ZSCALER AND SPLUNKDEPLOYMENT GUIDEJULY 2023, VERSION 1.4

BUSINESS DEVELOPMENT GUIDEZSCALER AND SPLUNK DEPLOYMENT GUIDE

Contents
Terms and Acronyms

6

About This Document

7

Zscaler Overview

7

Splunk Overview

7

Audience

7

Software Versions

7

Request for Comments

8

Zscaler and Splunk Introduction

9

ZIA Overview

9

ZPA Overview

9

Zscaler Resources

10

Splunk Cloud Overview

10

Splunk SOAR Overview

10

Splunk Resources

11

Application Architecture

12

Data Models

12

Zscaler Log Streams

13

Web and Tunnel Logs
Firewall and DNS Logs
Private Access Logs

Zscaler APIs
Python SDK
SandboxAudit Logs

Zscaler Technical Add-on

13
14
14

15
15
16
17

18

Source Types

18

Macros19

Splunk CIM

19Modular Inputs

19©2024 Zscaler, Inc. All rights reserved.

2

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler Splunk App

20

Dependencies

20

User Interface

20

Overview and Connections
Access Control
Threat Prevention
Private Access

20
21
22
23

Installation and Configuration

24

Zscaler Configuration

24

Output Strings

24

Splunk Configuration

26

Search Head
Forwarders (or Indexers)
Network Inputs
Modular Inputs
Macro Modification
Custom Field Mapping

Appendix A: Splunk Configs
Event Types, Tags, and Aliases

Appendix B: Splunk Essential Configuration(Using NSS VM -Stream Syslog Over TCP)

26
26
26
28
29
29

30
30

39

Configure Zscaler NSS

39

Add or Create Index

39

Log into Splunk InstanceConfigure New Index in Splunk
Add Zscaler Index in Splunk

Create Data Inputs
Splunk Connect for Syslog
TCP Data Input
Select the Desired Zscaler Source Type
Change Default App Context and Default index
Verify Incoming Logs
Inspect Log Fields
Extracted Log Fields
Verify Splunk’s Zscaler App

39
40
41

42
42
42
42
43
44
44
45
45

©2024 Zscaler, Inc. All rights reserved.

3

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix C: Splunk Essential Configuration(Using Cloud-to-Cloud Logging—HTTPS POST)

47

Configure Splunk Cloud to Ingest ZIA Logs Over HEC Input

47

Log into Splunk Cloud Tenant
Install Zscaler App and Zscaler TA in Your Cloud Tenant
Create Zscaler Index in Splunk
Add Zscaler Index in Splunk
Create a new Data Input and HEC token
Configure Data Input and HEC token
Copy the HEC Token Value
Determine the Splunk Cloud API Endpoint to Send Logs To

48
48
49
49
50
51
54
55

Configure Splunk Cloud to Fetch Zscaler Audit Logs and Sandbox Events

56

Log In to Splunk IDM Instance
Install Zscaler Splunk TA on Splunk IDM InstanceConfigure Zscaler Index on Splunk IDM Instance
Add Zscaler Account Used by Splunk IDM to Make API Calls to ZIA
Configure Input for Audit Logs
Fill in the Settings for Fetching ZIA Audit Logs
Configure Input for Sandbox Events
Fill in the Settings for Fetching ZIA Sandbox Events
Confirm that Both Input Settings are Saved and Enabled
Configure Zscaler for Cloud-to-Cloud Logging
Go to Cloud-to-Cloud Logging Section in ZIA Portal
Set Up the Cloud NSS Log Feed (Web)Set Up the Cloud NSS Log Feed (Firewall)
Add Other Log Source Types
Validate NSS Cloud Configuration
Verify Zscaler Splunk App

56
57
58
58
59
60
60
61
61
61
62
62
65
66
67
68

Appendix D: Using SOAR (formerly Phantom) with Zscaler and Splunk

69

SOAR components

69

A Sample Playbook to Showcase Zscaler and SOAR Integration

69

Configuring SOAR

71

Create new Event Label in SOAR
Create Automation User in SOAR
Installing Zscaler App on SOAR
Search for Zscaler App
Configure Zscaler App

71
72
73
73
74
©2024 Zscaler, Inc. All rights reserved.

4

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Test Connectivity Between SOAR and Zscaler
Installing Splunk App on SOAR
Search for Splunk App
Configure Splunk App
Test connectivity Between SOAR and Splunk
Download Zscaler Playbook
Edit the Playbook Settings

Configuring Splunk

75
76
76
77
79
79
80

81

Install Splunk ES AppManage Threat Intelligence within ES App
Notable Events and Forwarding to SOAR
Install SOAR App
Configure Automation User
Verify Events in SOAR
Inspect Actions Taken by SOAR

81
82
84
86
87
88
89

Appendix E: Zscaler Posture Control and Splunk

90

Create AWS S3 Bucket

90

Configuring ZPC to Send Alerts to AWS S3

91

Configuring AWS

93

Configuring Splunk

96

Appendix F: Requesting Zscaler Support

99©2024 Zscaler, Inc. All rights reserved.

5

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Terms and Acronyms
This table defines abbreviations used in the deployment guide. When applicable, a Request for Change (RFC) is includedin the Definition column for your reference.
Acronym
API
CA
CIM
CSV
DLP
DNS
DPD
GRE
ICMP
IKE
IPS
IPSec
LSS
NSS
NOC
PFS
PSK
SaaS
SIEM
SOAR
SOC
SSL
TCP Input
TLS
VDI
XFF
ZDX
ZIA
ZPA
ZPC

Definition
Application Programming Interface
Central Authority (Zscaler)
Common Information Model (Splunk-defined data model)
Comma-Separated Values
Data Loss Prevention
Domain Name Service
Dead Peer Detection (RFC 3706)
Generic Routing Encapsulation (RFC2890)
Internet Control Message Protocol
Internet Key Exchange (RFC2409)
Intrusion Prevention System
Internet Protocol Security (RFC2411)
Log Streaming Service
Nanolog Streaming Service
Network Operations Centre
Perfect Forward Secrecy
Pre-Share Key
Software as a Service
Security Incident and Event Management
Security Orchestration and Automation
Security Operations Centre
Secure Socket Layer (RFC6101)
Method of ingesting data in Splunk via TCP datagrams
Transport Layer Security
Virtual Desktop Infrastructure
X-Forwarded-For (RFC7239)
Zscaler Digital Experience (Zscaler)
Zscaler Internet Access (Zscaler)
Zscaler Private Access (Zscaler)
Zscaler Posture Control (Zscaler)©2024 Zscaler, Inc. All rights reserved.

6

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

About This Document
The following sections describe the organizations and requirements for the integration covered by this deployment guide.

Zscaler Overview
Zscaler (NASDAQ: ZS) enables the world’s leading organizations to securely transform their networks and applications fora mobile and cloud-first world. Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) services create fast, secureconnections between users and applications, regardless of device, location, or network. Zscaler delivers its services 100%in the cloud and offers the simplicity, enhanced security, and improved user experience that traditional appliances or
hybrid solutions can’t match. Used in more than 185 countries, Zscaler operates a massive, global cloud security platformthat protects thousands of enterprises and government agencies from cyberattacks and data loss. To learn more, see
Zscaler's website.

Splunk Overview
Splunk (NASDAQ: SPLK) is a world leader in data analytics, security incident management, orchestration and automation.
Zscaler traffic, status and access logs provide a rich and voluminous source of data for ingesting into the Splunk platform.
You can then use this information to enrich other data sources and generate interesting events related to businessservices and technology operations. To learn more, refer to Splunk's website.

Audience
This guide is for network administrators, endpoint and IT administrators, and security analysts responsible for deploying,monitoring, and managing enterprise security systems. This document is targeted and those interested in learning detailsof how Zscaler and Splunk interact, as well as providing guidance for integration of Zscaler and Splunk.
This can consist of:•Enterprise, Solution, and Security Architects•

SOC and NOC designers and managers•

Splunk designers, implementors, administrators, and operators•

Anyone with a general interest in Zscaler SIEM integration and reference materials

Notice that appendices are provided for those needing a foundational exposure to Splunk and NSS as it relates to thisintegration. For additional product and company resources, see:•

Zscaler Resources•

Splunk Resources•

Appendix F: Requesting Zscaler Support

Software Versions
This document was authored using the latest versions of ZIA, ZPA, and Splunk Cloud.

©2024 Zscaler, Inc. All rights reserved.

7

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Request for Comments•

For prospects and customers: Zscaler values reader opinions and experiences. Contact partner-doc-support@
zscaler.com to offer feedback or corrections for this guide.

•For Zscaler employees: Contact z-bd-sa@zscaler.com to reach the team that validated and authored theintegrations in this document.

If you have created searches, reports, dashboards, or other useful functionality that could be used with the app, submit
them for inclusion into the next version of the Zscaler Splunk App:•

Email: splunk-support@zscaler.com•

From the ZIA Admin Portal, go to Zscaler Community Products > Cloud Reporting and Management.

©2024 Zscaler, Inc. All rights reserved.

8

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler and Splunk Introduction
The following are overviews of the Zscaler and Splunk applications are described in this section. Zscaler and Splunk sharea large joint customer base where the two technologies interact, and our companies have a mutual partnership. In orderto ease integration of Zscaler capabilities into your environments, Zscaler has developed a ‘Splunk App" which simplifies
the ingestion of Zscaler generated data into the Splunk platform. This Splunk App makes the overall integration process
between our technologies more accessible for our joint customers.
you are using this guide to implement a solution at a government agency, some of the content might be
exclamation-triangle Ifdifferent
for your deployment. Efforts are made throughout the guide to note where government agencies mightneed different parameters or input. If you have questions, contact your Zscaler Account team.

ZIA Overview
ZIA is a secure internet and web gateway delivered as a service from the cloud. Think of it as a secure internet onramp—
all you do is make Zscaler your next hop to the internet via one of the following methods:•

Setting up a tunnel (GRE or IPSec) to the closest Zscaler data center (for offices).

•

Forwarding traffic via our lightweight Zscaler Client Connector or PAC file (for mobile employees).

No matter where users connect—a coffee shop in Milan, a hotel in Hong Kong, or a VDI instance in South Korea—they get
identical protection. ZIA sits between your users and the internet and inspects every transaction inline across multiple
security techniques (even within SSL).
You get full protection from web and internet threats. The Zscaler cloud platform supports Cloud Firewall, IPS,
Sandboxing, DLP, and Isolation, allowing you start with the services you need now and activate others as your needs grow.

ZPA Overview
ZPA is a cloud service that provides secure remote access to internal applications running on cloud or data center usinga Zero Trust framework. With ZPA, applications are never exposed to the internet, making them completely invisible
to unauthorized users. The service enables the applications to connect to users via inside-out connectivity rather thanextending the network to them.
ZPA provides a simple, secure, and effective way to access internal applications. Access is based on policies created by
the IT administrator within the ZPA Admin Portal and hosted within the Zscaler cloud. On each user device, software
called Zscaler Client Connector is installed. Zscaler Client Connector ensures the user’s device posture and extends a
secure microtunnel out to the Zscaler cloud when a user attempts to access an internal application.

©2024 Zscaler, Inc. All rights reserved.

9

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler Resources
The following table contains links to Zscaler resources based on general topic areas.
Name and Link

Description

ZIA Help Portal

Help articles for ZIA.

ZPA Help Portal

Help articles for ZPA.

ZPA Access Policies

Help link for how to configure ZPA access policies with a set of configuration
examples.

Zscaler Tools

Troubleshooting, security and analytics, and browser extensions that help
Zscaler determine your security needs.

Zscaler Training and Certification

Training designed to help you maximize Zscaler products.

Submit a Zscaler Support Ticket

Zscaler Support portal for submitting requests and issues.

The following table contains links to Zscaler resources for government agencies.
Name and Link
ZIA Help Portal

Description
Help articles for ZIA.

ZPA Help Portal

Help articles for ZPA.

ZPA Access Policies

Help link for how to configure ZPA access policies with a set of configuration
examples.

Zscaler Tools

Troubleshooting, security and analytics, and browser extensions that help
Zscaler determine your security needs.

Zscaler Training and Certification

Training designed to help you maximize Zscaler products.

Submit a Zscaler Support Ticket

Zscaler Support portal for submitting requests and issues.

Splunk Cloud Overview
Splunk Cloud Platform provides a complete suite of self-service service capabilities for you to ingest data, customize dataretention settings, customize user roles and centralized authentication, configure searches and dashboards, update yourIP Allow List and perform app management. Splunk Cloud Platform collects, searches, monitors, reports, and analyzes
all of your real-time and historical machine data using a cloud service that is centrally and uniformly delivered by Splunk
to its cloud customer base. In addition, you can use the Cloud Monitoring Console (CMC) to holistically monitor the data
consumption and health of your Splunk Cloud Platform environment. Finally, ensure your Operational Contacts are kept
up-to-date.

Splunk SOAR Overview
Splunk SOAR is a security orchestration, automation, and response (SOAR) application that empowers your SOC. Splunk
SOAR allows security analysts to work smarter, not harder, by automating repetitive tasks; triaging security incidents
faster with automated detection, investigation, and response; increasing productivity, efficiency, and accuracy; andstrengthening defenses by connecting and coordinating complex workflows across their team and tools. Splunk SOAR
also supports a broad range of security functions including event and case management, integrated threat intelligence,and collaboration tools and reporting.

©2024 Zscaler, Inc. All rights reserved.

10

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Splunk Resources
The following table contains links to Splunk support resources.
Name and Link
Splunk Documentation

Description
Splunk platform online documentation.

Splunk Cloud help

Splunk Cloud online help articles.

Splunk SOAR help

Splunk SOAR online help articles.

Splunk Common Information Model (CIM)

Description of Splunk’s CIM.

SOAR Demonstration

Video demonstration of Splunk's SOAR capabilities and uses.

Splunk and Zscaler partner page

Splunk’s Zscaler partner page.

©2024 Zscaler, Inc. All rights reserved.

11

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Application Architecture
Zscaler’s integration with Splunk follows Splunk’s well-defined framework for Splunk App. Splunk App is designed
specifically to be installed and run in a Splunk environment. The app is separated into two discreet parts, the technicaladd-on, and the Zscaler Splunk App.
The app takes advantage of several technologies in order to ingest data from Zscaler, which consists of log streams
generated from customer environments, and can also retrieve data using Zscaler APIs. The following diagram shows thesevarious interfaces.

Figure 1. Application architecture

The interfaces are detailed in the following sections.

Data Models
Zscaler and Splunk joint customers require Zscaler logging data to be in a format that is compatible with Splunk’s
Common Information Model (CIM) data model. The Zscaler Technical Add-On maps all Zscaler NSS fields into
CIM-compatible types, as well as tagging all events that are relevant to specific CIM data models.

©2024 Zscaler, Inc. All rights reserved.

12

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler Log Streams
Zscaler streams logs into the customer environments, facilitated by Zscaler-supplied virtual machines that execute in acustomer’s (or partner’s) hosted compute environment.
These virtual machines attach to the Zscaler cloud via outbound connections and receive encrypted and tokenized logs
to stream into customer log collection and SIEM platforms. The following table describes the various log streams.
Log Type

Streaming Technology

Platforms

Proxy

NSS - Web

VMware, AWS, and Azure

TunnelNSS - Web

VMware, AWS, and Azure

Firewall

NSS - CWF

VMware, AWS, and Azure

DNS

NSS - CWF

VMware, AWS, and Azure

Alert

NSS – CWF/Web

VMware, AWS, and Azure

App Auth

LSS

RedHat compatible (see doc for version specifics)

App Access

LSS

RedHat compatible (see doc for version specifics)

Browser Access

LSS

RedHat compatible (see doc for version specifics)

Proxy

NSS - Web

VMware, AWS, and Azure

Web and Tunnel Logs
A dedicated Zscaler NSS server delivers Zscaler web and tunnel logs. Event streams are generated for the following log
types:•

Proxy logs: all access logs processed by Zscaler proxy•Tunnel logs: up or down tunnel events and summary usage statistics•

Alerts: system alerts for events such as connectivity loss

For more information, see the following:•

NSS Feed Output Format: Web Logs (government agencies, see NSS Feed Output Format: Web Logs).

•

Adding NSS Feeds for Tunnel Logs (government agencies, see Adding NSS Feeds for Tunnel Logs).

•

Adding NSS Feeds for Alerts (government agencies, see Adding NSS Feeds for Alerts).

There is a dedicated Splunk event type for each of these log streams, detailed in the Source Types section.

Figure 2. Zscaler NSS web and tunnel data in Splunk©2024 Zscaler, Inc. All rights reserved.

13

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Firewall and DNS Logs
A dedicated Zscaler NSS server delivers Zscaler Firewall and DNS logs. Event streams are generated for the following log
types:•

Cloud Firewall logs: all access logs processed by Zscaler firewall•

DNS logs: logs for DNS traffic where DNS traffic is sent via Zscaler•

Alerts: system alerts for events such as connectivity loss

You can find details for all possible fields and formats, see:•NSS Feed Output Format: Firewall Logs (government agencies, see NSS Feed Output Format: Firewall Logs).

•

NSS Feed Output Format: DNS Logs (government agencies, see NSS Feed Output Format: DNS Logs).

•

Adding NSS Feeds for Alerts (government agencies, see Adding NSS Feeds for Alerts).

These log streams have a dedicated Splunk event type, detailed in the Source Types section.

Figure 3. Zscaler NSS firewall and DNS data in Splunk

Private Access Logs
ZPA has the following log types. Log formats expected by Splunk are JSON. You can find the default log string format fromthe drop-down menu in the Logging section of the ZPA Admin Portal.

Figure 4. Zscaler LSS ZPA data in Splunk©2024 Zscaler, Inc. All rights reserved.

14

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler APIs
Zscaler runs a number of open APIs for customer use, which include read and write functions. The current Splunkintegration focuses on read functions for Zscaler Sandbox detonation reports and Zscaler Admin audit logs. Full
specifications for the Zscaler API are found in the API Reference (government agencies, see API Reference).
Splunk makes use of these APIs via Splunk modular inputs. Both Sandbox and audit logs have dedicated Splunk event
types and are detailed in the Source Types section.

Figure 5. Zscaler APIs used by Splunk modular inputs

Clipboard-list

SOAR has existing write integrations to Zscaler API, details of these integrations are not in scope for thisdocument.

Python SDKThe Splunk App contains several scripts that interface with the Zscaler API, including a fork of a private SDK used by anumber of Zscaler technology partners. An unofficial version of the original SDK is located at the Zscaler Python SDK
GitHub repository.
The raw scripts and SDK are found in the bin/ directory of the Technical Add-On.

©2024 Zscaler, Inc. All rights reserved.

15

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Sandbox
The Zscaler Sandbox is used by customers to detonate unknown file samples, and determines if there’s malicious
behavior.
When the Sandbox analyzes files, the end user recipient might be quarantined or allowed to download the file. The
outcome is determined by customer-specific Sandbox policies. The latest policy constructs are found in Configuring the
Sandbox Policy (government agencies, see Configuring the Sandbox Policy).
Sandbox detonation results are significant to customers because a malicious verdict indicates a possibly compromised
user or risky user behavior that could jeopardize business. As such, Zscaler offers full Sandbox reporting as a productfeature and includes the capability to pull detailed sandbox post-detonation reports via API calls. Zscaler’s Splunktechnical add-on ingests these events, and the Zscaler Splunk App produces a number of derived reports.

Figure 6. How Sandbox modular input works

Figure 7. Zscaler Sandbox data in SplunkIt’s possible that Splunk ES can find a notable event and generate a response action and engage a SOAR platform such as
Splunk > SOAR via correlation. Note that SOAR has existing read and write integrations to Zscaler API, but details of these
integrations are not in scope for this document.
©2024 Zscaler, Inc. All rights reserved.

16

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Audit Logs
An audit log is generated as administrators access the Zscaler console and make changes within the console. Zscaler
makes these events available via the Zscaler API because they often must be archived outside of Zscaler. You canconfigure the Splunk Technical Add-On to ingest these logs.
When configured, the modular input tracks the state of the most recent log retrieval, then requests the delta for any logs
generated since the last successful retrieval.

Figure 8. How audit logs modular input works

Figure 9. Zscaler audit logs in Splunk©2024 Zscaler, Inc. All rights reserved.

17

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler Technical Add-on
The Zscaler Technical Add-On does all the hard work in accessing and processing Zscaler event information. This includes:•

Enabling compatibility with Splunk’s CIM data model•

Connecting to Zscaler APIs including modular input configuration•

Defining source types and search macros

The Add-On is a requirement for the Zscaler Splunk App because the app takes advantage of many configurations andcomponents defined in the Add-On.
You can download the Add-On from the Splunk Base.

Source Types
The following source types are defined in the Zscaler Technical Add-On, and cover the current possible inputs. Actual useof the source types might vary depending on the bundle and features to which the Zscaler customer subscribed.
There are no pre-configured data inputs. Data inputs must be configured by the Splunk Admin according to the Network
Inputs and Modular Inputs sections. Splunk’s best practice is to not permit the definition of network inputs in a Splunkapp.
Source Type

Function

Stream Format

zscalernss-web

ZIA Proxy Logs

Splunk CIM

zscalernss-tunnel

ZIA Tunnel Logs–up or down events and aggregate traffic stats

Name Value Pairs

zscalernss-fw

ZIA Firewall Logs

Name Value Pairs

zscalernss-dns

ZIA DNS Logs

Name Value Pairs

zscalernss-alerts

VM-related Alerts from Zscaler NSS VM(not applicable)

zscalerlss-zpa-audit

ZPA Audit Logs

JSON

zscalerlss-zpa-connector

App Connector Status Logs

JSON

zscalerlss-zpa-pse

Private Service Edge Status Logs

JSON

zscalerlss-zpa-app

User Activity Log

JSONzscalerlss-zpa-authUser Status Log

JSONzscalerlss-zpa-bba

Browser Access Logs

JSON

zscalerlss-zpa-web-inspection

Web Inspection (i.e., AppProtection logs)

JSON

zscalerapi-zia-audit

ZIA Administrative Audit Logs

API

zscalerapi-zia-sandbox

ZIA detailed Sandbox Logs (detonation)API

zscalernss-audit

Zscaler NSS Admin Logs via streaming (not API)

JSON

©2024 Zscaler, Inc. All rights reserved.

18

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

MacrosSplunk Macros are used to shortcut frequently used sets of search commands. The Technical Add-On defines several
search macros to:•Ease dashboard creation and the underlying reports.

•

Create a simple configuration point to a customer’s specific Zscaler data index.

The following search macros are defined in the Zscaler Technical Add-On, and are used extensively throughout the
Add-On and App. Zscaler suggests that any additional searches and reports created by Splunk admins and operators
leverage these macros.
You might need to modify these macros depending on your Splunk configuration. The Macro Modification section
contains more information.

Splunk CIM
Zscaler implemented the Splunk CIM to integrate tightly with Splunk enterprise security. The Zscaler Technical Add-On
defines all the necessary field aliases and event tags to be compatible with Splunk’s CIM.
Zscaler tags events of the following types, models:•

Web and Proxy•

Security and Malware•

Firewall and IPS

•

VPN

•

DLP and Incident

Modular Inputs
Zscaler’s Technical Add-On takes advantage of Splunk’s modular inputs to connect to Zscaler’s APIs for Sandbox andadmin logs. You can configure each API configured separately, and multiple instances are called if there is a need to ingest
logs from multiple Zscaler tenants.
The modular inputs are written in Python and are engineered for compatibility with Splunk Cloud (although full Splunk
Cloud validation hasn’t occurred). Modular inputs use Zscaler and Splunk SDKs. The Zscaler SDK simplifies access to
Zscaler APIs, and the Splunk SDK secures API keys and passwords, and leverages Splunk search and state-tracking.
All modular input files are in the /bin section of the Technical Add-On.

©2024 Zscaler, Inc. All rights reserved.

19

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Zscaler Splunk App
The Zscaler Splunk App front-ends all the Zscaler data ingested into Splunk. This includes a large volume of saved
searches and dashboards. The app’s menu is laid out similar to core Zscaler capabilities of Access Control, Threat
Prevention, Private Access, and Data Protection. You can drill down into each area.

Figure 10. Splunk app menu

You can download the app from the Splunk Base.

Dependencies
The Zscaler Splunk app is dependent on Zscaler’s Technical Add-On (mandatory).

User Interface
The Splunk App is the visual component of Zscaler’s Splunk integration. Other CIM-compatible Splunk tools or apps alsovisualize Zscaler data, but the app leverages a number of fields that are not part of the Splunk CIM. The following is aseries of screenshots from the Splunk App.
The Zscaler Splunk App can serve as a useful base for you to create your own Zscaler-oriented searches, reports, anddashboards.

Overview and Connections

Figure 11. Zscaler overview in Splunk©2024 Zscaler, Inc. All rights reserved.

20

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Access Control

Figure 12. Bandwidth Report

Figure 13. Web Access Controls©2024 Zscaler, Inc. All rights reserved.

21

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Threat Prevention

Figure 14. Threat Prevention overview

Figure 15. Sandbox©2024 Zscaler, Inc. All rights reserved.

22

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Private AccessFigure 16. Private Access overview

Figure 17. Private Access health©2024 Zscaler, Inc. All rights reserved.

23

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Installation and Configuration
The following sections describe how to configure the Zscaler and Splunk integration.

Zscaler Configuration
You must configure Zscaler to send data into Splunk. Follow Zscaler’s existing documentation to set up the baseconfiguration of NSS, LSS, and API access. The relevant reference links are:•Understanding Nanolog Streaming Service•

About the Log Streaming Service•

About Cloud Service API Key Management

Output Strings

Clipboard-list

If you copy and paste the following outputs, remove any spaces between the fields when configuring an NSS
feed in the ZIA Admin Portal. Removing all spaces allows you to save your NSS feed configuration successfully.

The Splunk App uses fields not included in the base output fields. Configure each of your LSS and NSS feeds as follows:
NSS Web%d{yy}-%02d{mth}-%02d{dd}-%02d{hh}:%02d{mm}:%02d{ss}\treason=%s{reason}\tevent_id=%d{recordid}\tmd5=%s{bamd5}\tprotocol=%s{proto}\taction=%s{action}\ttransactionsize=%d{totalsize}\tresponsesize=%d{respsize}\trequestsize=%d{reqsize}\
turlcategory=%s{urlcat}\tserverip=%s{sip}\tclienttranstime=%d{ctime}\
trequestmethod=%s{reqmethod}\trefererURL=%s{ereferer}\tuseragent=%s{ua}\tproduct=NSS\
tlocation=%s{location}\tClientIP=%s{cip}\tstatus=%s{respcode}\tuser=%s{login}\turl=%s{eurl}\tvendor=Zscaler\thostname=%s{ehost}\tclientpublicIP=%s{cintip}\
tthreatcategory=%s{malwarecat}\tthreatname=%s{threatname}\tfiletype=%s{filetype}\
tappname=%s{appname}\tpagerisk=%d{riskscore}\tdepartment=%s{dept}\turlsup
ercategory=%s{urlsupercat}\tappclass=%s{appclass}\tdlpengine=%s{dlpeng}\
tssldecrypted=%s{ssldecrypted}\turlclass=%s{urlclass}\tthreatclass=%s{malwareclass}\
tdlpdictionaries=%s{dlpdict}\tfileclass=%s{fileclass}\tbwthrottle=%s{bwthrottle}\
tservertranstime=%d{stime}\tcontenttype=%s{contenttype}\tunscannabletype=%s{unscannabl
etype}\tdevicehostname=%s{devicehostname}\tdeviceowner=%s{deviceowner}\n
NSS Tunnel Sample%s{datetime}\tRecordtype=%s{tunnelactionname}\ttunneltype=%s{tunneltype}\tuser=%s{vpncredentialname}\tlocation=%s{locationname}\tsourceip=%s{sourceip}\
tdestinationip=%s{destvip}\tsourceport=%d{srcport}\ttxbytes=%lu{txbytes}\
trxbytes=%lu{rxbytes}\tdpdrec=%d{dpdrec}\recordid=%d{recordid}\n
IKE Phase 1%s{datetime}\tRecordtype=%s{tunnelactionname}\ttunneltype=IPSEC_IKEV %d{ikeversion}\tuser=%s{vpncredentialname}\tlocation=%s{locationname}\tsourceip=%s{sourceip}\
tdestinationip=%s{destvip}\tsourceport=%d{srcport}\tdestinationport=%d{dstport}\
tlifetime=%d{lifetime}\tikeversion=%d{ikeversion}\tspi_in=%lu{spi_in}\tspi_out=%lu{spi_out}\talgo=%s{algo}\tauthentication=%s{authentication}\tauthtype=%s{authtype}\
recordid=%d{recordid}\n©2024 Zscaler, Inc. All rights reserved.

24

ZSCALER AND SPLUNK DEPLOYMENT GUIDEIKE Phase 2%s{datetime}\tRecordtype=%s{tunnelactionname}\ttunneltype=IPSEC_IKEV%d{ikeversion}\tuser=%s{vpncredentialname}\tlocation=%s{locationname}\tsourceip=%s{sourceip}\tdestinationip=%s{destvip}\tsourceport=%d{srcport}\tsourceportstart=%d{srcportstart}\tdestinationportstart=%d{destportstart}\
tsrcipstart=%s{srcipstart}\tsrcipend=%s{srcipend}\tdestinationipstart=%s{destipstart}\
tdestinationipend=%s{destipend}\tlifetime=%d{lifetime}\tikeversion=%d{ikeversion}\
tlifebytes=%d{lifebytes}\tspi=%d{spi}\talgo=%s{algo}\tauthentication=%s{authentic
ation}\tauthtype=%s{authtype}\tprotocol=%s{protocol}\ttunnelprotocol=%s{tunnelpro
tocol}\tpolicydirection=%s{policydirection}\recordid=%d{recordid}\nTunnel Event%s{datetime}\tRecordtype=%s{tunnelactionname}\ttunneltype=%s{tunneltype}\tuser=%s{vpncredentialname}\tlocation=%s{locationname}\tsourceip=%s{sourceip}\
tdestinationip=%s{destvip}\tsourceport=%d{srcport}\tevent=%s{event}\
teventreason=%s{eventreason}\recordid=%d{recordid}\n
NSS CFW
datetime=%s{time}\tuser=%s{login}\tdepartment=%s{dept}\tlocationname=%s{location}\
tcdport=%d{cdport}\tcsport=%d{csport}\tsdport=%d{sdport}\tssport=%d{ssport}\
tcsip=%s{csip}\tcdip=%s{cdip}\tssip=%s{ssip}\tsdip=%s{sdip}\ttsip=%s{tsip}\ttunsport=%d{tsport}\ttuntype=%s{ttype}\taction=%s{action}\tdnat=%s{dnat}\
tstateful=%s{stateful}\taggregate=%s{aggregate}\tnwsvc=%s{nwsvc}\tnwapp=%s{nwapp}\tproto=%s{ipproto}\tipcat=%s{ipcat}\tdestcountry=%s{destcountry}\
tavgduration=%d{avgduration}\trulelabel=%s{rulelabel}\tinbytes=%ld{inbytes}\
toutbytes=%ld{outbytes}\tduration=%d{duration}\tdurationms=%d{durationms}\
tnumsessions=%d{numsessions}\tipsrulelabel=%s{ipsrulelabel}\tthreatcat=%s{threatcat}\tthreatname=%s{threatname}\tdeviceowner=%s{deviceowner}\tdevicehostname=%s{devicehostname}\n
NSS DNS
datetime=%s{time}\tuser=%s{login}\tdepartment=%s{dept}\tlocation=%s{location}\
treqaction=%s{reqaction}\tresaction=%s{resaction}\treqrulelabel=%s{reqrulelabel}\tresrulelabel=%s{resrulelabel}\tdns_reqtype=%s{reqtype}\tdns_req=%s{req}\tdns_
resp=%s{res}\tsrv_dport=%d{sport}\tdurationms=%d{durationms}\tclt_sip=%s{cip}\tsrv_
dip=%s{sip}\tcategory=%s{domcat}\tdeviceowner=%s{deviceowner}\tdevicehostname=%s{device
hostname}\nNSS Alert
Admin Audit\{ "sourcetype" : "zscalernss-audit", "event" :\{"time":"%s{time}","recordid":"%d{recordid}","action":"%s{action}","category":"%s{category}","subcategory":"%s{subcategory}","resource":"%s{resource}","interface":"%s{interface}","adminid":"%s{adminid}","clientip":"%s{clientip}","result":"%s{result}","errorcode":"%s{errorcode}","auditlogtype":"%s{auditlogtype}","preaction":%s{preaction},"postaction":%s{postaction}\}\}All ZPA (LSS) logs
All ZPA log types use default JSON drop-down log format available in the Logging section of the ZPA Admin Portal.

©2024 Zscaler, Inc. All rights reserved.

25

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Splunk Configuration
Prior to installing the App and Technical Add-on, Splunk architects or designers must determine where to install eachcomponent. These decisions can affect the overall Splunk design and enterprise change controls when implementing
Zscaler Logs and APIs into Splunk.

Search HeadThe Zscaler Splunk App can be installed exclusively on any Splunk search head. The app does not need any forwarding or
index time execution.
If taking advantage of Zscaler’s Sandbox APIs, install the Zscaler Technical Add-On on a search head because the app
leverages saved Splunk Searches and Alerts to find any files pending execution in the Zscaler sandbox.

Forwarders (or Indexers)
Install the Zscaler Technical Add-On on either the Splunk heavy forwarders or indexers that receive the TCP data inputs
for the Zscaler source types (the receivers of NSS and LSS streams).
Zscaler follows normal Splunk WebUI- or CLI-based installation methods:•

The App and TA can be downloaded from the following locations:•Zscaler Splunk App•

Zscaler Technical Add-On for Splunk

Network Inputs
Zscaler NSS and LSS streams are typically sent to Splunk via network inputs. This is usually inbuilt Splunk TCP input andcan also be HTTP Event Collector, i.e., HEC (if using cloud NSS).

Figure 18. Example Splunk TCP inputs©2024 Zscaler, Inc. All rights reserved.

26

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Example Configuration

Figure 19. Example Splunk TCP inputs

Note the UEBA is an artifact of a non-Zscaler App and is not relevant to the Zscaler configuration.

©2024 Zscaler, Inc. All rights reserved.

27

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Modular Inputs
Zscaler APIs are addressed via Splunk modular inputs. These can be seen, set, and configured in the TA’s setup page,
and there is a specific configuration for each input type. Splunk best practice uses a Global Account for the API user,
password, and key, and a setup screen when adding each input.

Figure 20. Adding a global accountFigure 21. Modular input configuration example (Sandbox)

Take care, when defining the interval, that you stay within your API rate limits. For more information, see API Rate Limit
Summary (government agencies, see API Rate Limit Summary)©2024 Zscaler, Inc. All rights reserved.

28

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Macro Modification
Your preexisting Splunk environment might use an index name different to what Zscaler’s Splunk App and Technical
Add-On expect. In this case, modify the macros.conf (or create a local/macros.conf) and override theindex= zscalerlogs to match the index name used within your Splunk environment.
For example, if you use the name zscalerlogs you can change each macro definition as follows:
definition = index= zscalerlogs sourcetype="zscalernss-dns"
Figure 22. Macro modification example

Custom Field Mapping
The Zscaler Splunk App and Technical Add-On look for field names as shown in Output Strings. If you use different fieldnames, you or the Splunk admin must:
1. Change your Zscaler log stream configurations to match what the app is expecting.
2. Defined local field aliases to align to what the app is expecting.

©2024 Zscaler, Inc. All rights reserved.

29

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix A: Splunk Configs
Event Types, Tags, and Aliases[Zscaler_CFW]
search = (sourcetype=zscalernss-fw)[Zscaler_DNS]
search = (sourcetype=zscalernss-dns)[Zscaler_Proxy_General]
search = (sourcetype=zscalernss-web)[Zscaler_Proxy_DLP]
search = (sourcetype=zscalernss-web ruletype="DLP")[Zscaler_ZPA]
search = (sourcetype=zscalerlss-zpa-app) OR (sourcetype=zscalerlss-zpa-auth) OR(sourcetype=zscalerlss-zpa-connector)[Zscaler_Proxy_Malware]
search = (sourcetype="zscalernss-web" threatname!="None")[Zscaler_Sandbox]
search = (sourcetype=zscalerapi-zia-sandbox)[Zscaler_Audit]
search = (sourcetype=zscalerapi-zia-audit)
Figure 23. eventtypes.conf©2024 Zscaler, Inc. All rights reserved.

30

ZSCALER AND SPLUNK DEPLOYMENT GUIDE[eventtype=Zscaler_DNS]
dns = enabled
network = enabledresolution = enabled[eventtype=Zscaler_CFW]
communicate = enabled
network = enabled[eventtype=Zscaler_Proxy_General]communicate = enabled
end = enabled
network = enabled
performance = enabled
proxy = enabled
session = enabledstart = enabled
web = enabled[eventtype=Zscaler_Proxy_Malware]
attack = enabled
ids = enabled
malware = enabled[eventtype=Zscaler_Proxy_DLP]
dlp = enabled
incident = enabled[eventtype=Zscaler_ZPA]
authentication = enabledcommunicate = enabled
end = enabled
network = enabled
performance = enabled
session = enabledstart = enabled
vpn = enabled
Figure 24. tags.conf©2024 Zscaler, Inc. All rights reserved.

31

ZSCALER AND SPLUNK DEPLOYMENT GUIDE[zscalernss-alerts]
pulldown_type = 1
category = Network & Security
description = Zscaler NSS System Alerts[zscalernss-dns]
EVAL-vendor_product = Zscaler_ZIA_Firewall
FIELDALIAS-clt_sip_as_src = clt_sip AS src
FIELDALIAS-clt_sip_as_src_ip = clt_sip AS src_ip
FIELDALIAS-dns_req_as_query = dns_req AS query
FIELDALIAS-dns_reqtype_as_record_type = dns_reqtype AS record_type
FIELDALIAS-dns_resp_as_answer = dns_resp AS answer
FIELDALIAS-durationms_as_response_time = durationms AS response_time
FIELDALIAS-srv_dip_as_dest = srv_dip AS dest
FIELDALIAS-srv_dip_as_dest_ip = srv_dip AS dest_ip
FIELDALIAS-srv_dport_as_dest_port = srv_dport AS dest_port
pulldown_type = 1
category = Network & Security
description = Zscaler DNS Control Logs
[zscalernss-web]
EVAL-action = lower(action)
EVAL-app = Zscaler
EVAL-dlp_type = "Inline Gateway"
EVAL-duration = clienttranstime + servertranstime
EVAL-dvc = "Zscaler Cloud Proxy"
EVAL-dvc_zone = "Cloud Proxy"
EVAL-vendor_product = "Zscaler_ZIA_Proxy"
FIELDALIAS-ClientIP_as_src = ClientIP AS src
FIELDALIAS-ClientIP_as_src_ip = ClientIP AS src_ip
FIELDALIAS-aob_gen_zscalernss_web_alias_1 = protocol AS transport
FIELDALIAS-aob_gen_zscalernss_web_alias_2 = user AS src_user
FIELDALIAS-aob_gen_zscalernss_web_alias_3 = dlpengine AS severity
FIELDALIAS-aob_gen_zscalernss_web_alias_4 = threatname AS signature
FIELDALIAS-aob_gen_zscalernss_web_alias_5 = contenttype AS http_content_type
FIELDALIAS-aob_gen_zscalernss_web_alias_6 = hostname AS dest
FIELDALIAS-clientpublicIP_as_src_translated_ip = clientpublicIP AS src_translated_ip
FIELDALIAS-clienttranstime_as_response_time = clienttranstime AS response_time©2024 Zscaler, Inc. All rights reserved.

32

ZSCALER AND SPLUNK DEPLOYMENT GUIDEFIELDALIAS-department_as_src_user_bunit = department AS src_user_bunit
FIELDALIAS-dlpdictionaries_as_signature = dlpdictionaries AS signature
FIELDALIAS-filename_as_file_name = filename AS file_name
FIELDALIAS-md5_as_file_hash = md5 AS file_hash
FIELDALIAS-refererURL_as_http_referrer = refererURL AS http_referrer
FIELDALIAS-requestmethod_as_http_method = requestmethod AS http_method
FIELDALIAS-requestsize_as_bytes_in = requestsize AS bytes_in
FIELDALIAS-responsesize_as_bytes_out = responsesize AS bytes_out
FIELDALIAS-serverip_as_dest_ip = serverip AS dest_ip
FIELDALIAS-serverip_as_dest_translated_ip = translated_ip hostname AS dest
FIELDALIAS-threatcategory_as_category = threatcategory AS category
FIELDALIAS-transactionsize_as_bytes = transactionsize AS bytes
FIELDALIAS-urlcategory_as_category = urlcategory AS category
FIELDALIAS-useragent_as_http_user_agent = useragent AS http_user_agent
REPORT-ta_builder_internal_use_kv_format_results_for_zscalernss_web =ta_builder_internal_use_kv_format_results_for_zscalernss_web
category = Network & Security
description = Zscaler Web/Proxy Logs
pulldown_type = 1[zscalerlss-zpa-app]
EVAL-app = Zscaler
EVAL-vendor_product = Zscaler_ZPA
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_1 = ServerIP AS dest_ip
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_2 = ClientPublicIP AS src_ip
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_4 = Application AS app
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_5 = ServicePort AS dest_port
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_6 = ConnectorPort AS src_port
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_7 = Host AS dest
SHOULD_LINEMERGE = 0
category = Network & Security
description = Zscaler ZPA App Logs
pulldown_type = 1[zscalerlss-zpa-auth]
EVAL-app = Zscaler
FIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_1 = Username AS user
FIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_3 = PublicIP AS src©2024 Zscaler, Inc. All rights reserved.

33

ZSCALER AND SPLUNK DEPLOYMENT GUIDEFIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_4 = SessionStatus AS action
FIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_5 = Application AS app
FIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_6 = ServicePort AS dest_port
FIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_7 = ConnectorPort AS src_port
FIELDALIAS-aob_gen_zscalerlss_zpa_auth_alias_8 = Host AS dest
SHOULD_LINEMERGE = 0
category = Network & Security
description = Zscaler ZPA Auth Logs
pulldown_type = 1[zscalerlss-zpa-connector]
EVAL-app = Zscaler
FIELDALIAS-aob_gen_zscalerlss_zpa_connector_alias_1 = Application AS app
FIELDALIAS-aob_gen_zscalerlss_zpa_connector_alias_2 = ServicePort AS dest_port
FIELDALIAS-aob_gen_zscalerlss_zpa_connector_alias_3 = ConnectorPort AS src_port
FIELDALIAS-aob_gen_zscalerlss_zpa_connector_alias_4 = Host AS dest
SHOULD_LINEMERGE = 0
category = Network & Security
description = Zscaler ZPA Connector Logs
pulldown_type = 1[zscalernss-fw]
EVAL-action = eval action=if(like(action, "%Allow%"), "allowed", action)
EVAL-app = Zscaler
EVAL-bytes = inbytes + outbytes
EVAL-vendor_product = Zscaler_ZIA_Firewall
FIELDALIAS-cdip_as_dest_ip = cdip AS dest_ip
FIELDALIAS-cdport_as_dest_port = cdport AS dest_port
FIELDALIAS-csip_as_src = csip AS src
FIELDALIAS-csip_as_src_ip = csip AS src_ip
FIELDALIAS-csport_as_src_port = csport AS src_port
FIELDALIAS-csport_as_src_translated_port = csport AS src_translated_port
FIELDALIAS-inbytes_as_bytes_in = inbytes AS bytes_in
FIELDALIAS-locationname_as_src_zone = locationname AS src_zone
FIELDALIAS-outbytes_as_bytes_out = outbytes AS bytes_out
FIELDALIAS-proto_as_protocol = proto AS protocol
FIELDALIAS-proto_as_transport = proto AS transport
FIELDALIAS-sdip_as_dest = sdip AS dest
©2024 Zscaler, Inc. All rights reserved.

34

ZSCALER AND SPLUNK DEPLOYMENT GUIDEFIELDALIAS-sdip_as_dest_translated_ip = sdip AS dest_translated_ip
FIELDALIAS-sdport_as_dest_translated_port = sdport AS dest_translated_port
FIELDALIAS-tsip_as_src_translated_ip = tsip AS src_translated_ip
category = Network & Security
description = Zscaler Firewall Logs
pulldown_type = 1[zscalerapi-zia-audit]
TRUNCATE=0
category = Network & Security
description = Zscaler ZIA Admin Audit Logs
pulldown_type = 1
FIELDALIAS-cloudname = "log{}.AA in Cloud" AS cloudname
FIELDALIAS-action = "log{}.Action" AS action
FIELDALIAS-category = "log{}.Category" AS category
FIELDALIAS-src_ip = "log{}.Client IP" AS src_ip
FIELDALIAS-interface = "log{}.Interface" AS interface
FIELDALIAS-post_action = "log{}.Post Action" AS post_action
FIELDALIAS-pre_action = "log{}.Pre Action" AS pre_action
FIELDALIAS-resource = "log{}.Resource" AS resource
FIELDALIAS-result = "log{}.Result" AS result
FIELDALIAS-sub_category = "log{}.Subcategory" AS sub_category
FIELDALIAS-time = "log{}.Time" AS time
FIELDALIAS-user = "log{}.User" AS user
[zscalerapi-zia-sandbox]
TRUNCATE=0
category = Network & Security
description = Zscaler Sandbox detonation reports
pulldown_type = 1
FIELDALIAS-class_category = "Full Details.Classification.Category" AS class_category
FIELDALIAS-class_detect_mal = "Full Details.Classification.DetectedMalware" ASclass_detect_mal
FIELDALIAS-class_score = "Full Details.Classification.Score" AS class_score
FIELDALIAS-class_type = "Full Details.Classification.Type" AS class_type
FIELDALIAS-exploit_risk = "Full Details.Exploit{}.Risk" AS exploit_risk
FIELDALIAS-exploit_sig = "Full Details.Exploit{}.Signature" AS exploit_sig
FIELDALIAS-exploit_sig_source = "Full Details.Exploit{}.SignatureSources{}" AS
exploit_sig_source©2024 Zscaler, Inc. All rights reserved.

35

ZSCALER AND SPLUNK DEPLOYMENT GUIDEFIELDALIAS-file_cert = "Full Details.FileProperties.DigitalCerificate" AS file_cert
FIELDALIAS-file_size = "Full Details.FileProperties.FileSize" AS file_size
FIELDALIAS-file_type = "Full Details.FileProperties.FileType" AS file_type
FIELDALIAS-file_cert_issuer = "Full Details.FileProperties.Issuer" AS file_cert_issuer
FIELDALIAS-file_hash = "Full Details.FileProperties.MD5" AS file_hash
FIELDALIAS-md5 = "Full Details.FileProperties.MD5" AS md5
FIELDALIAS-file_cert_root = "Full Details.FileProperties.RootCA" AS file_cert_root
FIELDALIAS-sha1 = "Full Details.FileProperties.SHA1" AS sha1
FIELDALIAS-ssdeep = "Full Details.FileProperties.SSDeep" AS ssdeep
FIELDALIAS-sha2 = "Full Details.FileProperties.Sha256" AS sha2
FIELDALIAS-sha256 = "Full Details.FileProperties.Sha256" AS sha256
FIELDALIAS-net_risk = "Full Details.Networking{}.Risk" AS net_risk
FIELDALIAS-net_sig = "Full Details.Networking{}.Signature" AS net_sig
FIELDALIAS-net_sig_source = "Full Details.Networking{}.SignatureSources{}" AS
net_sig_source
FIELDALIAS-country = "Full Details.Origin.Country" AS country
FIELDALIAS-language = "Full Details.Origin.Language" AS language
FIELDALIAS-orig_risk = "Full Details.Origin.Risk" AS orig_risk
FIELDALIAS-persist_risk = "Full Details.Persistence{}.Risk" AS persist_risk
FIELDALIAS-persist_sig = "Full Details.Persistence{}.Signature" AS persist_sig
FIELDALIAS-persist_sig_source = "Full Details.Persistence{}.SignatureSources{}" ASpersist_sig_source
FIELDALIAS-bypass_risk = "Full Details.SecurityBypass{}.Risk" AS bypass_risk
FIELDALIAS-bypass_sig = "Full Details.SecurityBypass{}.Signature" AS bypass_sig
FIELDALIAS-bypass_sig_source = "Full Details.SecurityBypass{}.SignatureSources{}" ASbypass_sig_source
FIELDALIAS-stealth_risk = "Full Details.Stealth{}.Risk" AS stealth_risk
FIELDALIAS-stealth_sig = "Full Details.Stealth{}.Signature" AS stealth_sig
FIELDALIAS-stealth_sig_source = "Full Details.Stealth{}.SignatureSources{}" ASstealth_sig_source
FIELDALIAS-category = "Full Details.Summary.Category" AS category
FIELDALIAS-duration = "Full Details.Summary.Duration" AS duration
FIELDALIAS-start_time = "Full Details.Summary.StartTime" AS start_time
FIELDALIAS-status = "Full Details.Summary.Status" AS status
FIELDALIAS-risk = "Full Details.SystemSummary{}.Risk" AS risk
FIELDALIAS-signature = "Full Details.SystemSummary{}.Signature" AS signature
FIELDALIAS-sig_source = "Full Details.SystemSummary{}.SignatureSources{}" AS sig_source[zscalerlss-zpa-bba]©2024 Zscaler, Inc. All rights reserved.

36

ZSCALER AND SPLUNK DEPLOYMENT GUIDEEVAL-app = Zscaler
EVAL-vendor_product = Zscaler_ZPA
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_1 = ServerIP AS dest_ip
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_2 = ClientPublicIP AS src_ip
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_4 = Application AS app
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_5 = ServicePort AS dest_port
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_6 = ConnectorPort AS src_port
FIELDALIAS-aob_gen_zscalerlss_zpa_app_alias_7 = Host AS dest
SHOULD_LINEMERGE = 0
category = Network & Security
description = Zscaler ZPA Browser Access Logs
pulldown_type = 1
Figure 25. props.conf[z-dns]definition = index=zscaler sourcetype="zscalernss-dns"
iseval = 0[z-fw]
definition = index=zscaler sourcetype="zscalernss-fw"
iseval = 0[z-web]definition = index=zscaler sourcetype="zscalernss-web"iseval = 0[z-sandbox]
definition = index=zscaler sourcetype="zscalerapi-zia-sandbox"
iseval = 0[z-audit]definition = index=zscaler sourcetype="zscalerapi-zia-audit"
iseval = 0[z-index]
definition = index=zscaler
iseval = 0[z-zpa]©2024 Zscaler, Inc. All rights reserved.

37

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

definition = index=zscaler sourcetype="zscalerlss-zpa*"
iseval = 0[z-zpa-app]
definition = index=zscaler sourcetype="zscalerlss-zpa-app"
iseval = 0[z-zpa-auth]definition = index=zscaler sourcetype="zscalerlss-zpa-auth"iseval = 0[z-zpa-con]definition = index=zscaler sourcetype="zscalerlss-zpa-connector"
iseval = 0[z-webuser-list]
definition = tstats prestats=false local=false summariesonly=true count from
datamodel=Web where nodename=Web.Proxy by Web.user | rename Web.user AS user
iseval = 0[z-zpauser-list]
definition = tstats count AS "Count of VPN" from datamodel=Network_Sessions where(nodename = All_Sessions.VPN) groupby All_Sessions.user prestats=true | stats dedup_
splitvals=t count AS "Count of VPN" by All_Sessions.user | sort limit=100 All_Sessions.
user | fields - _span | rename All_Sessions.user AS user | fillnull "Count of VPN" |fields user, "Count of VPN"
iseval = 0
Figure 26. macros.conf©2024 Zscaler, Inc. All rights reserved.

38

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix B: Splunk Essential Configuration (Using NSS VM-Stream Syslog Over TCP)
This appendix details how to perform the initial integration between Splunk and Zscaler for logs that are streamed to a
Splunk instance from ZIA using Syslog over plain text TCP.

Configure Zscaler NSS
Zscaler configuration guides are available at the following links. For more information, see Understanding Nanolog
Streaming Service (government agencies, see Understanding Nanolog Streaming Service).
Deploy NSS•

NSS Deployment Guide for Microsoft Azure (government agencies, see NSS Deployment Guide for Microsoft
Azure).

•NSS Deployment Guide for Amazon Web Services (government agencies, see NSS Deployment Guide for Amazon
Web Services).

•NSS Deployment Guide for VMWare vSphere (government agencies, see NSS Deployment Guide for VMWarevSphere).

•Configuring Advanced NSS Settings (government agencies, see Configuring Advanced NSS Settings).

•

Troubleshooting Deployed NSS Servers (government agencies, see Troubleshooting Deployed NSS Servers).

Add NSS Feeds•

Adding NSS Feeds (government agencies, see Adding NSS Feeds).

Add or Create Index
This section requires Admin access to a working instance of Splunk.

Log into Splunk Instance
By default, Splunk login portal listens on TCP port 8000. Log in using your admin username and password by connecting
to your Splunk instance over HTTPS.

Figure 27. Log in to Splunk©2024 Zscaler, Inc. All rights reserved.

39

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure New Index in Splunk
The index is the repository for Splunk Enterprise data. Splunk Enterprise transforms incoming data into events, which it
stores in indexes.
Splunk Enterprise manages indexes to facilitate flexible searching and fast data retrieval, eventually archiving themaccording to a user-configurable schedule.

Figure 28. Log flow pipeline©2024 Zscaler, Inc. All rights reserved.

40

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

After logging into Splunk, go to Settings > Indexes > New Index.

Figure 29. View indexes

Add Zscaler Index in Splunk
Zscaler creates an index titled zscaler. Because the Splunk App for Zscaler looks for data written at index zscaler by
default, setting index=zscaler allows us to use the Splunk App for Zscaler out of the box.
In the New Index dialog, type zscaler without quotes (case sensitive) and click Save.

Figure 30. Add Zscaler index in Splunk©2024 Zscaler, Inc. All rights reserved.

41

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Create Data Inputs
Splunk Connect for Syslog
Syslog is Splunk’s preferred method of ingesting high volumes of data. For more information, refer to Welcome to Splunk
Connect for Syslog!

TCP Data Input
Go to Settings > Data Inputs > TCP (Add new).
The Add Data wizard is displayed. This step configures Splunk to listen on TCP using port 514. NSS supports only TCP, but
you can configure the destination port. Most administrators use port 514 as it is the default port for UDP-based syslog.
After configuring the SIEM port, click Next.

Figure 31. Configure new TCP input

Select the Desired Zscaler Source Type
When Splunk indexes data, it does so from a source entity that provides data for Splunk to extract (e.g., Windows event
logs or *nix syslogs). Splunk tags incoming data with a source field as it gets indexed. The source type is an indicator forthe type of data, so that Splunk knows how to properly format and extract it as it comes in. It's also a convenient way tocategorize data because you can use Splunk search to display all data of a certain source type.
For example, Windows event logs, NSS web logs, NSS Firewall logs are all source types.
If multiple web NSS servers send logs to the same Splunk instance, the servers all belong to the same source type, buteach one of these servers constitute an independent source.

©2024 Zscaler, Inc. All rights reserved.

42

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Splunk apps use sources and source types to extract knowledge from the data they index. Enter zscaler to display all
possible Zscaler-specific source types. Select the option based on the kind of Zscaler logs sent to Splunk.

Figure 32. Select desired Zscaler source type

Change Default App Context and Default index
On the same page:
1. Select Zscaler Splunk App as the App context.
2. Select zscaler as the index from the drop-down menu.
3. Click Review and then Submit.

Figure 33. Change default app context©2024 Zscaler, Inc. All rights reserved.

43

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Verify Incoming Logs
Click Start Searching to verify that logs are flowing from Zscaler into Splunk.

Figure 34. Verify incoming logs

Inspect Log Fields
This displays only the logs that are from Zscaler.

Figure 35. Inspect log fields©2024 Zscaler, Inc. All rights reserved.

44

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Extracted Log Fields
Verify that the index and source type of the incoming logs match what you set up earlier.

Figure 36. View extracted log fields

Verify Splunk’s Zscaler App
Go to Apps > Zscaler Splunk App.
The window is populated with incoming Zscaler data.

Figure 37. Verify Splunk Zscaler app©2024 Zscaler, Inc. All rights reserved.

45

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

If a particular panel is not populated, click the Search icon next to it. This shows the query that the panel is runningbehind the scenes to help with troubleshooting.

Figure 38. Verify Splunk Zscaler app©2024 Zscaler, Inc. All rights reserved.

46

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix C: Splunk Essential Configuration (Using Cloud-toCloud Logging—HTTPS POST)
This appendix details initial integration between the Splunk Cloud and Zscaler Internet Access (ZIA) if logs are streamed to
the Splunk Cloud instance from ZIA using HTTP Event Collector (HEC) input on the Splunk cloud.
Cloud NSS is a cloud-to-cloud log streaming service that allows you to stream logs directly from the ZIA cloud into a
supported cloud-based SIEM, without the need to deploy an NSS VM for web or Firewall. The service supports all ZIA log
types: web, SaaS security, tunnel, Firewall, and DNS.
When you subscribe to the service, you can configure cloud NSS feeds for each log type to an HTTPS API-based log
collector hosted on your cloud SIEM. Rather than deploying, managing, and monitoring on-premises NSS VMs, you cansimply configure an HTTPS API feed that pushes logs using HTTP POST from the Zscaler cloud service into an HTTPS API
endpoint on the SIEM. For the Splunk cloud, this is the HEC input.
Contact Zscaler Support to request access to this service.

Figure 39. High-level overview of cloud-to-cloud logging

You can subscribe to Cloud NSS, which allows direct cloud-to-cloud log streaming for all types of ZIA logs into a Splunk
instance.
The following links provide information about cloud-to-cloud logging:•

Understanding Nanolog Streaming Service (government agencies, see Understanding Nanolog Streaming Service).

•

About Cloud NSS Feeds (government agencies, see About Cloud NSS Feeds).

•

Add NSS Feeds (government agencies, see Add NSS Feeds).

•

Adding Cloud NSS Feeds for Web Logs (government agencies, see Adding Cloud NSS Feeds for Web Logs).

Configure Splunk Cloud to Ingest ZIA Logs Over HEC Input
This section requires admin access to a working instance of Splunk cloud.
The Splunk HEC sends data and application events to a Splunk deployment over the HTTPS. HEC uses a token-based
authentication model. You can generate a token and then configure a logging library or HTTP client with the token to
send data to HEC in a specific format. The HEC token that is created from the following steps must be pasted later into
the ZIA Admin Portal. While the HEC token is required in this deployment, in addition, you can optionally restrict the
public source IPs that are allowed to send logs to their Splunk cloud stack. You can contact Splunk support to employ any
IP-level allowlists.

©2024 Zscaler, Inc. All rights reserved.

47

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Log into Splunk Cloud Tenant

Figure 40. Log into Splunk Cloud tenant

Install Zscaler App and Zscaler TA in Your Cloud Tenant
After logging in, go to Apps > Browse More Apps and search for zscaler.
You can install Zscaler Splunk App on your Splunk cloud tenant.
Contact the Splunk cloud support team to get "Zscaler Technical Add-on (TA)" installed in your Splunk cloud

exclamation-triangle tenant.

Figure 41. Install Zscaler App and TA©2024 Zscaler, Inc. All rights reserved.

48

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Create Zscaler Index in Splunk
After installing Zscaler App and TA, go to Settings > Indexes > New Index.

Figure 42. Add new index

Add Zscaler Index in Splunk
In the New Index dialog, type zscaler (case sensitive) and click Save.
Because the Splunk App for Zscaler looks for data written at index zscaler by default, setting index=zscaler allows
you to use the Splunk App for Zscaler out of the box.
Zscaler does not have a specific recommendation for Max raw data size, Searchable time, or Dynamic Data Storage. These
values depend entirely on your setup, amount of logs, cost associated with storage in Splunk cloud, etc., and vary from
customer to customer. For more information regarding these settings, refer to the Splunk documentation.

Figure 43. Add Zscaler index in Splunk©2024 Zscaler, Inc. All rights reserved.

49

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Create a new Data Input and HEC token
After creating an index in the previous step, go to Settings > Data inputs.

Figure 44. Go to data inputs

The Data inputs dialog is displayed. Click the option to Add new input.

Figure 45. Create new input©2024 Zscaler, Inc. All rights reserved.

50

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure Data Input and HEC token
Now create an HEC token. This is a 32-character unique token that is part of every POST API call from ZIA to the Splunkcloud. It works as an authorization token and is part of each HTTP POST API call made from the Zscaler logging service to
the Splunk cloud.

Clipboard-list

Do not enable indexer acknowledgment. Provide a token name. Leave the rest of options at default settings andclick Next.

Figure 46. Configuring HEC token and input©2024 Zscaler, Inc. All rights reserved.

51

ZSCALER AND SPLUNK DEPLOYMENT GUIDEThe following example sends ZIA Web logs to the Splunk cloud. Thus, the source type selected in this example iszscalernss-web. Change the source type to match the log type that you want to ingest (for example, zscalernss-fw,
zscalernss-dns, etc.).

Figure 47. Configuring HEC token and input (cont.)©2024 Zscaler, Inc. All rights reserved.

52

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

From the Review dialog, confirm the settings and click Submit.

Figure 48. Review the setup

The Token is being deployed. The token might take a few minutes to get deployed in Splunk cloud.

Figure 49. Wait for token to be deployed©2024 Zscaler, Inc. All rights reserved.

53

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Copy the HEC Token Value
After the token is deployed, go to Setting > Data inputs > HTTP Event Collector.
The 32-character HEC token is shown on this screen. Make a note of this token for use in the ZIA Admin Portal later. In
Splunk, HEC tokens are tied to different source types (Zscaler’s source types: web, Firewall, DNS, etc.).

Clipboard-list

Create separate HEC tokens for each of the Zscaler log source types. For example, create an HEC token used
for only zscalernss-web, a separate HEC token used by only zscalerss-fw, and a separate HEC token just for
zscalernss-dns, etc. This allows for better scaling, renewing, and invalidating HEC tokens in the future, if needed,without affecting other Zscaler source types.

Figure 50. Note the HEC token©2024 Zscaler, Inc. All rights reserved.

54

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Determine the Splunk Cloud API Endpoint to Send Logs To
The host of the Splunk API end point that you specify to send logs to depends on your Splunk cloud deployment.
Refer to Set up and use HTTP Event Collector in Splunk Web to determine the host portion. Use JSON-formatted log
messages.
The endpoint portion is always /services/collector, and endpoint /services/collector/raw does not comeinto play.Note the complete API URL corresponding to your Splunk cloud instance.

Figure 51. Determine the Splunk Cloud API endpoint to send logs to©2024 Zscaler, Inc. All rights reserved.

55

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure Splunk Cloud to Fetch Zscaler Audit Logs and Sandbox Events
Previously, the Zscaler Splunk TA needed to be installed on Splunk Inputs Data Manager (IDM). IDM was a Splunk instancewithin a Splunk Cloud Stack that set up and configured modular and scripted inputs. As a part of a stack, IDM is managedby Splunk. IDM is a unique instance, meaning that it exists independently and separately from a search head, and does
not belong to a search or indexing cluster. To use IDM, contact Splunk support.
Now, Splunk cloud prefers using Victoria, which removes the necessity of IDM. You can install most apps on Splunk cloud
directly as opposed to contacting Splunk support.
If using IDM, a Zscaler username, password, and API credentials are configured on the Splunk TA installed on IDM. Thisinitiates API calls from the Splunk cloud to Zscaler to fetch audit logs and Sandbox reports.
If using the newer Victoria stack, complete the following steps on the same Splunk cloud instance on which the Zscaler
Splunk app is installed (instead of IDM).

Clipboard-list

You must also request Splunk cloud support team to enable "Scheduled search" capabilities on their IDM. Thissetting is disabled in Splunk cloud by default. The IDM must be peered to the indexing tier so that indexed data
can be searched.
Second, the account running the Zscaler TA (likely sc_admin or splunk-system-user) must have Splunkcapabilities to:•

Run saved searches.

•

Output a lookup.

Finally, the equivalent saved search on the IDM must be enabled and scheduled to run.

For more information, refer to the Splunk documentation.

Log In to Splunk IDM Instance

Figure 52. Log in to Splunk cloud IDM©2024 Zscaler, Inc. All rights reserved.

56

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Install Zscaler Splunk TA on Splunk IDM Instance
After logging in, go to Apps > Find more Apps and search for zscaler.
You must contact Splunk cloud support team to get Zscaler Technical Add-On (TA) installed in your Splunk cloud tenant.
Zscaler Splunk App doesn’t need to be installed on IDM.

Figure 53. Install Zscaler Splunk App and TA©2024 Zscaler, Inc. All rights reserved.

57

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure Zscaler Index on Splunk IDM Instance
After Zscaler Splunk TA is installed on Splunk IDM, go to Settings > Indexes and create a new zscaler index.
Click Save after filling in the details.

Figure 54. Add Zscaler Index in Splunk IDM

Add Zscaler Account Used by Splunk IDM to Make API Calls to ZIA
Go to Configuration > Account > Add.

Figure 55. Create new account in Splunk IDM©2024 Zscaler, Inc. All rights reserved.

58

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Fill in the Zscaler credentials pertinent to your ZIA tenant and save the settings by clicking Add.

Figure 56. Fill in ZIA credentials in Splunk IDM

Configure Input for Audit Logs
In IDM, go to Inputs > Create New Input. First, configure input for fetching Zscaler Audit Logs.

Figure 57. Add audit logs input in Splunk IDM©2024 Zscaler, Inc. All rights reserved.

59

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Fill in the Settings for Fetching ZIA Audit Logs
After filling in the details, click Add. Settings might take a few minutes to take effect.

Figure 58. Save Audit Logs input in Splunk IDM

Configure Input for Sandbox Events
In IDM, go to Inputs > Create New Input. Then, select Zscaler Sandbox Events.

Figure 59. Add Sandbox events input in Splunk IDM©2024 Zscaler, Inc. All rights reserved.

60

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Fill in the Settings for Fetching ZIA Sandbox Events
After filling in the details, click Add. Settings might take a few minutes to take effect.

Figure 60. Save Sandbox events input in Splunk IDM

Confirm that Both Input Settings are Saved and Enabled
On the Inputs section of IDM, view the Zscaler Audit Logs and Zscaler Sandbox Events. Confirm that the Status for each
input is Enabled.

Figure 61. Confirm that both Inputs are enabled in Splunk IDM

Configure Zscaler for Cloud-to-Cloud Logging
You can subscribe to Cloud NSS, which allows direct cloud-to-cloud log streaming for all types of ZIA logs into a Splunk
instance. Rather than deploying, managing, and monitoring on-premises NSS VMs, you can configure an HTTP or HTTPSAPI feed that pushes logs from the Zscaler cloud service into an HTTPS API endpoint on the SIEM (i.e., the HEC input for
the Splunk cloud). The following steps show how to set up the log feed for web logs. You must repeat these steps to set
up other Zscaler log types (e.g., Firewall or DNS logs).

©2024 Zscaler, Inc. All rights reserved.

61

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Go to Cloud-to-Cloud Logging Section in ZIA Portal
After logging into ZIA Admin Portal, go to Administration > Nanolog Streaming Service > Cloud NSS Feeds > Add CloudNSS Feed.

Figure 62. Go to cloud-to-cloud logging section in ZIA

Set Up the Cloud NSS Log Feed (Web)
Select Splunk as the SIEM type from the drop-down menu.
The API URL is a Splunk URL dependent on your Splunk cloud stack.

Clipboard-list

Add "?auto_extract_timestamp=true" at the end of the Splunk cloud API endpoint. For example, if your Splunk
API URL is:
https://http-inputs-partnerstack05.splunkcloud.com:443/services/collector
Then, in the ZIA Admin Portal, configure it as:
https://http-inputs-partnerstack05.splunkcloud.com:443/services/collector?auto_extract_timestamp=true

The authorization header contains the relevant Splunk HEC token created in previous steps.
In the Add Cloud NSS Feed dialog, Key1 is "Authorization". Value1 is the HEC token in the format "Splunk XXX-XXX-XXX"(replace XXX with actual HEC token value).

©2024 Zscaler, Inc. All rights reserved.

62

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Feed Output Type is JSON from the drop-down menu. After filling in required parameters, click Save. Add ,\" (comma,
backslash, double quotes) to the Feed Escape Character list.

Figure 63. Configure cloud NSS feed

When you create a web feed, you must set the Feed Output Type to Custom and then paste the following code

Clipboard-list text into the Feed Output Format:\{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%d{yy}-%02d{mth}-%02d{dd}%02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{sip}","clienttranstime":"%d{ctime}","requestmethod":"%s{reqmethod}","refererURL":"%s{ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zscaler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malwarecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}","pagerisk":"%d{riskscore}","department":"%s{edepartment}","urlsupercategory":"%s{urlsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclass}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fileclass}","bwthrottle":"%s{bwthrottle}","servertranstime":"%d{stime}","contenttype":"%s{contenttype}","ssldecrypted":"%s{ssldecrypted}","unscannabletype":"%s{unscannabletype}","md5":"%s{bamd5}","deviceowner":"%s{deviceowner}","devicehostname":"%s{deviceho
stname}"\}\}©2024 Zscaler, Inc. All rights reserved.

63

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Figure 64. Example with all fields populated (web)©2024 Zscaler, Inc. All rights reserved.

64

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Set Up the Cloud NSS Log Feed (Firewall)
Select Splunk as the SIEM Type from the drop-down menu.
The API URL is a Splunk URL, dependent on your Splunk cloud stack.

Clipboard-list

Add "?auto_extract_timestamp=true" at the end of the Splunk cloud API endpoint.
For example, if your Splunk API URL is:
https://http-inputs-partnerstack05.splunkcloud.com:443/services/collector
Then, in the ZIA Admin Portal, configure it as:
https://http-inputs-partnerstack05.splunkcloud.com:443/services/collector?auto_extract_timestamp=true

The authorization header contains the relevant Splunk HEC token created in previous steps.
1. In the Add Cloud NSS Feed dialog, Key1 is "Authorization". Value1 is the HEC token in format "Splunk XXX-XXX-XXX"(replace XXX with actual HEC token value).
2. Select the Feed Output Type of JSON from the drop-down menu. Add ,\" (comma, backslash, double quotes) to
the Feed Escape Character list. In the Feed Output Format, change the "sourcetype" to "zscalernss-fw".
3. After filling in required parameters, click Save.

Figure 65. Configure cloud NSS feed

©2024 Zscaler, Inc. All rights reserved.

65

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Figure 66. Example with all fields populated (firewall)

Add Other Log Source Types
Repeat the preceding steps to add other log source types (for example, DNS logs, tunnel logs, etc.).
Make sure to edit the feed output format to "zscalernss-dns", "zscalernss-tunnel", etc. Refer to the table in the Source
Types section for a list of source types.

©2024 Zscaler, Inc. All rights reserved.

66

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Validate NSS Cloud Configuration
After the config is saved, click the Zscaler icon to verify connectivity from ZIA cloud to Splunk cloud. This sends a sample
or test log message from the ZIA cloud to Splunk. Cloud-to-cloud connectivity is verified if Splunk sends the expected
response.

Figure 67. Verify connectivity to Splunk cloud

After the connectivity is verified, the Connectivity Test column changes from Validation Pending to Validation
Successful.

Figure 68. Splunk cloud connectivity verified©2024 Zscaler, Inc. All rights reserved.

67

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Verify Zscaler Splunk App
Log back into your Splunk cloud tenant and go to Apps > Zscaler Splunk App.
It is populated with incoming Zscaler log data.

Figure 69. Verify Zscaler Splunk App

If you see a particular panel not populated, click the magnifying glass next to it. This shows you the query that the panel isrunning behind the scenes, which helps with troubleshooting.

Figure 70. Access individual searches within Zscaler Splunk App©2024 Zscaler, Inc. All rights reserved.

68

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix D: Using SOAR (formerly Phantom) with Zscaler andSplunkSplunk SOAR (formerly Phantom) is a security orchestration, automation, and response (SOAR) system. The Splunk SOAR
platform combines security infrastructure orchestration, playbook automation, and case management capabilities tointegrate your team, processes, and tools to help you orchestrate security workflows, automate repetitive security tasks,
and quickly respond to threats.
You can watch a video demonstrating Splunk SOAR.

SOAR components

Figure 71. SOAR components

A Sample Playbook to Showcase Zscaler and SOAR Integration
This sample playbook leverages Splunk, Splunk ES, SOAR, and Zscaler NSS logs for threat hunting using custom threat
feeds.
In the example, ZIA NSS logs are streamed to Splunk (SIEM). SOAR talks to the ZIA tenant as well as the Splunk instance towhich NSS logs are being sent.

©2024 Zscaler, Inc. All rights reserved.

69

ZSCALER AND SPLUNK DEPLOYMENT GUIDEA custom threat feed (IOC type: malicious Domains) that the customer subscribes to is ingested into Splunk ES (which ispart of Splunk). Splunk ES then looks for an overlap between domains on the threat feed and incidents of them being
accessed via ZIA in the past (over an adjustable interval). If it finds an overlap, a notable event is created by Splunk ES andsent to SOAR.
SOAR then checks to see if Zscaler currently classifies this domain as malicious. If Zscaler classifies this domain as
malicious, SOAR triggers a search in NSS logs that were consumed by Splunk to look at historical data.
If Zscaler doesn’t classify them as malicious, SOAR adds the domain to your ZIA disallowed list and then looks at historical
data (with an adjustable time range) to find which users have accessed those domains by triggering a search over NSS
logs that were consumed by Splunk.
SOAR then sends an email to the network admin detailing which users were exposed to these domains, along with
relevant timestamps.

Clipboard-list

The following steps enable a SOAR instance to communicate with Splunk and Zscaler. Configure a sample
playbook which is used to automate threat hunting. This sample playbook is just an example of what isachievable by leveraging SOAR abilities with Zscaler’s APIs. You can build your own playbooks to implement yourcustom use cases.

Figure 72. Zscaler and Splunk ES SOAR

©2024 Zscaler, Inc. All rights reserved.

70

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configuring SOAR
The following steps assume that you have admin access to the SOAR instance.

Create new Event Label in SOAR
Splunk sends events to SOAR with this label. The SOAR playbook is triggered only for events that contain this label.
Triggered events is a way to limit a playbook, specifying actions only on specific kinds of events.
1. Go to Administration > Event Settings > Label Settings and then + Label.

Figure 73. Create event label in SOAR

2. Name it "from_correlation_splunk_search".

Figure 74. Create event label in SOAR

©2024 Zscaler, Inc. All rights reserved.

71

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Create Automation User in SOAR
This username is used by Splunk to communicate with SOAR.
1. Go to Administration > Users and create a new automation user with following settings.

Figure 75. Create automation user in SOAR

2. Click the username created.
3. Copy the following section for your record. The Authorization Configuration for REST API is used by Splunk toauthenticate with SOAR.

Figure 76. Copy code in Authorization Configuration for REST API©2024 Zscaler, Inc. All rights reserved.

72

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Installing Zscaler App on SOAR
Log into SOAR and go to Apps.

Figure 77. Go to Apps section in SOAR

Search for Zscaler App
Search for zscaler. Go to Unconfigured Apps > Configure new Asset.

Figure 78. Search for Zscaler app in SOAR

©2024 Zscaler, Inc. All rights reserved.

73

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure Zscaler App
The Asset Info tab allows free-form text input. Name your asset according to your organization’s naming conventions.

Figure 79. Configure Zscaler app in SOAR

©2024 Zscaler, Inc. All rights reserved.

74

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Fill out Asset Settings with your pertinent ZIA tenant details.
After filling all the details, click Save and then click Test Connectivity.

Figure 80. Configure Zscaler app in SOAR

Test Connectivity Between SOAR and Zscaler
When all the information is filled in correctly, the connectivity test passes and your result looks similar to the following
example.

Figure 81. Test connectivity between SOAR and Zscaler©2024 Zscaler, Inc. All rights reserved.

75

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Installing Splunk App on SOAR
Click Apps to display the available apps in Splunk SOAR.

Figure 82. Install Splunk app

Search for Splunk App
Search for splunk.
Go to Unconfigured Apps > Configure New Asset.

Figure 83. Search for Zscaler app in SOAR

©2024 Zscaler, Inc. All rights reserved.

76

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure Splunk App
The Asset Info tab allows free-form text input. Name your asset according to your organization’s naming conventions..

Figure 84. Configure asset info

©2024 Zscaler, Inc. All rights reserved.

77

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Fill out Asset Settings with your pertinent Splunk details. Make sure that communication from SOAR to Splunk on port
8089 is permitted by the network.

Figure 85. Configure Splunk app in SOAR

Under Ingest Settings, set the Polling Interval per your operational needs. This document sets it to 1-minute.

Figure 86. Configure polling interval©2024 Zscaler, Inc. All rights reserved.

78

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Test connectivity Between SOAR and Splunk
When all the information is filled in correctly, the connectivity test passes and your result looks similar to the following
example.

Figure 87. Test connectivity between SOAR and Splunk

Download Zscaler Playbook
Download the Zscaler playbook (as a .tar file) using this link and import it into your SOAR instance.

Figure 88. Upload sample playbook to SOAR

©2024 Zscaler, Inc. All rights reserved.

79

ZSCALER AND SPLUNK DEPLOYMENT GUIDEThis playbook does a correlation search against known malicious IP and domains and your ZIA logs. If a malicious IP anddomain is found in these logs, the playbook checks if that IP and domain is already on that customer’s Zscaler disallow list.
If it is, then no action is taken.
If it is not on the disallow list, SOAR checks how Zscaler classifies this IP and domain. If Zscaler classifies it as "Unknown,"
SOAR updates Zscaler’s disallow list via an API call.

Figure 89. Playbook process

Edit the Playbook Settings
Go to Playbooks and open the one that was imported. Edit the Playbook Properties and mark it as Active.
Also change Operates on to the label that was created earlier in the drop-down menu and click Save.

Figure 90. Change playbook status to active©2024 Zscaler, Inc. All rights reserved.

80

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configuring Splunk
The following sections describe how to configure Splunk.

Install Splunk ES App
After logging into your Splunk instance, click Splunk Apps and search for "enterprise security".
Install the Splunk ES app.

Figure 91. Splunk ES app

Figure 92. Search and install Splunk Enterprise Security©2024 Zscaler, Inc. All rights reserved.

81

ZSCALER AND SPLUNK DEPLOYMENT GUIDEManage Threat Intelligence within ES App
Go to the newly installed Enterprise Security Splunk app and then click App Configuration.

Figure 93. Splunk enterprise security

Figure 94. Splunk enterprise security app configuration

Click Content Management.

Figure 95. Content management in Splunk ES©2024 Zscaler, Inc. All rights reserved.

82

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Type Threat in the search box and select the Type as Correlation Search.
Enable the Threat Activity Detected correlation search.

Figure 96. Threat activity search

After enabling, click Threat Activity Detected.

Figure 97. Enable Threat Activity Detected correlation

The following page is displayed.

Figure 98. Correlation search©2024 Zscaler, Inc. All rights reserved.

83

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Notable Events and Forwarding to SOAR
When you scroll down to the bottom of this page, the Notable and Risk Analysis option is selected by default. Click the
Add New Response Action button and add Send to SOAR.

Figure 99. Add adaptive response action in SOAR

©2024 Zscaler, Inc. All rights reserved.

84

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Notable events are automatically created by Splunk ES based on correlation searches. Add action to forward artifacts
related to such events to your SOAR setup.

Figure 100. Forward notable events to SOAR

©2024 Zscaler, Inc. All rights reserved.

85

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Install SOAR App
Install SOAR App on Splunk. SOAR IP is defined here and Splunk forwards artifacts to this SOAR instance.
Install the SOAR App for Splunk.

Figure 101. SOAR App for Splunk

Figure 102. Install SOAR app in Splunk©2024 Zscaler, Inc. All rights reserved.

86

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configure Automation User
Configure username and authentication settings to establish communication between Splunk and SOAR.
Go to the newly installed SOAR Splunk App and then click Create Server.

Figure 103. SOAR server configuration

Populate the Authorization Configuration by pasting the Authorization token content copied in earlier steps and click
Save.

Figure 104. New SOAR server credentials©2024 Zscaler, Inc. All rights reserved.

87

ZSCALER AND SPLUNK DEPLOYMENT GUIDEYou see a confirmation dialog.

Figure 105. SOAR server verification

Verify Events in SOAR
Log back into SOAR. You start seeing events being populated. It might take up to 30 minutes for events to display. These
events trigger the SOAR playbook.

Figure 106. Verify that the notable events are being forwarded by Splunk to SOAR

©2024 Zscaler, Inc. All rights reserved.

88

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Inspect Actions Taken by SOAR
Clicking any of these events displays pertinent playbook runs. A playbook lists all the actions invoked with the success or
failure status.

Figure 107. Verify playbook runs and actions taken©2024 Zscaler, Inc. All rights reserved.

89

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix E: Zscaler Posture Control and Splunk
Posture Control is a Cloud-Native Application Protection Platform (CNAPP) that takes a radically new approach to cloudnative application security with a 100% agentless solution that correlates across multiple security engines to prioritize
hidden risks caused by misconfigurations, threats, and vulnerabilities across the entire cloud stack, reducing cost,complexity, and cross-team friction.
Posture Control is part of Zscaler for Workloads, a comprehensive cloud security solution for any application running on
any service in any cloud.

Figure 108. ZPC and Splunk integration

Create AWS S3 Bucket
Zscaler Posture Control exports its alerts to an S3 bucket. These alerts are then ingested into Splunk by Splunk reading thecontents of that S3 bucket via a generic Splunk S3 input. The first step is to log into AWS console and create an S3 bucket
to which ZPC exports the alerts.

Figure 109. Amazon S3 Buckets©2024 Zscaler, Inc. All rights reserved.

90

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configuring ZPC to Send Alerts to AWS S3
To configure ZPC to sent alerts to AWS S3 buckets:
1. Log in to the ZPC Admin Portal. Go to Administration > Integrations.

Figure 110. ZPC Integrations

2. Click Add to enter a new cloud storage integration, which is used as a location to store alerts.

Figure 111. Add Cloud Storage

3. Name the integration and select Amazon S3 Bucket as the Cloud Storage.

Figure 112. Integration Information

4. Enter the AWS S3 Bucket Name to which ZPC should push alerts.
©2024 Zscaler, Inc. All rights reserved.

91

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

5. Click Copy the S3 Bucket policy and log into the AWS S3 portal.

Figure 113. Cloud Storage Details in the ZPC Admin Portal

6. Paste the bucket policy into the permissions of the bucket. The bucket policy looks similar to the following example.

Figure 114. AWS Bucket Policy in AWS S3 portal

7. Return to the ZPC Admin Portal and click Test Connection. The connection test must succeed before moving to thenext step.

©2024 Zscaler, Inc. All rights reserved.

92

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configuring AWS
ZPC writes alerts to this S3 bucket in AWS, and Splunk reaches out to this S3 bucket to pull down the alerts written to thisbucket.
To create an Identity and Access Management (IAM) user and assign permissions to that user in AWS to allow listing of S3
buckets:
1. Click Add Users.

Figure 115. AWS Add Users

2. Provide a username and select Access Key. You can download the access key, which is used later by Splunk to pullcontents of this S3 bucket into Splunk.

Figure 116. IAM Users©2024 Zscaler, Inc. All rights reserved.

93

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

3. Create and attach an IAM policy to the user. This policy allows the Splunk user account to see all the buckets
available when configuring Splunk. In the following example, a similar policy must be created in AWS and attachedto the user.
4. Click Next.

Figure 117. IAM Policy

5. After the user is created, create Access Keys to enable programmatic access using those credentials. Splunk uses thecredentials to contact S3. Create and download an Access Key and corresponding Secret Access Key for this user.

Figure 118. Access Keys

©2024 Zscaler, Inc. All rights reserved.

94

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

6. Edit the permissions of the bucket so that the user can read from that bucket. You need to make changes to the
Principal and Resource sections to match your accounts and usernames. The end result is an addition of a stanza inthe bucket permissions pertaining to the username that is used by Splunk to pull down the alerts from S3 bucket.

Figure 119. AWS Bucket Policy©2024 Zscaler, Inc. All rights reserved.

95

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

Configuring Splunk
Configure Splunk to read from the S3 bucket.
1. On your Splunk instance, install the Splunk Add-on for AWS. This allows you to configure Splunk to ingest the alertsfrom S3.
2. Select the Splunk Add-on for AWS and then Account under the Configuration tab.
3. Click Add.
4. Add the user created earlier.
5. Enter the Username, Key ID, and Secret Key.

Figure 120. Splunk Account Configuration

Figure 121. Add Splunk Account

6. Create a generic S3 input from the Splunk App by going to Inputs > Create New Input > Custom Data Type >Generic S3.

Figure 122. Splunk S3 Inputs©2024 Zscaler, Inc. All rights reserved.

96

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

7. Provide a Name.
8. Select the AWS username created earlier.
9. Select the name of the bucket used in the previous sections.
10. In Source Type, enter zscaler-posturecontrol-alerts and for index, enter zscaler.
11. Click Add.

Figure 123. Splunk Update Generic S3©2024 Zscaler, Inc. All rights reserved.

97

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

12. Go back to the Zscaler Splunk app and select the Posture Control tab. As alerts get pushed out by ZPC, thecorresponding Splunk dashboards are populated.

Figure 124. Splunk dashboards©2024 Zscaler, Inc. All rights reserved.

98

ZSCALER AND SPLUNK DEPLOYMENT GUIDEAppendix F: Requesting Zscaler Support
You might sometimes need Zscaler Support for provisioning certain services, or to help troubleshoot configuration andservice issues. Zscaler Support is available 24/7/365.
To contact Zscaler Support:
1. Go to Administration > Settings > Company profile.

Figure 125. Collecting details to open support case with Zscaler TAC

2. Copy the Company ID.

Figure 126. Company ID©2024 Zscaler, Inc. All rights reserved.

99

ZSCALER AND SPLUNK DEPLOYMENT GUIDE

3. Now that you have your company ID, you can open a support ticket. Go to Dashboard > Support > Submit a Ticket.

Figure 127. Submit a Ticket©2024 Zscaler, Inc. All rights reserved. 100