Zscaler NSS

Zscaler is a software as a service (SaaS) web proxy with an "on-premises" NSS component that retrieves the logs from the cloud and pulls them into the local network for log aggregators, such as the InsightIDR Collector.

Zscaler NSS product logs can contain information about hosts and accounts, in addition to the source address. When setting up Zscaler NSS as an event source, you will have the ability to specify attribution options.

To set up Zscaler NSS, you’ll need to:

1. Review “Before you Begin” and note any requirements,
2. Configure Zscaler NSS to send data to your Collector,
3. Set up the Zscaler NSS event source in InsightIDR, and
4. Verify the configuration works.

Before You Begin

You must prepare Zscaler NSS to forward logs to the InsightIDR Collector.

You can find additional information on how to configure Zscaler NSS here: https://help.zscaler.com/zia/documentation-knowledgebase/analytics/nss/nss-deployment-guides.

You must set up a separate Zscaler NSS event source for each NSS feed you’d like to send to InsightIDR. If you’d like to send Web, Firewall and DNS logs to InsightIDR, you should set up three Zscaler NSS event sources.

Configure Zscaler NSS to send data to your Collector

The Zscaler logs must arrive in a certain format depending on the type of log for InsightIDR to correctly parse them.

Forward Web Logs

In Zscaler, select LEEF as the format when setting up your NSS feed. Then, paste the following format into the Feed Output Format field:

 
1
%s{mon} %02d{dd} %02d{hh}:%02d{mm}:%02d{ss} zscaler-nss: LEEF:1.0|Zscaler|NSS|4.1|%s{reason}|cat=%s{action}\tdevTime=%s{mon} %02d{dd} %d{yy} %02d{hh}:%02d{mm}:%02d{ss} %s{tz}\tdevTimeFormat=MMM dd yyyy HH:mm:ss z\tsrc=%s{cip}\tdst=%s{sip}\tsrcPostNAT=%s{cintip}\trealm=%s{location}\tusrName=%s{login}\tsrcBytes=%d{reqsize}\tdstBytes=%d{respsize}\trole=%s{dept}\tpolicy=%s{reason}\turl=%s{eurl}\trecordid=%d{recordid}\tbwthrottle=%s{bwthrottle}\tuseragent=%s{ua}\treferer=%s{ereferer}\thostname=%s{ehost}\tappproto=%s{proto}\turlcategory=%s{urlcat}\turlsupercategory=%s{urlsupercat}\turlclass=%s{urlclass}\tappclass=%s{appclass}\tappname=%s{appname}\tmalwaretype=%s{malwarecat}\tmalwareclass=%s{malwareclass}\tthreatname=%s{threatname}\triskscore=%d{riskscore}\tdlpdict=%s{dlpdict}\tdlpeng=%s{dlpeng}\tfileclass=%s{fileclass}\tfiletype=%s{filetype}\treqmethod=%s{reqmethod}\trespcode=%s{respcode}\tcontenttype=%s{contenttype}\tunscannabletype=%s{unscannabletype}\tdeviceowner=%s{deviceowner}\tdevicehostname=%s{devicehostname}\tbypassedtraffic=%d{bypassed_traffic}\n

Forward Firewall Logs

In Zscaler, select JSON as the format when setting up your NSS feed. Then, paste the following format into the Feed Output Format field:

json
1
\{ "sourcetype": "zscalernss-fw", "event":\{"datetime":"%s{time}","user":"%s{login}","locationname":"%s{location}","cdport":"%d{cdport}","csport":"%d{csport}","csip":"%s{csip}","cdip":"%s{cdip}","action":"%s{action}","proto":"%s{ipproto}","inbytes":"%ld{inbytes}","outbytes":"%ld{outbytes}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","bypassedsession":"%d{bypassed_session}"\}\}

These are the minimum required fields needed to parse Firewall logs in InsightIDR. You can also add additional fields within the event section if you’d like to send other information.

Forward DNS Logs

In Zscaler, select JSON as the format when setting up your NSS feed. Then, paste the following format into the Feed Output Format field:

json
1
\{ "sourcetype": "zscalernss-dns", "event":\{"datetime":"%s{time}","user":"%s{login}","location":"%s{location}","reqaction":"%s{reqaction}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","srv_dport":"%d{sport}","clt_sip":"%s{cip}","srv_dip":"%s{sip}"\}\}

These are the minimum required fields needed to parse DNS logs in InsightIDR. You can also add additional fields within the event section if you’d like to send other information.

Configure InsightIDR to collect data from the event source

After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.

To configure the new event source in InsightIDR:

1. From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.
2. Do one of the following:
   • Search for Zscaler NSS in the event sources search bar.
   • In the Product Type filter, select Web Proxy.
3. Select the Zscaler NSS event source tile.
4. Choose your collector and event source. You can also name your event source if you want.
5. Optionally choose to send unparsed logs.
6. Choose the timezone that matches the location of your event source logs.
7. Select an attribution source.
8. Select a collection method and specify a port and a protocol.
   • Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
9. Click Save.

Verify the configuration

Complete the following steps to view your logs and ensure events are making it to the Collector:

1. Click Data Collection in the left menu of InsightIDR and navigate to the Event Sources tab. Find the new event source that was just created and click the View Raw Log button. If you see log messages in the box, then this shows that logs are flowing to the Collector.
2. Click Log Search in the left menu of InsightIDR.
3. Select the applicable Log Sets and the Log Names within them. The Log Name will be the name you gave to your event source. Zscaler logs flow into the Web Proxy Activity log set when the log is generated from a web proxy event.