Zscaler NSS

SIEM (InsightIDR) allows data collection from products and systems that can send events through webhook requests (HTTP POST body method). A webhook event source can have one or more URLs associated with it. These unique URLs are used by the third party products as the destination of the webhook requests.

These limits apply to each POST request sent to the webhook:

Webhook requirements

SIEM (InsightIDR) supports these data formats for webhook event sources:

• Plain text - Webhook requests containing plain text are processed with newline characters separating individual event lines.

• JSON - Webhook requests containing JSON data are supported natively. If the contents are an array of events, the elements of the array are treated as individual events. Otherwise, the entire JSON request body will be treated as a single event.

  • For example, this JSON data will be interpreted as two events automatically:

  [
  { "log": "event 1"},
  { "log": "event 2"}
  ]

  • If the events are contained within a field in the JSON object, the JSON Events Key field can be configured to indicate which field contains the events. In this example, the JSON Events Key is set to resources to identify that the contents should be read from that field within the JSON. Periods can be used to identify a nested field, for example path.to.events.

   {
  "type": "AuditLogEntry",
  "size": 2,
  "resources": [
     { "log": "event 1" },
     { "log": "event 2" }
  ]
  }

• NDJSON - Webhook requests containing newline delimited JSON will have multiple JSON objects, separated by newline characters. Each line will be treated as individual events. The JSON Events Key may be specified if needed, as described in the JSON example.

• URL encoded form values - Webhook requests containing form values will translate the form data’s key plus value pairs into a JSON presentation.

To configure webhook collection:

1. In the Add Event Source panel, select Run On Webhook.
2. Name your event source.
3. Optionally, configure the JSON Events Key if needed.
4. Select Copy to copy the Webhook URL for use in the product you wish to configure to send events to SIEM (InsightIDR).
5. Select Generate a new Webhook URL if you want to add another URL. This can also be used if the existing URL needs to be replaced.
6. Select Save.

Test the configuration

You can test if logs can be sent to the event source using a curl command. The following examples work for Windows, Mac and Linux operating systems. Ensure you replace the placeholder with your new Webhook URL:

curl --verbose <your-webhook-URL> --header "Content-type:application/json" --data "{\"message\":\"Something else happened\",\"user\":\"jsmith\",\"hostname\":\"server1\"}"


curl --verbose <your-webhook-URL> --header "Content-type:application/text" --data "Raw text message"

To configure collector collection:

1. In the Add Event Source panel, select Run On Collector.
2. Name your event source and choose your collector.
3. Select a collection method and specify a port and a protocol.
   • Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
4. Choose the timezone that matches the location of your event source logs.
5. Optionally choose to send unparsed logs.
6. Select an attribution source.
7. Select Save.

Test the configuration

Complete the following steps to view your logs and ensure events are making it to the Collector:

1. Click Data Collection in the left menu of SIEM (InsightIDR) and navigate to the Event Sources tab. Find the new event source that was just created and click the View Raw Log button. If you see log messages in the box, then this shows that logs are flowing to the Collector.
2. Click Log Search in the left menu of SIEM (InsightIDR).
3. Select the applicable Log Sets and the Log Names within them. The Log Name will be the name you gave to your event source. Zscaler logs flow into the Web Proxy Activity log set when the log is generated from a web proxy event.