Zscaler ZIA & ZPA Integrations

Overview

The AgileBlue SOC | XDR platform provides automated data collection and configuration services for your Zscaler environment. This integration can be used to receive logs sent by NSS log server on the specified TCP port, or by LSS Log Receiver on respective TCP ports. 

Supported Zscaler Integrations

• Zscaler Internet Access (ZIA)
• Zscaler Private Access (ZPA)

Setup Notes

• A syslog server must be registered to your AgileBlue Syslog Policy in order to access this integration. Please click here for additional information.
• Before proceeding with the steps below, please contact AgileBlue Support to configure the Zscaler integration on your Syslog Policy.

Setup Steps - ZIA

1. Log in to the ZIA Admin Portal using your admin account.
2. Add an NSS server. Click here for reference.
   1. Verify the NSS Server is healthy by accessing Administration > Nanolog Streaming Service > NSS Servers
3. Add the NSS Feeds you would like to configure. Click here for reference.
4. Configure the Zscaler NSS Server and NSS Feeds to send logs to your Syslog Server registered with AgileBlue on the specified port.
   1. ZIA Alerts: 9010 TCP
   2. ZIA DNS Logs: 9011 TCP
   3. ZIA Firewall Logs: 9012 TCP
   4. ZIA Tunnel Logs: 9013 TCP
   5. ZIA Web Logs: 9014 TCP
5. Once this is complete, contact AgileBlue Support to confirm the data stream.

Setup Steps - ZPA

1. Configure the Zscaler LSS Log Receiver to send logs to your Syslog Server registered with AgileBlue.
   1. Reference this guide for help setting up a log receiver.
   2. Reference this guide for help configuring the log receiver.
2. Specify the TCP input based on the following log types:
   1. ZPA App Connector Status Logs: 9015 TCP
   2. ZPA Audit Logs: 9016 TCP
   3. ZPA Browser Access Logs: 9017 TCP
   4. ZPA User Activity Logs: 9018 TCP
   5. ZPA User Status Logs: 9019 TCP
3. Once this is complete, contact AgileBlue Support to confirm the data stream.

Need Help?

AgileBlue is always here to support you and ensure you are 100% successful. If there are any issues with the installation or if you have any questions, please reach out to AgileBlue Support.

Email: support@agileblue.com 
Phone: (216) 606-9400🚨