Pondurance Home > Main Menu > Log Ingestion > Log Forwarder > Zscaler ZIA

Zscaler ZIA

Zscaler Internet Access (ZIA) Log Forwarding Configuration

The Scope application supports ingestion of logs from the following Zscaler ZIA products through log forwarders:

Refer to the official Zscaler documentation below for instructions on configuring log forwarding for the supported ZIA products.

Product	Official Documentation
Zscaler ZIA Web	https://help.zscaler.com/zia/adding-nss-feeds-web-logs
Zscaler ZIA Firewall	https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs
Zscaler ZIA Alerts	https://help.zscaler.com/zia/adding-nss-feeds-alerts
Zscaler ZIA DNS	https://help.zscaler.com/zia/adding-nss-feeds-dns-logs
Zscaler ZIA Tunnel	https://help.zscaler.com/zia/adding-nss-feeds-tunnel-logs

The Scope application supports ingestion of Zscaler ZIA Web logs in the following two formats:

Note: Either format can be used. Ensure that all fields defined in the selected format are included in the NSS feed configuration.

Field Name	Sample
`time`	`Tue Sep 3 15:16:30 2024`
`login`	`redacted1@tst.com`
`proto`	`DNSOVERHTTPS`
`eurl`	`mozilla.redacted.com/dns-query`
`action`	`Allowed`
`appname`	`Cloudflare DNS`
`appclass`	`DoH Services`
`reqsize`	`379`
`respsize`	`690`
`stime`	`3`
`ctime`	`53`
`urlclass`	`Business Use`
`urlsupercat`	`Internet Communication`
`urlcat`	`Internet Services`
`malwarecat`	`None`
`threatname`	`None`
`riskscore`	`0`
`dlpeng`	`None`
`dlpdict`	`None`
`location`	`Redacted 500MB`
`dept`	`Default Department`
`cip`	`10.203.40.123`
`sip`	`10.10.61.4`
`reqmethod`	`POST`
`respcode`	`200`
`eua`	`Unknown`
`ereferer`	`None`
`ruletype`	`None`
`rulelabel`	`None`
`contenttype`	`application/dns_message`
`unscannabletype`	`None`
`deviceowner`	`REDACTED2`
`devicehostname`	`NA`

The Scope application supports ingestion of Zscaler ZIA Firewall logs in the following format: