Parsers and collectors / List of Devo parsers / Network and application security / proxy.zscaler

proxy.zscaler

Introduction

The tags beginning with proxy.zscaler identify events generated by Zscaler products.

Tag structure

The full tag must have 4 levels. The first two are fixed as proxy.zscaler. The third level identifies the type of events sent, and the fourth level indicates the event subtype.

Technology	Brand	Type	Subtype
proxy	zscaler	access nss nss_web nss_firewall	cef csv

Therefore, the valid tags include:

proxy.zscaler.access
proxy.zscaler.nss
proxy.zscaler.nss_web.cef
proxy.zscaler.nss_firewall.cef
proxy.zscaler.nss_web.csv
proxy.zscaler.nss_firewall.csv

And these are the corresponding data tables:

proxy.zscaler.access
proxy.zscaler.nss
proxy.zscaler.nss_web
proxy.zscaler.nss_firewall

How is the data sent to Devo?

You can forward logs generated by Zscaler in both CEF0 and CSV format using any Syslog drain (for example, Syslog-ng).

Please, contact Devo for support about how to configure Zscaler NSS Web / Firewall feeds' output (for example, fields order for CSV format or csX and cnX fields mapping for CEF format) before starting to use nss_web or nss_firewall parsers.

Log samples

The following are sample logs sent to each of the proxy.zscaler data tables. Also, find how the information will be parsed in your data table under each sample log.

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

proxy.zscaler.nss_web

<12>2021-01-01 01:00:30.000 guille=127.0.0.1 proxy.zscaler.nss_web.cef: 0|Zscaler|NSSWeblog|4.1|Allowed|Allowed|3|act=Allowed app=SSL cat=Corporate Marketing dhost=web-50.koch.com dst=186.5.87.182 src=39.87.236.101 in=5546 outcome=NA out=2241 request=web-50.koch.com rt=Mar 17 2021 21:40:13 GMT sourceTranslatedAddress=39.87.236.101 requestClientApplication=Windows Microsoft Windows 10 Enterprise ZTunnel/dev/jason07/attorney/will/wonder.numbers requestMethod=NA suser=starkmackenzie spriv=Road Warrior externalId=6940741080096702554 fileType=None reason=Allowed destinationServiceName=OneDrive cn1=0 cn1Label=risks core cs1=Contact Centre IIC cs1Label=dept cs2=Business and Economy cs2Label=urlsupercat cs3=File Share cs3Label=appclass cs4=None cs4Label=malwarecat cs5=None cs5Label=threatname cs6=None cs6Label=dlpeng ZscalerNSSWeblogURLClass=Business Use ZscalerNSSWeblogDLPDictionaries=None requestContext=None

And this is how the logs would be parsed:

Field	Value	Type	Extra fields
hostchain	`guille=127.0.0.1`	`str`	✓
hostname	`guille`	`str`
tag	`proxy.zscaler.nss_web.cef`	`str`	✓
cefVersion	`0`	`str`
embDeviceVendor	`Zscaler`	`str`
embDeviceProduct	`NSSWeblog`	`str`
deviceVersion	`4.1`	`str`
signatureID	`Allowed`	`str`
name	`Allowed`	`str`
severity	`3`	`str`
time	`Mar 17 2021 21:40:13 GMT`	`str`
login	`starkmackenzie`	`str`
proto	`SSL`	`str`
eurl	`web-50.koch.com`	`str`
action	`Allowed`	`str`
reason	`Allowed`	`str`
appname	`OneDrive`	`str`
appclass	`File Share`	`str`
reqsize	`5546`	`int`
respsize	`2241`	`int`
urlclass	`Business Use`	`str`
urlsupercat	`Business and Economy`	`str`
urlcat	`null`	`str`
malwarecat	`None`	`str`
threatname	`None`	`str`
riskscore	`0`	`str`
dlpeng	`None`	`str`
dlpdict	`None`	`str`
location	`null`	`str`
dept	`Contact Centre IIC`	`str`
cip	`39.87.236.101`	`ip`
sip	`186.5.87.182`	`ip`
reqmethod	`NA`	`str`
respcode	`NA`	`str`
ua	`Windows Microsoft Windows 10 Enterprise ZTunnel/dev/jason07/attorney/will/wonder.numbers`	`str`
ereferer	`null`	`str`
ruletype	`null`	`str`
rulelabel	`null`	`str`
contenttype	`null`	`str`
unscannable	`null`	`str`
deviceowner	`null`	`str`
devicehostname	`null`	`str`
ologin	`null`	`str`
throttlereqsize	`null`	`str`
throttlerespsize	`null`	`str`
bwthrottle	`null`	`str`
bwclassname	`null`	`str`
bwrulename	`null`	`str`
module	`null`	`str`
bamd5	`null`	`str`
dlpdicthitcount	`null`	`str`
dlpidentifier	`null`	`str`
dlpmd5	`null`	`str`
fileclass	`null`	`str`
filetype	`None`	`str`
filesubtype	`null`	`str`
filename	`null`	`str`
reqdatasize	`null`	`str`
reqhdrsize	`null`	`str`
respdatasize	`null`	`str`
resphdrsize	`null`	`str`
totalsize	`null`	`str`
reqversion	`null`	`str`
respversion	`null`	`str`
referer	`null`	`str`
uaclass	`null`	`str`
ua_token	`null`	`str`
host	`web-50.koch.com`	`str`
ehost	`null`	`str`
refererhost	`null`	`str`
erefererpath	`null`	`str`
eurlpath	`null`	`str`
erefererhost	`null`	`str`
url	`null`	`str`
df_hostname	`null`	`str`
mobappname	`null`	`str`
mobappcat	`null`	`str`
mobdevtype	`null`	`str`
cintip	`39.87.236.101`	`ip`
trafficredirectmethod	`null`	`str`
ssldecrypted	`null`	`str`
clientsslcipher	`null`	`str`
clienttlsversion	`null`	`str`
clientsslsessreuse	`null`	`str`
srvsslcipher	`null`	`str`
srvtlsversion	`null`	`str`
srvocspresult	`null`	`str`
srvcertchainvalpass	`null`	`str`
srvwildcardcert	`null`	`str`
serversslsessreuse	`null`	`str`
srvcertvalidationtype	`null`	`str`
srvcertvalidityperiod	`null`	`str`
malwareclass	`null`	`str`
devicemodel	`null`	`str`
devicename	`null`	`str`
deviceostype	`null`	`str`
deviceosversion	`null`	`str`
deviceappversion	`null`	`str`
ztunnelversion	`null`	`str`
recordid	`6940741080096702000`	`str`
productversion	`null`	`str`
nsssvcip	`null`	`str`
eedone	`null`	`str`
stime	`null`	`int`
ctime	`null`	`int`
rawMessage	zscaler-nss CEF:0\|Zscaler\|NSSWeblog\|4.1\|Allowed\|Allowed\|3\|act=Allowed app=SSL cat=Corporate Marketing dhost=web-50.koch.com dst=186.5.87.182 src=39.87.236.101 in=5546 outcome=NA out=2241 request=web-50.koch.com rt=Mar 17 2021 21:40:13 GMT sourceTranslatedAddress=39.87.236.101 requestClientApplication=Windows Microsoft Windows 10 Enterprise ZTunnel/dev/jason07/attorney/will/wonder.numbers requestMethod=NA suser=starkmackenzie spriv=Road Warrior externalId=6940741080096702554 fileType=None reason=Allowed destinationServiceName=OneDrive cn1=0 cn1Label=risks core cs1=Contact Centre IIC cs1Label=dept cs2=Business and Economy cs2Label=urlsupercat cs3=File Share cs3Label=appclass cs4=None cs4Label=malwarecat cs5=None cs5Label=threatname cs6=None cs6Label=dlpeng ZscalerNSSWeblogURLClass=Business Use ZscalerNSSWeblogDLPDictionaries=None requestContext=None	`str`	✓

proxy.zscaler.nss_firewall

<12>2021-01-01 01:00:30.000 guille=127.0.0.1 proxy.zscaler.nss_firewall.cef: CEF:0|Zscaler|NSSFWlog|5.1|Allow|Allow|3|act=Allow suser=seanknight cs1=Manila BPO spriv=US-MA-ANDV-B->Osprey-Citrix/dev/seat.mp4 dst=10.90.134.181 src=140.113.241.238 spt=52618 dpt=80 sourceTranslatedAddress=106.149.65.128 destinationTranslatedAddress=10.90.134.181 destinationServiceName=HTTP app=ofw_tcp_bypass proto=TCP in=65054 out=1583 cn1=368 cn2=1105 cn3=3 cs2=Yes cs3=Other cs3Label=Country cs4=Zscaler Bypass Traffic cat=Miscellaneous or Unknown

And this is how the logs would be parsed:

Field	Value	Type	Extra fields
hostchain	`guille=127.0.0.1`	`str`	✓
hostname	`guille`	`str`
tag	`proxy.zscaler.nss_firewall.cef`	`str`	✓
cefVersion	`0`	`str`
embDeviceVendor	`Zscaler`	`str`
embDeviceProduct	`NSSFWlog`	`str`
deviceVersion	`5.1`	`str`
signatureID	`Allow`	`str`
name	`Allow`	`str`
severity	`3`	`str`
time	`null`	`str`
login	`null`	`str`
dept	`Manila BPO`	`str`
location	`null`	`str`
cdport	`null`	`str`
csport	`52618`	`str`
sdport	`80`	`str`
ssport	`null`	`str`
csip	`140.113.241.238`	`ip`
cdip	`106.149.65.128`	`ip`
ssip	`10.90.134.181`	`ip`
sdip	`10.90.134.181`	`ip`
tsip	`null`	`ip`
tsport	`null`	`str`
ttype	`null`	`str`
action	`Allow`	`str`
dnat	`null`	`str`
nwsvc	`HTTP`	`str`
nwapp	`ofw_tcp_bypass`	`str`
ipproto	`TCP`	`str`
ipcat	`Miscellaneous or Unknown`	`str`
destcountry	`Other`	`str`
avgduration	`null`	`int`
rulelabel	`Zscaler Bypass Traffic`	`str`
inbytes	`65054`	`int`
outbytes	`1583`	`int`
duration	`368`	`int`
durationms	`1105`	`int`
numsessions	`3`	`int`
ipsrulelabel	`null`	`str`
threatcat	`null`	`str`
threatname	`null`	`str`
recordid	`null`	`str`
eedone	`null`	`str`
devicehostname	`null`	`str`
devicemodel	`null`	`str`
devicename	`null`	`str`
deviceostype	`null`	`str`
deviceosversion	`null`	`str`
deviceowner	`null`	`str`
deviceappversion	`null`	`str`
ztunnelversion	`null`	`str`
rawMessage	`CEF:0\|Zscaler\|NSSFWlog\|5.1\|Allow\|Allow\|3\|act=Allow suser=seanknight cs1=Manila BPO spriv=US-MA-ANDV-B->Osprey-Citrix/dev/seat.mp4 dst=10.90.134.181 src=140.113.241.238 spt=52618 dpt=80 sourceTranslatedAddress=106.149.65.128 destinationTranslatedAddress=10.90.134.181 destinationServiceName=HTTP app=ofw_tcp_bypass proto=TCP in=65054 out=1583 cn1=368 cn2=1105 cn3=3 cs2=Yes cs3=Other cs3Label=Country cs4=Zscaler Bypass Traffic cat=Miscellaneous or Unknown`	`str`	✓

Download as PDF