Zscaler Private Access - Cloud SIEM

This section has instructions for collecting Zscaler Private Access (ZPA) log messages and sending them to Sumo Logic to be ingested by CSE.

Sumo Logic CSE supports ZPA logs sent as JSON.

Step 1: Configure CIP collection

In this step, you configure an HTTP Source to collect Zscaler Private Access log messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to Configure an HTTP Source below. Otherwise, create a new collector as described in Configure a Hosted Collector below, and then create the HTTP Source on the collector.

Configure a Hosted Collector

1. In the Sumo Logic platform, select Manage Data > Collection > Collection.
2. Click Add Collector.
3. Click Hosted Collector.
4. The Add Hosted Collector popup appears.
   
5. Name. Provide a Name for the Collector.
6. Description. (Optional)
7. Category. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called _sourceCategory. 
8. Fields. 
   1. If you are planning that all the sources you add to this collector will forward log messages to CSE, click the +Add Field link, and add a field whose name is _siemForward and value is true. This will cause the collector to forward all of the logs collected by all of the sources on the collector to CSE.
   2. If all sources in this collector will be Zscaler Private Access sources, add an additional field with key _parser and value /Parsers/System/Zscaler/Zscaler Private Access/Zscaler Private Access-JSON.
      note

      It’s also possible to configure individual sources to forward to CSE, as described in the following section.

Configure an HTTP Source

1. In Sumo Logic, select Manage Data > Collection > Collection. 
2. Navigate to the Hosted Collector where you want to create the source.
3. On the Collectors page, click Add Source next to a Hosted Collector.
4. Select HTTP Logs & Metrics. 
5. The page refreshes.
   
6. Name. Enter a name for the source. 
7. Description. (Optional) 
8. Source Host. (Optional) Enter a string to tag the messages collected from the source. The string that you supply will be saved in a metadata field called _sourceHost.
9. Source Category. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called _sourceCategory.
10. Fields. If you are not parsing all sources in the hosted collector with the same parser, click the +Add Field link, and add a field whose name is _parser with value /Parsers/System/Zscaler/Zscaler Private Access/Zscaler Private Access-JSON.
11. Advanced Options for Logs. For information about the optional advance options you can configure, see HTTP Logs and Metrics Source.
12. Click Save.
13. Make a note of the HTTP Source URL that is displayed. You’ll supply it in Step 2 below.

Step 2: Configure Zscaler Private Access

In this step you configure Zscaler Private Access to send log messages to CIP. For instructions, see Configuring a Log Receiver in ZPA Help.

Step 3: Verify ingestion

In this step, you verify that your logs are successfully making it into CSE. 

1. Click the gear icon at the top of the CSE UI, and select Log Mappings under Incoming Data.
   
2. On the Log Mappings page search for "ZPA" and check under Record Volume.
   
3. For a more granular look at the incoming records, you can also search the Sumo Logic platform for "ZPA" security records.