Zscaler uses a virtual machine, Nanolog Streaming Service (NSS), to stream logs from the Zscaler service and deliver them to Sumo Logic installed collector via Syslog.
To collect logs for Zscaler, perform these steps, detailed in the following sections:
- Configure Sumo Logic Installed Collector and Syslog Source.
- Configure Zscaler NSS.
- Connect the Zscaler NSS feed to Sumo Logic.
Configure Sumo Logic Installed Collector and Syslog Source
To collect logs for Zscaler Web Security, in Sumo Logic configure:
For protocol, use TCP. Note the Port number, as you will need this to configure Zscaler NSS.
Also, when you configure the Syslog Source, we recommend that you use the Source Category security_zscaler.
Configure Zscaler NSS
Zscaler offers a virtual appliance, called Nanolog Streaming Service (NSS) to stream web logs to external SIEM via syslog. NSS is maintained and distributed by Zscaler as an Open Virtual Application (OVA).
To stream logs to the Sumo Logic Syslog Source, perform steps A, B, and C detailed in the “NSS Configuration Guide” at: https://support.zscaler.com/hc/en-us...guration-Guide.
Connect the Zscaler NSS Feed to Sumo Logic
Once you have configured the Zscaler NSS, now add a feed to send logs to the Sumo Logic syslog endpoint using the following steps.
- Log into your Zscaler NSS system.
- Go to Administration > Settings > Nanolog Streaming Service.
- From the NSS Feeds tab, click Add.
- In the Add NSS Feed dialog:
- Feed Name. Enter a name for your NSS feed.
- NSS Server. Select None.
- SIEM IP Address. Enter the Sumo Logic Installed Collector IP address.
- Log Type. Select Web Log.
- Feed Output Type. QRadar LEEF is the default.
- NSS Type. NSS for Web is the default.
- Status. Select Enabled.
- SIEM TCP Port. Enter the Sumo Logic Syslog Source TCP port number.
- Feed Escape Character. Leave this field blank.
- Feed Output Format. The LEEF format is displayed.
- User Obfuscation. Select Disabled.
- Duplicate Logs. Disabled by default.
- Timezone. Set to GMT by default.
- Click Save.