Skip to main content

Zscaler Private Access

thumbnail icon

The Zscaler Private Access app collects logs from Zscaler using the Log Streaming Service (LSS) to populate pre-configured searches and Dashboards. The dashboards provide easy-to-access visual insights into user behaviors, security, connector status, and risk.

Log types

The Sumo Logic app for Zscaler Private Access uses LSS to send the following logs, as documented here:

Collect logs for the Zscaler Private Access (ZPA) app

Zscaler Private Access uses the Log Streaming Service (LSS), to stream logs from the Zscaler service and deliver them to the Sumo Logic Hosted collector via Syslog.

LSS is deployed using two components, a log receiver and a ZPA App Connector. LSS resides in ZPA and initiates a log stream through a ZPA Public Service Edge (formerly Zscaler Enforcement Node or ZEN). The App Connector resides in your company's enterprise environment. It receives the log stream and then forwards it to Sumo Logic Cloud Syslog.

To collect logs for Zscaler Private Access, perform these steps, detailed in the following sections:

  1. Configure Sumo Logic Hosted Collector and a Cloud Syslog Source.
  2. Configure App Connector in ZPA.
  3. Deploy an App Connector on a Supported Platform.
  4. Configure Log Receivers in ZPA to send logs to Sumo Logic.

Configure Sumo Logic hosted collector and a Cloud Syslog source

To collect logs for ZPA, do the following in Sumo Logic:

  1. Configure a Hosted Collector.
  2. Perform the steps in Configure a Cloud Syslog Source. and configure the following Source fields:
    • Name. (Required) A name is required. Description is optional.
    • Source Category. (Required) [Provide a realistic Source Category example for this data type]. The Source Category metadata field is a fundamental building block to organize and label Sources. For details, see Best Practices.
  3. In the Advanced section, specify the following configurations:
    • Enable Timestamp Parsing. True
    • Time Zone. Use time zone from log file. If none is detected use: Use Collector Default.
    • Timestamp Format. Auto Detect
  4. In the Processing Rules for Logs section, add a Processing Rule:
    • Name: Remove Syslog String
    • Filter: (\<\d+\>1 - - - - - - <>\{)
    • Type: Mask messages that match
    • Mask String: {
  5. Click Save.

Copy and paste the Token, Host and Port in a secure location. You will need these when you configure ZPA LSS.

Configure App Connector in ZPA

Configure a new App Connector in ZPA. Copy the provisioning key created/selected during App Connector configuration.

Deploy an App Connector on a Supported Platform

After you add an App Connector, you must deploy it. Deployment consists of installing the App Connector and also enrolling the App Connector, which allows the App Connector to obtain a TLS client certificate that it must use to authenticate itself to the ZPA cloud. After deployment, the App Connector is ready to send logs to Sumo Logic.

Before you begin a deployment, read App Connector Deployment Prerequisites which provides detailed information on VM image sizing and scalability, supported platform requirements, deployment best practices, and other essential guidelines.

The deployment process differs depending on the platform used for the App Connector. Zscaler recommends that App Connectors be deployed in pairs, to ensure continuous availability during software upgrades.

To deploy the App Connector, see the Deployment Guide for your platform.

Configure Log Receivers in ZPA to send logs to Sumo Logic

Once you have deployed the App Connector, configure log receivers to send logs to the Sumo Logic cloud syslog endpoint using the following steps:

  1. Log into your ZPA system.

  2. Go to Administration > Log Receivers.

  3. Click Add Log Receiver.

  4. In the Add Log Receiver window, configure the following tabs:

    1. Log Receiver
  5. Name: Enter a name for the log receiver. The name cannot contain special characters, with the exception of periods (.), hyphens (-), and underscores (_).

  6. Description: (Optional) Enter a description.

  7. Domain or IP Address: Enter the Domain name from the Sumo Logic Cloud Syslog Source.

  8. TCP Port: Enter the TCP port number from the Sumo Logic Cloud Syslog Source. Default: 6514

  9. TLS Encryption: Select Enabled.

  10. Connector Groups: Choose the App Connector groups that can forward logs to the receiver, and click Done. You can search for a specific group, click Select All to apply all groups, or click Clear Selection to remove all selections.

  11. Click Next.

  12. Log Stream

    1. In the Log Stream tab, select a Log Type from the dropdown menu:
      1. User Activity: Information on end user requests to applications. To learn more, see User Activity Log Fields.
      2. User Status: Information related to an end user's availability and connection to ZPA. To learn more, see User Status Log Fields.
      3. Connector Status: Information related to an App Connector's availability and connection to ZPA. To learn more, see App Connector Status Log Fields.
      4. Browser Access: HTTP log information related to Browser Access. To learn more, see Browser Access Log Fields and About Browser Access.
      5. Audit Logs: Session information for all admins accessing the ZPA Admin Portal. To learn more, see About Audit Log Fields and About Audit Logs.
    2. In the Log Template field, select JSON.
    3. The default Log Stream Content that is displayed will change based on the Log Type and Log Template you selected in previous steps.

You can also edit the log stream content within the text field in order to capture specific fields and create a Custom log template. To learn more, see Understanding the Log Stream Content Format.

Edit the the log stream content, paste the following text in the beginning of the template:

<165>1 - - - - - - <Syslog Token>

For Syslog Token, enter the token from the Sumo Logic Cloud Syslog Source. The token should end with @41123. This number is the Sumo Logic Private Enterprise Number (PEN).

  1. You can define a streaming Policy for the log receiver. For example, you can create a policy where the receiver will only capture logs for a specified segment group or a specific set of session status error codes. The criteria you can use is dependent upon the Log Type you selected. For various options to define a streaming policy, see ZPA help.

  2. Click Next.

  3. Review

    1. In the Review tab, review your log receiver configuration, and click Save.
  4. Repeat the previous steps for all the Log Types:

    1. User Activity: Information on end user requests to applications. To learn more, see User Activity Log Fields.
    2. User Status: Information related to an end user's availability and connection to ZPA. To learn more, see User Status Log Fields.
    3. Connector Status: Information related to an App Connector's availability and connection to ZPA. To learn more, see App Connector Status Log Fields.
    4. Browser Access: HTTP log information related to Browser Access. To learn more, see Browser Access Log Fields and About Browser Access.
    5. Audit Logs: Session information for all admins accessing the ZPA Admin Portal. To learn more, see About Audit Log Fields and About Audit Logs.
  5. The end result should look like below:

  6. At this point, ZPA should start sending logs to Sumo Logic.

Installing the Zscaler Private Access app

To install the app, do the following:

  1. From the Sumo Logic navigation, select App Catalog.
  2. In the Search Apps field, search for and then select your app.
    Optionally, you can scroll down to preview the dashboards included with the app.
  3. To install the app, click Install App.
  4. Click Next in the Setup Data section.
  5. In the Configure section of the respective app, complete the following fields.
    1. Key. Select either of these options for the data source.
      • Choose Source Category, and select a source category from the list for Default Value.
      • Choose Custom, and enter a custom metadata field. Insert its value in Default Value.
  6. Click Next. You will be redirected to the Preview & Done section.

Your app will be installed in the Installed Apps folder and dashboard panels will start to fill automatically.

Each panel slowly fills with data matching the time range query and received since the panel was created. Results will not immediately be available, updating with full graphs and charts over time.

Viewing ZPA Dashboards

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

  • You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
  • You can use template variables to drill down and examine the data on a granular level. For more information, see Filter with template variables.
  • Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

Overview

The ZPA - Overview Dashboard focuses on the overall health of the ZPA system.

Use this dashboard to:

  • Gain insights into ZPA health.
  • Manage ZPA connector health.
zscaler private access Dashboard

Audit

The ZPA - Audit Dashboard focuses the changes in the ZPA admin UI. It allows easy tracking and change management.

Use this dashboard to:

  • Gain insights into ZPA configuration changes.
  • Easily identify the mis-configurations for erratic behavior.
zscaler private access Dashboard

Connectors

The ZPA - Connectors Dashboard focuses on connector health and resource utilization.

Use this dashboard to:

  • Gain insights into ZPA connector health.
  • Identify and manage connectors erroring out or having resource constraints.
zscaler private access Dashboard

Performance

The ZPA - Performance Dashboard focuses on the performance of the connectors and the ZPA system.

Use this dashboard to:

  • Gain insights into ZPA Performance.
  • Manage ZPA connector setup times to determine potential issues.
zscaler private access Dashboard

User Activity

The ZPA - User Activity Dashboard focuses on the users activity.

Use this dashboard to:

  • Gain insights into User activity.
zscaler private access Dashboard

Users

The ZPA - Users Dashboard focuses on the user details.

Use this dashboard to:

  • Gain insights into User connections and Access.
  • Manage Policy and Timeout blocks.
zscaler private access Dashboard
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.