Skip to main content

Zscaler Private Access

thumbnail icon

The Sumo Logic app for Zscaler Private Access (ZPA) collects logs from Zscaler using the Log Streaming Service (LSS) to populate pre-configured searches and dashboards that provide easy-to-access visual insights into user behaviors, security, connector status, and risk.

Log types​

This app uses LSS to send the following logs:

Learn more about these ZPA logs.

Collect logs for the Zscaler Private Access app​

ZPA uses the LSS to stream logs from the Zscaler service and delivers them to the Sumo Logic Hosted Collector via Syslog.

LSS is deployed using two components, a log receiver and a ZPA App Connector. LSS resides in ZPA and initiates a log stream through a ZPA Public Service Edge (formerly Zscaler Enforcement Node or ZEN). The App Connector resides in your company's enterprise environment. It receives the log stream and then forwards it to Sumo Logic Cloud Syslog.

To collect logs for ZPA, follow the below steps in Sumo Logic.

Step 1: Configure Sumo Logic hosted collector and a Cloud Syslog source​

  1. Configure a Sumo Logic Hosted Collector.
  2. Perform the steps in Configure a Cloud Syslog Source and configure the following Source fields:
    • Name. (Required) A name is required. Description is optional.
    • Source Category. (Required) Provide a realistic Source Category example for this data type. The Source Category metadata field is a fundamental building block to organize and label Sources. For details, see Best Practices.
  3. In the Advanced section, specify the following configurations:
    • Enable Timestamp Parsing. True.
    • Time Zone. Use time zone from log file. If none is detected, use: Use Collector Default.
    • Timestamp Format. Auto Detect.
  4. In the Processing Rules for Logs section, add a Processing Rule:
    • Name: Remove Syslog String.
    • Filter. (\<\d+\>1 - - - - - - \{).
    • Type. Mask messages that match.
    • Mask String. {.
  5. Click Save.

Copy and paste the Token, Host and Port in a secure location. You will need these when you configure ZPA LSS.

Step 2: Configure App Connector in ZPA​

  1. Open ZPA and configure a new App Connector.
  2. Copy the provisioning key created/selected during App Connector configuration.

Step 3: Deploy an App Connector on a Supported Platform​

After adding an App Connector, you'll need to deploy it. Deployment consists of installing and enrolling the App Connector, which allows the App Connector to obtain a TLS client certificate for authenticating to the ZPA cloud. Once deployed, the App Connector is ready to send logs to Sumo Logic.

Before you begin a deployment, read the App Connector Deployment Prerequisites, which provides detailed information on VM image sizing and scalability, supported platform requirements, deployment best practices, and other essential guidelines.

The deployment process varies depending on the platform used for the App Connector. Zscaler recommends deploying App Connectors in pairs to ensure continuous availability during software upgrades.

To deploy the App Connector, see the Deployment Guide for your platform.

Step 4: Configure Log Receivers in ZPA to send logs to Sumo Logic​

Once you have deployed the App Connector, you'll need to configure log receivers to send logs to the Sumo Logic cloud syslog endpoint by doing the following:

  1. Log in to your ZPA system.
  2. Go to Administration > Log Receivers.
  3. Click Add Log Receiver.
  4. In the Add Log Receiver window, configure the following tabs:
    1. Log Receiver
      1. Name. Enter a name for the log receiver. The name cannot contain special characters, with the exception of periods (.), hyphens (-), and underscores (_).
      2. Description. (Optional) Enter a description.
      3. Domain or IP Address. Enter the Domain name from the Sumo Logic Cloud Syslog Source.
      4. TCP Port. Enter the TCP port number from the Sumo Logic Cloud Syslog Source (default: 6514).
      5. TLS Encryption. Select Enabled.
      6. Connector Groups. Choose the App Connector groups that can forward logs to the receiver, and click Done. You can search for a specific group, click Select All to apply all groups, or click Clear Selection to remove all selections.
      7. Click Next.
    2. Log Stream.
      1. In the Log Stream tab, select a Log Type from the dropdown menu:
        1. User Activity. Information on end user requests to applications. To learn more, see User Activity Log Fields.
        2. User Status. Information related to an end user's availability and connection to ZPA. To learn more, see User Status Log Fields.
        3. Connector Status. Information related to an App Connector's availability and connection to ZPA. To learn more, see App Connector Status Log Fields.
        4. Browser Access. HTTP log information related to Browser Access. To learn more, see Browser Access Log Fields and About Browser Access.
        5. Audit Logs. Session information for all admins accessing the ZPA Admin Portal. To learn more, see About Audit Log Fields and About Audit Logs.
      2. In the Log Template field, select JSON.
      3. The default Log Stream Content that is displayed will change based on the Log Type and Log Template you selected in previous steps. You can also edit the log stream content within the text field in order to capture specific fields and create a Custom log template. To learn more, see Understanding the Log Stream Content Format.
        • Edit the log stream content, paste the following text in the beginning of the template: 
          <165>1 - - - - - - <Syslog Token>
        • For Syslog Token, enter the token from the Sumo Logic Cloud Syslog Source. The token should end with @41123. This number is the Sumo Logic Private Enterprise Number (PEN).
      4. You can define a streaming Policy for the log receiver. For example, you can create a policy where the receiver will only capture logs for a specified segment group or a specific set of session status error codes. The criteria you can use is dependent upon the Log Type you selected. For various options to define a streaming policy, see ZPA help.
      5. Click Next.
    3. Review. In the Review tab, review your log receiver configuration, and click Save.
      1. Repeat the previous steps for all the Log Types:
        1. User Activity. Information on end user requests to applications. To learn more, see User Activity Log Fields.
        2. User Status. Information related to an end user's availability and connection to ZPA. To learn more, see User Status Log Fields.
        3. Connector Status. Information related to an App Connector's availability and connection to ZPA. To learn more, see App Connector Status Log Fields.
        4. Browser Access. HTTP log information related to Browser Access. To learn more, se Browser Access Log Fields and About Browser Access.
        5. Audit Logs. Session information for all admins accessing the ZPA Admin Portal. To learn more, see About Audit Log Fields and About Audit Logs.

At this point, ZPA should start sending logs to Sumo Logic.

Installing the Zscaler Private Access app​

To install the app, do the following:

  1. Select App Catalog.
  2. In the 🔎 Search Apps field, run a search for your desired app, then select it.
  3. Click Install App.
    note

    Sometimes this button says Add Integration.

  4. Click Next in the Setup Data section.
  5. In the Configure section of your respective app, complete the following fields.
    1. Key. Select either of these options for the data source.
      • Choose Source Category and select a source category from the list for Default Value.
      • Choose Custom, and enter a custom metadata field. Insert its value in Default Value.
  6. Click Next. You will be redirected to the Preview & Done section.

Post-installation

Once your app is installed, it will appear in your Installed Apps folder, and dashboard panels will start to fill automatically.

Each panel slowly fills with data matching the time range query and received since the panel was created. Results will not immediately be available, but will update with full graphs and charts over time.

Upgrading the Zscaler Private Access app (optional)​

To update the app, do the following:

  1. Select App Catalog.
  2. In the Search Apps field, search for and then select your app.
    Optionally, you can identify apps that can be upgraded in the Upgrade available section.
  3. To upgrade the app, click Upgrade.
    1. If the upgrade does not have any configuration or property changes, you will be redirected to the Preview & Done section.
    2. If the upgrade has any configuration or property changes, you will be redirected to Setup Data page.
      1. In the Configure section of your respective app, complete the following fields.
        • Key. Select either of these options for the data source.
          • Choose Source Category and select a source category from the list for Default Value.
          • Choose Custom and enter a custom metadata field. Insert its value in Default Value.
      2. Click Next. You will be redirected to the Preview & Done section.

Post-update

Your upgraded app will be installed in the Installed Apps folder, and dashboard panels will start to fill automatically.

note

See our Release Notes changelog for new updates in the app.

Uninstalling the Zscaler Private Access app (optional)​

To uninstall the app, do the following:

  1. Select App Catalog.
  2. In the 🔎 Search Apps field, run a search for your desired app, then select it.
  3. Click Uninstall.

Viewing ZPA Dashboards​

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

  • You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
  • You can use template variables to drill down and examine the data on a granular level. For more information, see Filter with template variables.
  • Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

Overview​

The ZPA - Overview Dashboard focuses on the overall health of the ZPA system.

Use this dashboard to:

  • Gain insights into ZPA health.
  • Manage ZPA connector health.
zscaler private access Dashboard

Audit​

The ZPA - Audit Dashboard focuses the changes in the ZPA admin UI. It allows easy tracking and change management.

Use this dashboard to:

  • Gain insights into ZPA configuration changes.
  • Easily identify the mis-configurations for erratic behavior.
zscaler private access Dashboard

Connectors​

The ZPA - Connectors Dashboard focuses on connector health and resource utilization.

Use this dashboard to:

  • Gain insights into ZPA connector health.
  • Identify and manage connectors erroring out or having resource constraints.
zscaler private access Dashboard

Performance​

The ZPA - Performance Dashboard focuses on the performance of the connectors and the ZPA system.

Use this dashboard to:

  • Gain insights into ZPA Performance.
  • Manage ZPA connector setup times to determine potential issues.
zscaler private access Dashboard

User Activity​

The ZPA - User Activity Dashboard focuses on the users activity.

Use this dashboard to:

  • Gain insights into User activity.
zscaler private access Dashboard

Users​

The ZPA - Users Dashboard focuses on the user details.

Use this dashboard to:

  • Gain insights into User connections and Access.
  • Manage Policy and Timeout blocks.
zscaler private access Dashboard
Status
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.