To ingest logs from the Zscaler Cloud into Splunk, an NSS server needs to be deployed. The NSS feed will send CIM formatted logs to Splunk. The Zscaler Technical Adapter for Splunk normalizes the logs into a common format that can be leveraged by different applications.
The Zscaler Splunk App provides pre built reports and dashboards including:
* Threat Intelligence
* Web Usage
* Remote Access Activity
* DLP events and incidents
For additional documentation, reach out to splunk-support@zscaler.com
Added fix for Tunnel Widget not displaying rules in landing dashboard
Added fixes to make macro edit more friendly
Minor edits to some widgets to work better with RBAC
Now filtering locations from user oriented reports/widgets.
Added exciting new Security and Threat dashboards
- Security overview with Clickable events (pivot based on threats over user)
- Overall Trading info
- Web Traffic overview
Version 2.0.0
Added Reports and Dashboard for new Modular Inputs:
- Admin Audit Logs (ZIA)
- Cloud Sandbox detailed reports
Moved all macros into TA, removed from App
Overview Dashboard modified to better reflect summary of all data inputs
New Private Access Health Dashboard
V1.0 - Initial Release
V1.0.1 - Changed App name to "Zscaler Splunk App"
V1.0.2 - Removed dependabcy for "IMAP Mailbox" as it's not Splunk Certified
V1.0.3 - updated README.txt to include correct links in deps section
V1.0.1 - Changed App name to "Zscaler Splunk App"
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.