Zscaler Splunk App
Overview
Details
Pre-built reports exist for Zscaler’s Internet Access and Private Access Platforms, this include:
* Overview Dashboards showing highlights for your Zscaler products
* Focussed dashboards for:
- Threat Intelligence
- Web Usage
- Remote Access usage
- Zscaler DLP - event and incident reports
Zscaler is excited to deliver this tight integration with Splunk and will continue to enhance reports, dashboards and integrations for the Zscaler Splunk App.
Please note this app has a key dependancy on the Zscaler TA for Splunk --> https://splunkbase.splunk.com/app/3865/
Full App and TA Documentarian is available here --> https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728
To ingest logs from the Zscaler Cloud into Splunk, an NSS server needs to be deployed. The NSS feed will send CIM formatted logs to Splunk. The Zscaler Technical Adapter for Splunk normalizes the logs into a common format that can be leveraged by different applications.
The Zscaler Splunk App provides pre built reports and dashboards including:
* Threat Intelligence
* Web Usage
* Remote Access Activity
* DLP events and incidents
Dependency
Documentation
For additional documentation, reach out to splunk-support@zscaler.com
Release Notes
Version 2.0.6
- Added new Dashboard for Zscaler Private Access Connecter health (CPU, RAM, Network etc)
- Minor fixes to Connections dashboard, and general app layout
- Other small adjustments based on customer feedback
Version 2.0.5
Added fix for Tunnel Widget not displaying rules in landing dashboard
Version 2.0.4
Added fixes to make macro edit more friendly
Minor edits to some widgets to work better with RBAC
Version 2.0.3
Now filtering locations from user oriented reports/widgets.
Version 2.0.2
Added exciting new Security and Threat dashboards
- Security overview with Clickable events (pivot based on threats over user)
- Overall Trading info
- Web Traffic overview
Version 2.0.0
Version 2.0.0
Added Reports and Dashboard for new Modular Inputs:
- Admin Audit Logs (ZIA)
- Cloud Sandbox detailed reports
Moved all macros into TA, removed from App
Overview Dashboard modified to better reflect summary of all data inputs
New Private Access Health Dashboard
Version 1.0.3
V1.0 - Initial Release
V1.0.1 - Changed App name to "Zscaler Splunk App"
V1.0.2 - Removed dependabcy for "IMAP Mailbox" as it's not Splunk Certified
V1.0.3 - updated README.txt to include correct links in deps section
Version 1.0.2
Version 1.0.1
V1.0.1 - Changed App name to "Zscaler Splunk App"