icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Zscaler Splunk App
SHA256 checksum (zscaler-splunk-app_207.tgz) 40fd689987bc6a1cad4967ac0f21e854ac4335a8c86a82c65f3cfd7ddad70e2e SHA256 checksum (zscaler-splunk-app_206.tgz) 86c9e7d0925a05e23f1034d975cb81a9b6f105d5a92d0d74e37a9950b7cee837 SHA256 checksum (zscaler-splunk-app_205.tgz) c72dcc6209bac8ba586cf39ae65f932eadbeb4b816eddb9ab741d5b354316c8b SHA256 checksum (zscaler-splunk-app_204.tgz) 7da11bcd723e4e83f4043034a748a1c3574987f33ec0adb5263814478593fb84 SHA256 checksum (zscaler-splunk-app_203.tgz) c06916804fc7c907acd33eac93c159b9fcae21f249399fbf3869270de9f3da62 SHA256 checksum (zscaler-splunk-app_202.tgz) a45adfdea40942be31dca86151728763737b0fb072f0927f14cded6fd4483590 SHA256 checksum (zscaler-splunk-app_200.tgz) 44aafda7916392ad22fc1486944bf73a47b6ca6c2278b7776dd7eb6c21dd73ca SHA256 checksum (zscaler-splunk-app_103.tgz) 83c5d94657bc3b4d70e89039ec213035e5e1b7ef6ec6544f494e49f2db325e30 SHA256 checksum (zscaler-splunk-app_102.tgz) 30af6454826cde12cca8d6e06cb99f3ad29ce87d17a1ae5c031bd7b9def41585 SHA256 checksum (zscaler-splunk-app_101.tgz) e7279d580aaba0fb2b2204c7787df12f5566fa1612a381ec6d5aa7e0c7a81cb4 SHA256 checksum (zscaler-splunk-app_10.tgz) a84e6fca64b3c5d26ab08c6a87f453ae01ac26edce58f3d4672e9c33b452d291
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Zscaler Splunk App

Splunk Cloud
The Zscaler App for Splunk provides detailed dashboards and reporting for all Zscaler products using Zscaler Nanolog Streaming and Log Streaming services. The Zscaler App for Splunk can also ingest DLP incident information, bringing full context for DLP incidents directly into Splunk

Pre-built reports exist for Zscaler’s Internet Access and Private Access Platforms, this include:
* Overview Dashboards showing highlights for your Zscaler products
* Focussed dashboards for:
- Threat Intelligence
- Web Usage
- Remote Access usage
- Zscaler DLP - event and incident reports
Zscaler is excited to deliver this tight integration with Splunk and will continue to enhance reports, dashboards and integrations for the Zscaler Splunk App.

Please note this app has a key dependancy on the Zscaler TA for Splunk --> https://splunkbase.splunk.com/app/3865/

Full App and TA Documentarian is available here --> https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728

To ingest logs from the Zscaler Cloud into Splunk, an NSS server needs to be deployed. The NSS feed will send CIM formatted logs to Splunk. The Zscaler Technical Adapter for Splunk normalizes the logs into a common format that can be leveraged by different applications.

The Zscaler Splunk App provides pre built reports and dashboards including:
* Threat Intelligence
* Web Usage
* Remote Access Activity
* DLP events and incidents



For additional documentation, reach out to splunk-support@zscaler.com

Release Notes

Version 2.0.7
Oct. 14, 2021

Update 4/11/22: The sandbox and audit logs is currently unsupported within the Splunk App. Although the functionality to get these logs still exist within Zscaler, the Splunk App does not currently support fetching these logs.

This release upgrades all dashboard to XML 1.1, which will invoke updated JQuery and reestablish compatibility with Splunk Cloud.

Note: new Dashboards for Lateral Movement and Data Protection have been added, some widgets will be searching on new undocumented sourcetypes, full support these sourcetypes (e.g. CIM Mapping, setup instruction) is still be worked on and will be coming in the next TA update, coupled with the needed updates to the Zscaler/Splunk admin/install guide.

Version 2.0.6
Aug. 10, 2020
  • Added new Dashboard for Zscaler Private Access Connecter health (CPU, RAM, Network etc)
  • Minor fixes to Connections dashboard, and general app layout
  • Other small adjustments based on customer feedback
Version 2.0.5
Jan. 9, 2020

Added fix for Tunnel Widget not displaying rules in landing dashboard

Version 2.0.4
Dec. 30, 2019

Added fixes to make macro edit more friendly
Minor edits to some widgets to work better with RBAC

Version 2.0.3
Dec. 24, 2019

Now filtering locations from user oriented reports/widgets.

Version 2.0.2
Oct. 21, 2019

Added exciting new Security and Threat dashboards
- Security overview with Clickable events (pivot based on threats over user)
- Overall Trading info
- Web Traffic overview

Version 2.0.0
July 9, 2019

Version 2.0.0
Added Reports and Dashboard for new Modular Inputs:
- Admin Audit Logs (ZIA)
- Cloud Sandbox detailed reports

Moved all macros into TA, removed from App

Overview Dashboard modified to better reflect summary of all data inputs

New Private Access Health Dashboard

Version 1.0.3
May 2, 2018

V1.0 - Initial Release
V1.0.1 - Changed App name to "Zscaler Splunk App"
V1.0.2 - Removed dependabcy for "IMAP Mailbox" as it's not Splunk Certified
V1.0.3 - updated README.txt to include correct links in deps section

Version 1.0.2
April 16, 2018
Version 1.0.1
Feb. 28, 2018

V1.0.1 - Changed App name to "Zscaler Splunk App"

Version 1.0
Jan. 30, 2018

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.