To ingest logs from the Zscaler Cloud into Splunk, an NSS server needs to be deployed. The NSS feed will send CIM formatted logs to Splunk. The Zscaler Technical Adapter for Splunk normalizes the logs into a common format that can be leveraged by different applications.
The Zscaler Splunk App provides pre built reports and dashboards including:
* Threat Intelligence
* Web Usage
* Remote Access Activity
* DLP events and incidents
For additional documentation, reach out to splunk-support@zscaler.com
Update 4/11/22: The sandbox and audit logs is currently unsupported within the Splunk App. Although the functionality to get these logs still exist within Zscaler, the Splunk App does not currently support fetching these logs.
Notes:
This release upgrades all dashboard to XML 1.1, which will invoke updated JQuery and reestablish compatibility with Splunk Cloud.
Note: new Dashboards for Lateral Movement and Data Protection have been added, some widgets will be searching on new undocumented sourcetypes, full support these sourcetypes (e.g. CIM Mapping, setup instruction) is still be worked on and will be coming in the next TA update, coupled with the needed updates to the Zscaler/Splunk admin/install guide.
Added fix for Tunnel Widget not displaying rules in landing dashboard
Added fixes to make macro edit more friendly
Minor edits to some widgets to work better with RBAC
Now filtering locations from user oriented reports/widgets.
Added exciting new Security and Threat dashboards
- Security overview with Clickable events (pivot based on threats over user)
- Overall Trading info
- Web Traffic overview
Version 2.0.0
Added Reports and Dashboard for new Modular Inputs:
- Admin Audit Logs (ZIA)
- Cloud Sandbox detailed reports
Moved all macros into TA, removed from App
Overview Dashboard modified to better reflect summary of all data inputs
New Private Access Health Dashboard
V1.0 - Initial Release
V1.0.1 - Changed App name to "Zscaler Splunk App"
V1.0.2 - Removed dependabcy for "IMAP Mailbox" as it's not Splunk Certified
V1.0.3 - updated README.txt to include correct links in deps section
V1.0.1 - Changed App name to "Zscaler Splunk App"
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.