icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading ZyXEL Firewall
SHA256 checksum (zyxel-firewall_201.tgz) 4a3bd4fce48119183564574d1ab1f792ed234205ad8c7734e0d6545d669ac683 SHA256 checksum (zyxel-firewall_200.tgz) 0989e661e61b2802c9bfd658a50a35712a46aff5e0cac9d910fa8ba16fac48c2 SHA256 checksum (zyxel-firewall_101.tgz) 14b6d8f81c471a802542e2e141f6394af142ea27492946e7538465d84473d25a SHA256 checksum (zyxel-firewall_100.tgz) bd139161db9e27617f392c959999242bc5f90031bb0e67937675bb17b7d655a0
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


ZyXEL Firewall

Splunk Cloud
A firewall is our first line of defence when it comes to Network Security, all the Traffic data getting inside the organization needs proper security. It is used to check any unauthorized access in the network premises and to monitor any unwanted activities and track them before it gets compromised in the network.

Zyxel Firewall Monitor app helps to control incoming and outgoing network traffic based on predetermined security rules. The main objective of the app is to investigate our firewall activities or any kind of malicious behavior from the outside world and determine the behavior with the help of Dashboards. This app gives proper insights of the Traffic Logs the outgoing and incoming traffic to the outside world, security to monitor sources and destinations which are approached for having contact with, organization’s VPN activities of internal and external users and to get notified with any activities in the firewall with the help of Reports and Alerts
To use this Zyxel Firewall Monitor app you need to first install TA_Zyxel_Splunk Add-on, this TA is mapped with Datamodels and will give the required sourcetypes to the firewall logs which can be used in this app.

Installation and Configuration:-
Installation is required to be done on SH.

Configuration - Once you are getting data from Zyxel Add-on for splunk as provided documentation there. Post installing Zyxel Firewall app need to edit Macro:
In the Zyxel App which is installed on Search Head –
Go to Settings -> Advanced Search -> search macros
Edit zywall_idx macro and add your index name


1) ZyXEL Home
This is the home page of the app, shows all important details of the firewall like firmware version, model name, device id, Current CPU and Memory levels in single value panel. Also includes introduction page along with the links to Edit event types used in app for modularity.

2) Security
The Security Tab will give the details of Failed Logins to VPN, Locked Sources for both Internal and External Users. It also detects the Intrusion of Source IP which has scanned Destination IP and ports and Outsiders attacks on the internal network and ports.

3) Traffic
This gives all the data usage statistics of firewall with chart showing data usage over the week. You can also view the data usage by the users and devices connected to firewall. These details get automatically captured by the Alerts and Reports running in the app. You may need to set the configurations for the alerts and reports as per your need.

4) VPN
This tab will give the overview of Users logging VPN with respect to their number of attempts made to login VPN, Total Sessions they used into login VPN in a particular Time range, details of the users who tried to login in out of office hours. Their total disconnects. The VPN IP they get when logged in to VPN along with these details get automatically captured by the Alerts and Reports.

5) Network Viz Firewall
This Tab will give a architectural Network Diagram of Users connecting to VPN, which VPN IP are they allocated. with that IP how many destinations they hit and the traffic data used in uploading and downloading data in MB.


1) Zyxel VPN login by new users
This report runs daily on 00:00 AM and collects the data into lookup if any new devices connected to the network.

2) Zyxel Out Of Office hours logins between 3 AM and 6 PM
This Report will run on every 24 hours and give the results of the users who had logged in to VPN in out of office hours

3) Zyxel Total Data Uploaded and Downloaded by all Users
This Report is scheduled for 24hrs it collects all the traffic uploaded and downloaded data by all users


1) Zyxel Firewall CPU/Memory Usage > 70
Triggers when firewall CPU/Memory usage goes beyond 70, runs at every one hour.
you can change the trigger condition as per requirement in query.

2) Zyxel Firewall Upload/Download Data Limit > 15GB
Sends alert when total downloaded data from organization goes beyond 15 GB. and upload data from organization goes beyond 1.5 GB. you can change the trigger condition as per requirement in query.

3) Zyxel Failed VPN Login Attempts > 3
This Alert will run for every hour and give the results for the users who has attempted failed VPN login by 3 consecutive times.

4) Zyxel Locked Users by Failed VPN Login Attempts
This Alert will trigger when an Internal user get locked by more than 3 consecutive failed attempts in VPN.

5) Zyxel User Download Data > 1GB
This alert will trigger when total downloaded data from employee's goes beyond 1 GB (default)

6) Zyxel VPN Not Connected By Users From Last 5 Days
This alert will trigger when a user has not logged in VPN from last 5 days.

7) Zyxel VPN not connected by users from last 24 hrs
This alert will get triggered for users who are not connected to VPN for last 24 hrs.

To learn more about configuration on Splunk and Zyxel app steps are give in app homepage

Release Notes

Version 2.0.1
Dec. 30, 2021
Version 2.0.0
Nov. 3, 2021
Version 1.0.1
July 14, 2020

Fixed the props.conf for obtaining correct ports, the regex has been modified to work efficiently.

Version 1.0.0
March 5, 2020

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.