Collect Zscaler CASB logs

This document describes how you can export Zscaler CASB logs by setting up a Google Security Operations feed and mapping log fields to the Unified Data Model (UDM).

For more information, see Data ingestion to Google SecOps overview .

A typical deployment consists of Zscaler CASB and a Google SecOps Webhook feed configured to send logs to Google SecOps. However, deployment details can differ by customer and could be more complex.

The deployment contains the following components:

• Zscaler CASB: The platform from which you collect logs.

• Google SecOps feed: The Google SecOps feed that fetches logs from Zscaler CASB and writes logs to Google SecOps.

• Google SecOps: Retains and analyzes the logs.

An ingestion label identifies the parser that normalizes raw log data into the structured UDM format. This document applies specifically to the parser associated with the ZSCALER_CASB ingestion label.

Before you begin

• Ensure that you have access to Zscaler Internet Access console. For more information, see Secure Internet and SaaS Access ZIA Help .
• Ensure that you're using Zscaler CASB version 1.0 or 2.0.
• Ensure that all systems in the deployment architecture are configured with the UTC time zone.
• Ensure that you have the API key required to complete feed setup in Google SecOps. For more information, see Setting up API keys .

Set up feeds

To configure this log type, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click the Zscalerfeed pack.
4. Locate the required log type and click Add New Feed.

5. Enter values for the following input parameters:

   • Source Type: Webhook (Recommended)
   • Split delimiter: the character used to separate logs lines. Leave blank if no delimiter is used.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed .
   • Ingestion Labels: Labels applied to all events from this feed.

6. Click Create Feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product .

Set up Zscaler CASB

1. In the Zscaler Internet Access Console, click Administration > Nanolog Streaming Service > Cloud NSS Feeds > Add Cloud NSS Feed.
2. In the Add Cloud NSS Feed window, enter the details.
3. In the Feed Namefield, enter a unique name for the feed.
4. Select Zscaler for Webin NSS Type.
5. In the Statuslist, select a status to activate or deactivate the NSS feed.
6. Leave SIEM Rateas Unlimited, unless you need to throttle the output stream due to licensing or other constraints.
7. In the SIEM Typelist, select Other.
8. In the OAuth 2.0 Authenticationlist, select Disabled.
9. In the Max Batch Sizefield, enter a size limit for an individual HTTP request payload to the SIEM's best practice; for example, 512 KB .

10. In the API URLfield, enter the HTTPS URL of the Chronicle API endpoint using the following format:

     https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs 
    

    • CHRONICLE_REGION : Region where your Google SecOps instance is hosted. For example, US .
    • GOOGLE_PROJECT_NUMBER : Your BYOP project number. Obtain this from C4.
    • LOCATION : Chronicle (Google SecOps) region (same as CHRONICLE_REGION ). For example, US .
    • CUSTOMER_ID : Your Google SecOps customer ID. Obtain from C4.
    • FEED_ID : ID of the newly created webhook feed (shown in the Feed UI).

    • Sample API URL:

       https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs 
      

11. Click Add HTTP Header, and then add HTTP headers in the following format:

    • Header 1 : Key1: X-goog-api-key and Value1:API Key generated from Google Cloud BYOP's API Credentials.
    • Header 2 : Key2: X-Webhook-Access-Key and Value2:API secret key generated in webhook's "SECRET KEY".

12. In the Log Typeslist, select SaaS Securityor SaaS Security Activity.

13. In the Feed Output Typelist, select JSON.

14. Disable JSON Array Notation.

15. Set Feed Escape Characterto , \ " .

16. In the Feed Output Typelist, select Customto add a new field to the Feed Output Format.

17. Copy and paste the Feed Output Format, and then add new fields, as needed. Ensure the key names match the actual field names.

18. Following are the default Feed Output Formats:

    • SaaS Security

     \ { 
      
     "sourcetype" 
      
     : 
      
     "zscalernss-casb" 
     , 
      
     "event" 
      
     : 
    \ { 
     "datetime" 
     : 
     " 
     %s 
     {time}" 
     , 
     "recordid" 
     : 
     " 
     %d 
     {recordid}" 
     , 
     "company" 
     : 
     " 
     %s 
     {company}" 
     , 
     "tenant" 
     : 
     " 
     %s 
     {tenant}" 
     , 
     "login" 
     : 
     " 
     %s 
     {user}" 
     , 
     "dept" 
     : 
     " 
     %s 
     {department}" 
     , 
     "applicationname" 
     : 
     " 
     %s 
     {applicationname}" 
     , 
     "filename" 
     : 
     " 
     %s 
     {filename}" 
     , 
     "filesource" 
     : 
     " 
     %s 
     {filesource}" 
     , 
     "filemd5" 
     : 
     " 
     %s 
     {filemd5}" 
     , 
     "threatname" 
     : 
     " 
     %s 
     {threatname}" 
     , 
     "policy" 
     : 
     " 
     %s 
     {policy}" 
     , 
     "dlpdictnames" 
     : 
     " 
     %s 
     {dlpdictnames}" 
     , 
     "dlpdictcount" 
     : 
     " 
     %s 
     {dlpdictcount}" 
     , 
     "dlpenginenames" 
     : 
     " 
     %s 
     {dlpenginenames}" 
     , 
     "fullurl" 
     : 
     " 
     %s 
     {fullurl}" 
     , 
     "lastmodtime" 
     : 
     " 
     %s 
     {lastmodtime}" 
     , 
     "filescantimems" 
     : 
     " 
     %d 
     {filescantimems}" 
     , 
     "filedownloadtimems" 
     : 
     " 
     %d 
     {filedownloadtimems}" 
    \ } 
    \ } 
     
    

    • SaaS Security Activity

      \ 
     { 
      
     "sourcetype" 
      
     : 
      
     "zscalernss-casb" 
     , 
      
     "event" 
      
     : 
     \ 
     { 
     "login" 
     : 
     "%s{username}" 
     , 
     "tenant" 
     : 
     "%s{tenant}" 
     , 
     "object_type" 
     : 
     "%d{objtype1}" 
     , 
     "applicationname" 
     : 
     "%s{appname}" 
     , 
     "object_name_1" 
     : 
     "%s{objnames1}" 
     , 
     "object_name_2" 
     : 
     "%s{objnames2}" 
     \ 
     } 
     \ 
     } 
     
    

19. From the Timezonelist, select the time zone for the Timefield in the output file. By default, the time zone is set to your organization's time zone.

20. Review the configured settings.

21. Click Saveto test connectivity. If the connection is successful, a green tick accompanied by the message Test Connectivity Successful: OK (200)appears.

For more information about Google SecOps feeds, see Google SecOps feeds documentation . For information about requirements for each feed type, see Feed configuration by type .

If you encounter issues when you create feeds, contact Google SecOps support .

Field mapping reference

Field mapping reference: ZSCALER_CASB

The following table lists the log fields of the ZSCALER_CASB log type and their corresponding UDM fields.

What's next

• Data ingestion to Google SecOps

Need more help? Get answers from Community members and Google SecOps professionals.