Collect Zscaler VPN logs

This document explains how to export Zscaler VPN logs by setting up Bindplane agent and how log fields map to Google SecOps Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google SecOps overview .

A typical deployment consists of Zscaler VPN and the Bindplane agent configured to send logs to Google SecOps. Each customer deployment can differ and might be more complex.

The deployment contains the following components:

• Zscaler VPN: The platform from which you collect logs.

• Bindplane agent: The Bindplane agent fetches logs from Zscaler VPN and sends logs to Google SecOps.

• Google SecOps: Retains and analyzes the logs.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the ZSCALER_VPN label.

Before you begin

• Ensure that you have access to the Zscaler Private Access console. For more information, see Secure Private Access (ZPA) Help .
• Ensure that you are using Zscaler VPN 2024 or later.
• Ensure that all systems in the deployment architecture are configured with the UTC time zone.

Configure Log Receiver in Zscaler Private Access

Use the following steps to configure and manage Log Receiver in Zscaler Private Access:

Add a log receiver

1. Go to Configuration & Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. Click Add Log Receiver.
3. In the Log Receivertab, do the following:
   1. In the Namefield, enter the name for the log receiver.
   2. In the Descriptionfield, enter a description.
   3. In the Domain or IP Addressfield, enter the fully qualified domain name (FQDN) or IP address for the log receiver.
   4. In the TCP Portfield, enter the TCP port number used by the log receiver .
   5. Select the encryption type in TLS Encryptionto enable or disable the encryption of the traffic between the App Connector and the log receiver. By default, this setting is disabled.
   6. Select App Connector groups that can forward logs to the receiver from the App Connector groupslist and click Done.
   7. Click Next.

4. In the Log Streamtab, do the following:

   1. Select a Log Typefrom the menu.
   2. Select a Log Templatefrom the menu.

   3. Copy-paste the Log Stream Contentand add new fields. Ensure the key names match the actual field names.

      The following are the default Log Stream Contentsettings for each log type:

      • User Activity:

         {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"ConnectionID": %j{ConnectionID},"InternalReason": %j{InternalReason},"ConnectionStatus": %j{ConnectionStatus},"IPProtocol": %d{IPProtocol},"DoubleEncryption": %d{DoubleEncryption},"Username": %j{Username},"ServicePort": %d{ServicePort},"ClientPublicIP": %j{ClientPublicIP},"ClientPrivateIP": %j{ClientPrivateIP},"ClientLatitude": %f{ClientLatitude},"ClientLongitude": %f{ClientLongitude},"ClientCountryCode": %j{ClientCountryCode},"ClientZEN": %j{ClientZEN},"Policy": %j{Policy},"Connector": %j{Connector},"ConnectorZEN": %j{ConnectorZEN},"ConnectorIP": %j{ConnectorIP},"ConnectorPort": %d{ConnectorPort},"Host": %j{Host},"Application": %j{Application},"AppGroup": %j{AppGroup},"Server": %j{Server},"ServerIP": %j{ServerIP},"ServerPort": %d{ServerPort},"PolicyProcessingTime": %d{PolicyProcessingTime},"ServerSetupTime": %d{ServerSetupTime},"TimestampConnectionStart": %j{TimestampConnectionStart:iso8601},"TimestampConnectionEnd": %j{TimestampConnectionEnd:iso8601},"TimestampCATx": %j{TimestampCATx:iso8601},"TimestampCARx": %j{TimestampCARx:iso8601},"TimestampAppLearnStart": %j{TimestampAppLearnStart:iso8601},"TimestampZENFirstRxClient": %j{TimestampZENFirstRxClient:iso8601},"TimestampZENFirstTxClient": %j{TimestampZENFirstTxClient:iso8601},"TimestampZENLastRxClient": %j{TimestampZENLastRxClient:iso8601},"TimestampZENLastTxClient": %j{TimestampZENLastTxClient:iso8601},"TimestampConnectorZENSetupComplete": %j{TimestampConnectorZENSetupComplete:iso8601},"TimestampZENFirstRxConnector": %j{TimestampZENFirstRxConnector:iso8601},"TimestampZENFirstTxConnector": %j{TimestampZENFirstTxConnector:iso8601},"TimestampZENLastRxConnector": %j{TimestampZENLastRxConnector:iso8601},"TimestampZENLastTxConnector": %j{TimestampZENLastTxConnector:iso8601},"ZENTotalBytesRxClient": %d{ZENTotalBytesRxClient},"ZENBytesRxClient": %d{ZENBytesRxClient},"ZENTotalBytesTxClient": %d{ZENTotalBytesTxClient},"ZENBytesTxClient": %d{ZENBytesTxClient},"ZENTotalBytesRxConnector": %d{ZENTotalBytesRxConnector},"ZENBytesRxConnector": %d{ZENBytesRxConnector},"ZENTotalBytesTxConnector": %d{ZENTotalBytesTxConnector},"ZENBytesTxConnector": %d{ZENBytesTxConnector},"Idp": %j{Idp},"ClientToClient": %j{c2c},"ClientCity": %j{ClientCity},"MicroTenantID": %j{MicroTenantID},"AppMicroTenantID": %j{AppMicroTenantID}}\n 
        

      • User Status:

          { 
         "LogTimestamp" 
         : 
          
         % 
         j 
         { 
         LogTimestamp: 
         time 
         }, 
         "Customer" 
         : 
          
         % 
         j 
         { 
         Customer 
         }, 
         "Username" 
         : 
          
         % 
         j 
         { 
         Username 
         }, 
         "SessionID" 
         : 
          
         % 
         j 
         { 
         SessionID 
         }, 
         "SessionStatus" 
         : 
          
         % 
         j 
         { 
         SessionStatus 
         }, 
         "Version" 
         : 
          
         % 
         j 
         { 
         Version 
         }, 
         "ZEN" 
         : 
          
         % 
         j 
         { 
         ZEN 
         }, 
         "CertificateCN" 
         : 
          
         % 
         j 
         { 
         CertificateCN 
         }, 
         "PrivateIP" 
         : 
          
         % 
         j 
         { 
         PrivateIP 
         }, 
         "PublicIP" 
         : 
          
         % 
         j 
         { 
         PublicIP 
         }, 
         "Latitude" 
         : 
          
         % 
         f 
         { 
         Latitude 
         }, 
         "Longitude" 
         : 
          
         % 
         f 
         { 
         Longitude 
         }, 
         "CountryCode" 
         : 
          
         % 
         j 
         { 
         CountryCode 
         }, 
         "TimestampAuthentication" 
         : 
          
         % 
         j 
         { 
         TimestampAuthentication: 
         iso8601 
         }, 
         "TimestampUnAuthentication" 
         : 
          
         % 
         j 
         { 
         TimestampUnAuthentication: 
         iso8601 
         }, 
         "TotalBytesRx" 
         : 
          
         % 
         d 
         { 
         TotalBytesRx 
         }, 
         "TotalBytesTx" 
         : 
          
         % 
         d 
         { 
         TotalBytesTx 
         }, 
         "Idp" 
         : 
          
         % 
         j 
         { 
         Idp 
         }, 
         "Hostname" 
         : 
          
         % 
         j 
         { 
         Hostname 
         }, 
         "Platform" 
         : 
          
         % 
         j 
         { 
         Platform 
         }, 
         "ClientType" 
         : 
          
         % 
         j 
         { 
         ClientType 
         }, 
         "TrustedNetworks" 
         : 
          
         [ 
         % 
         j 
         (,){ 
         TrustedNetworks 
         }], 
         "TrustedNetworksNames" 
         : 
          
         [ 
         % 
         j 
         (,){ 
         TrustedNetworksNames 
         }], 
         "SAMLAttributes" 
         : 
          
         % 
         j 
         { 
         SAMLAttributes 
         }, 
         "PosturesHit" 
         : 
          
         [ 
         % 
         j 
         (,){ 
         PosturesHit 
         }], 
         "PosturesMiss" 
         : 
          
         [ 
         % 
         j 
         (,){ 
         PosturesMiss 
         }], 
         "ZENLatitude" 
         : 
          
         % 
         f 
         { 
         ZENLatitude 
         }, 
         "ZENLongitude" 
         : 
          
         % 
         f 
         { 
         ZENLongitude 
         }, 
         "ZENCountryCode" 
         : 
          
         % 
         j 
         { 
         ZENCountryCode 
         }, 
         "FQDNRegistered" 
         : 
          
         % 
         j 
         { 
         fqdn_registered 
         }, 
         "FQDNRegisteredError" 
         : 
          
         % 
         j 
         { 
         fqdn_register_error 
         }, 
         "City" 
         : 
          
         % 
         j 
         { 
         City 
         }, 
         "MicroTenantID" 
         : 
          
         % 
         j 
         { 
         MicroTenantID 
         }} 
         \n 
         
        

      • Browser Access:

         {"LogTimestamp":%j{LogTimestamp:time},"ConnectionID":%j{ConnectionID},"Exporter":%j{Exporter},"TimestampRequestReceiveStart":%j{TimestampRequestReceiveStart:iso8601},"TimestampRequestReceiveHeaderFinish":%j{TimestampRequestReceiveHeaderFinish:iso8601},"TimestampRequestReceiveFinish":%j{TimestampRequestReceiveFinish:iso8601},"TimestampRequestTransmitStart":%j{TimestampRequestTransmitStart:iso8601},"TimestampRequestTransmitFinish":%j{TimestampRequestTransmitFinish:iso8601},"TimestampResponseReceiveStart":%j{TimestampResponseReceiveStart:iso8601},"TimestampResponseReceiveFinish":%j{TimestampResponseReceiveFinish:iso8601},"TimestampResponseTransmitStart":%j{TimestampResponseTransmitStart:iso8601},"TimestampResponseTransmitFinish":%j{TimestampResponseTransmitFinish:iso8601},"TotalTimeRequestReceive":%d{TotalTimeRequestReceive},"TotalTimeRequestTransmit":%d{TotalTimeRequestTransmit},"TotalTimeResponseReceive":%d{TotalTimeResponseReceive},"TotalTimeResponseTransmit":%d{TotalTimeResponseTransmit},"TotalTimeConnectionSetup":%d{TotalTimeConnectionSetup},"TotalTimeServerResponse":%d{TotalTimeServerResponse},"Method":%j{Method},"Protocol":%j{Protocol},"Host":%j{Host},"URL":%j{URL},"UserAgent":%j{UserAgent},"XFF":%j{XFF},"NameID":%j{NameID},"StatusCode":%d{StatusCode},"RequestSize":%d{RequestSize},"ResponseSize":%d{ResponseSize},"ApplicationPort":%d{ApplicationPort},"ClientPublicIp":%j{ClientPublicIp},"ClientPublicPort":%d{ClientPublicPort},"ClientPrivateIp":%j{ClientPrivateIp},"Customer":%j{Customer},"ConnectionStatus":%j{ConnectionStatus},"ConnectionReason":%j{ConnectionReason},"Origin":%j{Origin},"CorsToken":%j{CorsToken}}\n 
        

      • Private Service Edge Status:

         {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"PackageVersion": %j{PackageVersion},"Platform": %j{Platform},"ZEN": %j{ZEN},"ServiceEdge": %j{ServiceEdge},"ServiceEdgeGroup": %j{ServiceEdgeGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostUpTime": %j{HostUpTime},"ServiceEdgeStartTime": %j{ServiceEdgeStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n 
        

      • App Connector Status:

         {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"Platform": %j{Platform},"ZEN": %j{ZEN},"Connector": %j{Connector},"ConnectorGroup": %j{ConnectorGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"ServiceCount": %d{ServiceCount},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostStartTime": %j{HostStartTime},"ConnectorStartTime": %j{ConnectorStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n 
        

   4. In the SAML Attributes, click Select IdPand select the IdP configuration you want to include in the policy.

   5. In the Application Segmentsmenu, select the application segments you want to include and click Done.

   6. In the Segment Groupsmenu, select the segment groups you want to include and click Done.

   7. In the Client Typesmenu, select the client types you want to include and click Done.

   8. In the Session Statusesmenu, select the session status codes you want to exclude and click Done.

   9. Click Next.

5. In the Reviewtab, review your log receiver configuration and click Save.

Note:The ZSCALER_VPN Gold parser only supports JSON log format, therefore make sure to select JSONas Log Templatefrom the menu while configuring log stream.

Copy a log Receiver

1. Go to Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. In the table, locate the log receiver you want to modify and click Copy.
3. In the Add Log Receiverwindow, modify fields as necessary. To learn more about each field, see the procedure in the Add Log Receiversection.
4. Click Save.

Edit a log Receiver

1. Go to Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. In the table, locate the log receiver you want to modify and click Edit.
3. In the Edit Log Receiverwindow, modify fields as necessary. To learn more about each field, see the procedure in the Add Log Receiversection.
4. Click Save.

Delete a log Receiver

1. Go to Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. In the table, locate the log receiver you want to modify and click Delete.
3. In the Confirmationwindow, click Delete.

Forward Logs to Google SecOps using Bindplane agent

1. Install and set up a Linux Virtual Machine.
2. Install and configure the Bindplane agent on Linux to forward logs to Google SecOps. For more information about how to install and configure the Bindplane agent, see the Bindplane agent installation and configuration instructions .

If you encounter issues when you create feeds, contact Google SecOps support .

Supported Zscaler VPN log formats

The Zscaler VPN parser supports logs in JSON format.

Supported Zscaler VPN Sample Logs

• JSON:

   {
    "LogTimestamp": "Thu Jan 18 10:31:01 2024",
    "Customer": "ABC Group",
    "SessionID": "session-id",
    "ConnectionID": "session-id,connection-id",
    "InternalReason": "OPEN_OR_ACTIVE_CONNECTION",
    "ConnectionStatus": "open",
    "IPProtocol": 6,
    "DoubleEncryption": 0,
    "Username": "bc@myownpersonaldomain.com",
    "ServicePort": 443,
    "ClientPublicIP": "198.51.100.0",
    "ClientPrivateIP": "198.51.100.0",
    "ClientLatitude": 51.000000,
    "ClientLongitude": 0.000000,
    "ClientCountryCode": "GB",
    "ClientZEN": "EU-GB-9900",
    "Policy": "RG-NAC-IT",
    "Connector": "abc.mc.local",
    "ConnectorZEN": "EU-GB-9900",
    "ConnectorIP": "198.51.100.0",
    "ConnectorPort": 51146,
    "Host": "xyz.io",
    "Application": "blabla",
    "AppGroup": "HB App Segments",
    "Server": "0",
    "ServerIP": "198.51.100.0",
    "ServerPort": 443,
    "PolicyProcessingTime": 63,
    "ServerSetupTime": 13069,
    "TimestampConnectionStart": "2024-01-18T10:31:01.152Z",
    "TimestampConnectionEnd": "",
    "TimestampCATx": "",
    "TimestampCARx": "2024-01-18T10:31:01.152Z",
    "TimestampAppLearnStart": "",
    "TimestampZENFirstRxClient": "",
    "TimestampZENFirstTxClient": "",
    "TimestampZENLastRxClient": "",
    "TimestampZENLastTxClient": "",
    "TimestampConnectorZENSetupComplete": "2024-01-18T10:31:01.172Z",
    "TimestampZENFirstRxConnector": "",
    "TimestampZENFirstTxConnector": "2024-01-18T10:31:01.172Z",
    "TimestampZENLastRxConnector": "",
    "TimestampZENLastTxConnector": "2024-01-18T10:31:01.172Z",
    "ZENTotalBytesRxClient": 710,
    "ZENBytesRxClient": 710,
    "ZENTotalBytesTxClient": 0,
    "ZENBytesTxClient": 0,
    "ZENTotalBytesRxConnector": 0,
    "ZENBytesRxConnector": 0,
    "ZENTotalBytesTxConnector": 0,
    "ZENBytesTxConnector": 0,
    "Idp": "Azure IdP Config",
    "ClientToClient": "0",
    "ClientCity": "Thamesmead",
    "MicroTenantID": "0",
    "AppMicroTenantID": "0"
  } 
  

Field mapping reference

Field mapping reference: ZSCALER_VPN

The following table lists the log fields of the ZSCALER_VPN log type and their corresponding UDM fields.

Need more help? Get answers from Community members and Google SecOps professionals.