Collect Zscaler ZPA logs

This document explains how to export Zscaler ZPA logs by setting up Bindplane agent and how log fields map to Google SecOps Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google SecOps overview .

A typical deployment consists of Zscaler ZPA and the Bindplane agent configured to send logs to Google SecOps. Each customer deployment can differ and might be more complex.

The deployment contains the following components:

• Zscaler ZPA: The platform from which you collect logs.

• Bindplane agent: The Bindplane agent fetches logs from Zscaler ZPA and sends logs to Google SecOps.

• Google SecOps: Retains and analyzes the logs.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the ZSCALER_ZPA label.

Before you begin

• Ensure that you have access to the Zscaler Private Access console. For more information, see Secure Private Access (ZPA) Help
• Ensure that you are using Zscaler ZPA 2024 or later.
• Ensure that all systems in the deployment architecture are configured with the UTC time zone.

Configure Log Receiver in Zscaler Private Access

Use the following steps to configure and manage Log Receiver in Zscaler Private Access:

Add a log receiver

1. Select Configuration & Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. Click Add Log Receiver.
3. In the Log Receivertab, do the following:
   1. In the Namefield, enter the name for the log receiver.
   2. In the Descriptionfield, enter a description.
   3. In the Domain or IP Addressfield, enter the fully qualified domain name (FQDN) or IP address for the log receiver.
   4. In the TCP Portfield, enter the TCP port number used by the log receiver.
   5. Select the encryption type in TLS Encryptionto enable or disable the encryption of the traffic between the App Connector and the log receiver. By default, this setting is disabled.
   6. In the App Connector groupslist, select groups that can forward logs to the receiver.
   7. Click Next.

4. In the Log Streamtab, do the following:

   1. Select a Log Typefrom the menu.
   2. Select a Log Templatefrom the menu.
   3. Copy-paste the Log Stream Contentand add new fields. Ensure the key names match the actual field names. The following are the default Log Stream Contentsettings for each log type:

   • User Activity:

      {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"ConnectionID": %j{ConnectionID},"InternalReason": %j{InternalReason},"ConnectionStatus": %j{ConnectionStatus},"IPProtocol": %d{IPProtocol},"DoubleEncryption": %d{DoubleEncryption},"Username": %j{Username},"ServicePort": %d{ServicePort},"ClientPublicIP": %j{ClientPublicIP},"ClientPrivateIP": %j{ClientPrivateIP},"ClientLatitude": %f{ClientLatitude},"ClientLongitude": %f{ClientLongitude},"ClientCountryCode": %j{ClientCountryCode},"ClientZEN": %j{ClientZEN},"Policy": %j{Policy},"Connector": %j{Connector},"ConnectorZEN": %j{ConnectorZEN},"ConnectorIP": %j{ConnectorIP},"ConnectorPort": %d{ConnectorPort},"Host": %j{Host},"Application": %j{Application},"AppGroup": %j{AppGroup},"Server": %j{Server},"ServerIP": %j{ServerIP},"ServerPort": %d{ServerPort},"PolicyProcessingTime": %d{PolicyProcessingTime},"ServerSetupTime": %d{ServerSetupTime},"TimestampConnectionStart": %j{TimestampConnectionStart:iso8601},"TimestampConnectionEnd": %j{TimestampConnectionEnd:iso8601},"TimestampCATx": %j{TimestampCATx:iso8601},"TimestampCARx": %j{TimestampCARx:iso8601},"TimestampAppLearnStart": %j{TimestampAppLearnStart:iso8601},"TimestampZENFirstRxClient": %j{TimestampZENFirstRxClient:iso8601},"TimestampZENFirstTxClient": %j{TimestampZENFirstTxClient:iso8601},"TimestampZENLastRxClient": %j{TimestampZENLastRxClient:iso8601},"TimestampZENLastTxClient": %j{TimestampZENLastTxClient:iso8601},"TimestampConnectorZENSetupComplete": %j{TimestampConnectorZENSetupComplete:iso8601},"TimestampZENFirstRxConnector": %j{TimestampZENFirstRxConnector:iso8601},"TimestampZENFirstTxConnector": %j{TimestampZENFirstTxConnector:iso8601},"TimestampZENLastRxConnector": %j{TimestampZENLastRxConnector:iso8601},"TimestampZENLastTxConnector": %j{TimestampZENLastTxConnector:iso8601},"ZENTotalBytesRxClient": %d{ZENTotalBytesRxClient},"ZENBytesRxClient": %d{ZENBytesRxClient},"ZENTotalBytesTxClient": %d{ZENTotalBytesTxClient},"ZENBytesTxClient": %d{ZENBytesTxClient},"ZENTotalBytesRxConnector": %d{ZENTotalBytesRxConnector},"ZENBytesRxConnector": %d{ZENBytesRxConnector},"ZENTotalBytesTxConnector": %d{ZENTotalBytesTxConnector},"ZENBytesTxConnector": %d{ZENBytesTxConnector},"Idp": %j{Idp},"ClientToClient": %j{c2c},"ClientCity": %j{ClientCity},"MicroTenantID": %j{MicroTenantID},"AppMicroTenantID": %j{AppMicroTenantID}}\n 
     

   • User Status:

       { 
      "LogTimestamp" 
      : 
       
      % 
      j 
      { 
      LogTimestamp: 
      time 
      }, 
      "Customer" 
      : 
       
      % 
      j 
      { 
      Customer 
      }, 
      "Username" 
      : 
       
      % 
      j 
      { 
      Username 
      }, 
      "SessionID" 
      : 
       
      % 
      j 
      { 
      SessionID 
      }, 
      "SessionStatus" 
      : 
       
      % 
      j 
      { 
      SessionStatus 
      }, 
      "Version" 
      : 
       
      % 
      j 
      { 
      Version 
      }, 
      "ZEN" 
      : 
       
      % 
      j 
      { 
      ZEN 
      }, 
      "CertificateCN" 
      : 
       
      % 
      j 
      { 
      CertificateCN 
      }, 
      "PrivateIP" 
      : 
       
      % 
      j 
      { 
      PrivateIP 
      }, 
      "PublicIP" 
      : 
       
      % 
      j 
      { 
      PublicIP 
      }, 
      "Latitude" 
      : 
       
      % 
      f 
      { 
      Latitude 
      }, 
      "Longitude" 
      : 
       
      % 
      f 
      { 
      Longitude 
      }, 
      "CountryCode" 
      : 
       
      % 
      j 
      { 
      CountryCode 
      }, 
      "TimestampAuthentication" 
      : 
       
      % 
      j 
      { 
      TimestampAuthentication: 
      iso8601 
      }, 
      "TimestampUnAuthentication" 
      : 
       
      % 
      j 
      { 
      TimestampUnAuthentication: 
      iso8601 
      }, 
      "TotalBytesRx" 
      : 
       
      % 
      d 
      { 
      TotalBytesRx 
      }, 
      "TotalBytesTx" 
      : 
       
      % 
      d 
      { 
      TotalBytesTx 
      }, 
      "Idp" 
      : 
       
      % 
      j 
      { 
      Idp 
      }, 
      "Hostname" 
      : 
       
      % 
      j 
      { 
      Hostname 
      }, 
      "Platform" 
      : 
       
      % 
      j 
      { 
      Platform 
      }, 
      "ClientType" 
      : 
       
      % 
      j 
      { 
      ClientType 
      }, 
      "TrustedNetworks" 
      : 
       
      [ 
      % 
      j 
      (,){ 
      TrustedNetworks 
      }], 
      "TrustedNetworksNames" 
      : 
       
      [ 
      % 
      j 
      (,){ 
      TrustedNetworksNames 
      }], 
      "SAMLAttributes" 
      : 
       
      % 
      j 
      { 
      SAMLAttributes 
      }, 
      "PosturesHit" 
      : 
       
      [ 
      % 
      j 
      (,){ 
      PosturesHit 
      }], 
      "PosturesMiss" 
      : 
       
      [ 
      % 
      j 
      (,){ 
      PosturesMiss 
      }], 
      "ZENLatitude" 
      : 
       
      % 
      f 
      { 
      ZENLatitude 
      }, 
      "ZENLongitude" 
      : 
       
      % 
      f 
      { 
      ZENLongitude 
      }, 
      "ZENCountryCode" 
      : 
       
      % 
      j 
      { 
      ZENCountryCode 
      }, 
      "FQDNRegistered" 
      : 
       
      % 
      j 
      { 
      fqdn_registered 
      }, 
      "FQDNRegisteredError" 
      : 
       
      % 
      j 
      { 
      fqdn_register_error 
      }, 
      "City" 
      : 
       
      % 
      j 
      { 
      City 
      }, 
      "MicroTenantID" 
      : 
       
      % 
      j 
      { 
      MicroTenantID 
      }} 
      \n 
      
     

   • Browser Access

      {"LogTimestamp":%j{LogTimestamp:time},"ConnectionID":%j{ConnectionID},"Exporter":%j{Exporter},"TimestampRequestReceiveStart":%j{TimestampRequestReceiveStart:iso8601},"TimestampRequestReceiveHeaderFinish":%j{TimestampRequestReceiveHeaderFinish:iso8601},"TimestampRequestReceiveFinish":%j{TimestampRequestReceiveFinish:iso8601},"TimestampRequestTransmitStart":%j{TimestampRequestTransmitStart:iso8601},"TimestampRequestTransmitFinish":%j{TimestampRequestTransmitFinish:iso8601},"TimestampResponseReceiveStart":%j{TimestampResponseReceiveStart:iso8601},"TimestampResponseReceiveFinish":%j{TimestampResponseReceiveFinish:iso8601},"TimestampResponseTransmitStart":%j{TimestampResponseTransmitStart:iso8601},"TimestampResponseTransmitFinish":%j{TimestampResponseTransmitFinish:iso8601},"TotalTimeRequestReceive":%d{TotalTimeRequestReceive},"TotalTimeRequestTransmit":%d{TotalTimeRequestTransmit},"TotalTimeResponseReceive":%d{TotalTimeResponseReceive},"TotalTimeResponseTransmit":%d{TotalTimeResponseTransmit},"TotalTimeConnectionSetup":%d{TotalTimeConnectionSetup},"TotalTimeServerResponse":%d{TotalTimeServerResponse},"Method":%j{Method},"Protocol":%j{Protocol},"Host":%j{Host},"URL":%j{URL},"UserAgent":%j{UserAgent},"XFF":%j{XFF},"NameID":%j{NameID},"StatusCode":%d{StatusCode},"RequestSize":%d{RequestSize},"ResponseSize":%d{ResponseSize},"ApplicationPort":%d{ApplicationPort},"ClientPublicIp":%j{ClientPublicIp},"ClientPublicPort":%d{ClientPublicPort},"ClientPrivateIp":%j{ClientPrivateIp},"Customer":%j{Customer},"ConnectionStatus":%j{ConnectionStatus},"ConnectionReason":%j{ConnectionReason},"Origin":%j{Origin},"CorsToken":%j{CorsToken}}\n 
     

   • Private Service Edge Status:

      {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"PackageVersion": %j{PackageVersion},"Platform": %j{Platform},"ZEN": %j{ZEN},"ServiceEdge": %j{ServiceEdge},"ServiceEdgeGroup": %j{ServiceEdgeGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostUpTime": %j{HostUpTime},"ServiceEdgeStartTime": %j{ServiceEdgeStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n 
     

   • App Connector Status:

      {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"Platform": %j{Platform},"ZEN": %j{ZEN},"Connector": %j{Connector},"ConnectorGroup": %j{ConnectorGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"ServiceCount": %d{ServiceCount},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostStartTime": %j{HostStartTime},"ConnectorStartTime": %j{ConnectorStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n 
     

   • App Connector Metrics:

      {"LogTimestamp":%j{LogTimestamp:time},"Connector":%j{Connector},"CPUUtilization":%j{CPUUtilization},"SystemMemoryUtilization":%j{SystemMemoryUtilization},"ProcessMemoryUtilization":%j{ProcessMemoryUtilization},"AppCount":%j{AppCount},"ServiceCount":%j{ServiceCount},"TargetCount":%j{TargetCount},"AliveTargetCount":%j{AliveTargetCount},"ActiveConnectionsToPublicSE":%j{ActiveConnectionsToPublicSE},"DisconnectedConnectionsToPublicSE":%j{DisconnectedConnectionsToPublicSE},"ActiveConnectionsToPrivateSE":%j{ActiveConnectionsToPrivateSE},"DisconnectedConnectionsToPrivateSE":%j{DisconnectedConnectionsToPrivateSE},"TransmittedBytesToPublicSE":%j{TransmittedBytesToPublicSE},"ReceivedBytesFromPublicSE":%j{ReceivedBytesFromPublicSE},"TransmittedBytesToPrivateSE":%j{TransmittedBytesToPrivateSE},"ReceivedBytesFromPrivateSE":%j{ReceivedBytesFromPrivateSE},"AppConnectionsCreated":%j{AppConnectionsCreated},"AppConnectionsCleared":%j{AppConnectionsCleared},"AppConnectionsActive":%j{AppConnectionsActive},"UsedTCPPortsIPv4":%j{UsedTCPPortsIPv4},"UsedUDPPortsIPv4":%j{UsedUDPPortsIPv4},"UsedTCPPortsIPv6":%j{UsedTCPPortsIPv6},"UsedUDPPortsIPv6":%j{UsedUDPPortsIPv6},"AvailablePorts":%j{AvailablePorts},"SystemMaximumFileDescriptors":%j{SystemMaximumFileDescriptors},"SystemUsedFileDescriptors":%j{SystemUsedFileDescriptors},"ProcessMaximumFileDescriptors":%j{ProcessMaximumFileDescriptors},"ProcessUsedFileDescriptors":%j{ProcessUsedFileDescriptors},"AvailableDiskBytes":%j{AvailableDiskBytes},"MicroTenantID": %j{MicroTenantID}}\n 
     

   • AppProtection:

      {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"ConnectionID": %j{ConnectionID},"UserID": %j{UserID},"AssistantID": %j{AssistantID},"ExchangeSequenceIndex": %d{ExchangeSequenceIndex},"TimestampRequestReceiveStart": %d{TimestampRequestReceiveStart},"TimestampRequestReceiveHeaderFinish": %d{TimestampRequestReceiveHeaderFinish},"TimestampRequestReceiveFinish": %d{TimestampRequestReceiveFinish},"TimestampRequestTransmitStart": %d{TimestampRequestTransmitStart},"TimestampRequestTransmitFinish": %d{TimestampRequestTransmitFinish},"TimestampResponseReceiveFinish": %d{TimestampResponseReceiveFinish},"TimestampResponseTransmitStart": %d{TimestampResponseTransmitStart},"TimestampResponseTransmitFinish": %d{TimestampResponseTransmitFinish},"TotalTimeRequestReceive": %d{TotalTimeRequestReceive},"TotalTimeRequestTransmit": %d{TotalTimeRequestTransmit},"TotalTimeResponseReceive": %d{TotalTimeResponseReceive},"TotalTimeResponseTransmit": %d{TotalTimeResponseTransmit},"Domain": %j{Domain},"Method": %j{Method},"Protocol": %j{Protocol},"ProtocolVersion": %j{ProtocolVersion},"ContentType": %j{ContentType},"ContentEncoding": %j{ContentEncoding},"TransferEncoding": %j{TransferEncoding},"Host": %j{Host},"Destination": %j{Destination},"OriginDomain": %j{OriginDomain},"URL": %j{URL},"UserAgent": %j{UserAgent},"HTTPError": %j{HTTPError},"ClientPublicIp": %j{ClientPublicIp},"ClientPort": %d{ClientPort},"UpgradeHeaderPresent": %d{UpgradeHeaderPresent},"StatusCode": %d{StatusCode},"RequestHdrSize": %d{RequestHdrSize},"ResponseHdrSize": %d{ResponseHdrSize},"RequestBodySize": %d{RequestBodySize},"ResponseBodySize": %d{ResponseBodySize},"Application": %d{Application},"ApplicationGroup": %d{ApplicationGroup},"InspectionPolicy": %d{InspectionPolicy},"InspectionProfile": %d{InspectionProfile},"ParanoiaLevel": %d{ParanoiaLevel},"InspectionControlsHitCount": %d{InspectionControlsHitCount},"InspectionRuleProcessingTime": %d{InspectionRuleProcessingTime},"InspectionReqHeadersProcessingTime": %d{InspectionReqHeadersProcessingTime},"InspectionReqBodyProcessingTime": %d{InspectionReqBodyProcessingTime},"InspectionRespHeadersProcessingTime": %d{InspectionRespHeadersProcessingTime},"InspectionRespBodyProcessingTime": %d{InspectionRespBodyProcessingTime},"CertificateId": %d{CertificateId},"DoubleEncryption": %d{DoubleEncryption},"SSLInspection": %d{SSLInspection},"TotalBytesProcessed": %d{TotalBytesProcessed},"InspectionControls": [%j(,){InspectionControlArray}],"InspectionControlTypes": [%j(,){ControlTypeArray}],"InspectionControlCategories": [%j(,){InspectionControlCategories}],"Actions": [%j(,){Actions}],"Severities": [%j(,){SeveritiesArray}],"Descriptions": [%j(,){DescriptiveExplanationsArray}]}\n 
     

   • Private Service Edge Metrics:

      {"LogTimestamp":%j{LogTimestamp:time},"PrivateSE":%j{PrivateSE},"CPUUtilization":%j{CPUUtilization},"SystemMemoryUtilization":%j{SystemMemoryUtilization},"ProcessMemoryUtilization":%j{ProcessMemoryUtilization},"UsedTCPPortsIPv4":%j{UsedTCPPortsIPv4},"UsedUDPPortsIPv4":%j{UsedUDPPortsIPv4},"UsedTCPPortsIPv6":%j{UsedTCPPortsIPv6},"UsedUDPPortsIPv6":%j{UsedUDPPortsIPv6},"AvailablePorts":%j{AvailablePorts},"SystemMaximumFileDescriptors":%j{SystemMaximumFileDescriptors},"SystemUsedFileDescriptors":%j{SystemUsedFileDescriptors},"ProcessMaximumFileDescriptors":%j{ProcessMaximumFileDescriptors},"ProcessUsedFileDescriptors":%j{ProcessUsedFileDescriptors},"AvailableDiskBytes":%j{AvailableDiskBytes}}\n 
     

   1. Edit the log stream content in the Log Stream Contentto create a custom log template.
   2. In the SAML Attributes, click Select IdPand select the IdP configuration you want to include in the policy.
   3. In the Application Segmentsmenu, select the application segments you want to include and click Done.
   4. In the Segment Groupsmenu, select the segment groups you want to include and click Done.
   5. In the Client Typesmenu, select the client types you want to include and click Done.
   6. In the Session Statusesmenu, select the session status codes you want to exclude and click Done.
   7. Click Next.

5. In the Reviewtab, review your log receiver configuration and click Save.

Note:The ZSCALER_ZPA Gold parser only supports JSON log format, therefore make sure to select JSONas Log Templatefrom the menu while configuring log stream.

Copy a log Receiver

1. Select Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. In the table, locate the log receiver you want to modify and click Copy.
3. In the Add Log Receiverwindow, modify fields as necessary. To learn more about each field, see the procedure in the Add Log Receiversection.
4. Click Save.

Edit a log Receiver

1. Select Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. In the table, locate the log receiver you want to modify and click Edit.
3. In the Edit Log Receiverwindow, modify fields as necessary. To learn more about each field, see the procedure in the Add Log Receiversection.
4. Click Save.

Delete a log Receiver

1. Select Control > Private Infrastructure > Log Streaming Service > Log Receivers.
2. In the table, locate the log receiver you want to modify and click Delete.
3. In the Confirmationwindow, click Delete.

Forward Logs to Google SecOps using Bindplane agent

1. Install and set up a Linux Virtual Machine.
2. Install and configure the Bindplane agent on Linux to forward logs to Google SecOps. For more information about how to install and configure the Bindplane agent, see the Bindplane agent installation and configuration instructions .

If you encounter issues when you create feeds, contact Google SecOps support .

Supported Zscaler ZPA log formats

The Zscaler ZPA parser supports logs in JSON format.

Supported Zscaler ZPA Sample Logs

• JSON

   {
    "LogTimestamp": "Wed Jun 12 23:54:04 2024",
    "Customer": "Dummy User",
    "SessionID": "oKbLDDwJQN8C0lNHtAkh",
    "ConnectionID": "oKbLDDwJQN8C0lNHtAkh,WkyDJqMGv8TzkHKsK7uq",
    "InternalReason": "APP_NOT_REACHABLE",
    "ConnectionStatus": "close",
    "IPProtocol": 6,
    "DoubleEncryption": 0,
    "Username": "ZPA LSS Client",
    "ServicePort": 30161,
    "ClientPublicIP": "198.51.100.0",
    "ClientPrivateIP": "",
    "ClientLatitude": 45.823400,
    "ClientLongitude": -119.725700,
    "ClientCountryCode": "US",
    "ClientZEN": "US-CA-9390",
    "Policy": "0",
    "Connector": "0",
    "ConnectorZEN": "0",
    "ConnectorIP": "",
    "ConnectorPort": 0,
    "Host": "198.51.100.1",
    "Application": "Pune COE Receiver Logs - User Logs",
    "AppGroup": "Pune COE Receiver Logs - User Logs",
    "Server": "0",
    "ServerIP": "",
    "ServerPort": 30161,
    "PolicyProcessingTime": 66,
    "ServerSetupTime": 0,
    "TimestampConnectionStart": "2024-06-12T23:54:04.733Z",
    "TimestampConnectionEnd": "2024-06-12T23:54:04.735Z",
    "TimestampCATx": "2024-06-12T23:54:04.733Z",
    "TimestampCARx": "",
    "TimestampAppLearnStart": "",
    "TimestampZENFirstRxClient": "",
    "TimestampZENFirstTxClient": "",
    "TimestampZENLastRxClient": "",
    "TimestampZENLastTxClient": "",
    "TimestampConnectorZENSetupComplete": "",
    "TimestampZENFirstRxConnector": "",
    "TimestampZENFirstTxConnector": "",
    "TimestampZENLastRxConnector": "",
    "TimestampZENLastTxConnector": "",
    "ZENTotalBytesRxClient": 0,
    "ZENBytesRxClient": 0,
    "ZENTotalBytesTxClient": 0,
    "ZENBytesTxClient": 0,
    "ZENTotalBytesRxConnector": 0,
    "ZENBytesRxConnector": 0,
    "ZENTotalBytesTxConnector": 0,
    "ZENBytesTxConnector": 0,
    "Idp": "0",
    "ClientToClient": "0",
    "ClientCity": "Boardman",
    "MicroTenantID": "0",
    "AppMicroTenantID": "0"
  } 
  

UDM Mapping Table

Field mapping reference: ZSCALER_ZPA

The following table lists the log fields of the ZSCALER_ZPA log type and their corresponding UDM fields.

Need more help? Get answers from Community members and Google SecOps professionals.