Collect data from Zscaler

See the changelog of this Listener type here.

Overview

Onum supports integration with Zscaler.

Zscaler is a cloud-native security platform that sits between your users and the internet, SaaS applications, and internal systems.

Note that our Zscaler Listener is designed specifically for Zscaler Internet Access (ZIA) via Nanolog Streaming Service (NSS).

Prerequisites

You must generate a JWT token in your Zscaler account, which will be needed on the Listener setup.

Onum Setup

1

Log in to your Onum tenant and click Listeners > New listener.

2

Double-click the Zscaler Listener.

3

Enter a Name for the new Listener. Optionally, add a Description and some Tags to identify the Listener.

4

In the Socket section, enter the required Port.

Note that this section will not appear in Onum cloud deployments.

5

In the Authentication section, enter your Zscaler token. Open the Select token field and click New secret to create a new one:

• Give the token a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the Zscaler token you received.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the secret you just created in the Select token field.

6

In the Processing method section, choose between Delimiter or Stacked JSON. If you choose Delimiter, enter the required characters in the Custom delimiter field that appears. The default value is \n.

7

In the TLS configuration section, enter the required certificates (Certificate, Private key and CA chain).

Note that this section will not appear in Onum cloud deployments.

8

Finally, click Create labels. Optionally, you can set labels to be used for internal Onum routing of data. By default, data will be set as Unlabeled.

Learn more about labels in this article.

9

Click Create listener when you're done.

Output Ports

The Zscaler Listener has two output ports:

• Default port - Events are sent through this port if no error occurs while processing them.

• Error port - Events are sent through this port if an error occurs while processing them.