Knowledge BaseRelease NotesRequest Demo

Zscaler ZPA

Connecting ZPA logs to your Panther Console

Overview

Panther supports ingesting Zscaler Private Access (ZPA) logs by using either an HTTP or AWS S3 Data Transport source. The following ZPA log types are supported:

In order to onboard Zscaler ZPA logs in Panther, you must have a subscription to Zscaler ZPA.

How to onboard Zscaler ZPA logs to Panther

To ingest ZPA logs in Panther, you will create a log source in Panther, then configure App Connectors and Log Receivers.

Prerequisites

  • You must have permission to access the Zscaler ZPA console.

Step 1: Set up a Zscaler ZPA source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. In the top right, click Create New.

  3. Search for "Zscaler ZPA", then click its tile.

  4. In the Transport Mechanism dropdown in the slide-out panel, select the Data Transport method you'd like to use for this integration: AWS S3 Bucket or HTTP.

    • This selection depends on how you'd like to configure your Log Receiver to forward logs (in Step 3)—either to a Panther HTTP endpoint, or to an S3 bucket in your environment, which Panther then pulls from.

      An arrow is drawn from a tile labeled "Zscaler ZPA" to a dropdown field called "Transport Mechanism" with an "AWS S3 Bucket" value populated. In the right-hand corner is a Start Setup button.

  5. Click Start Setup.

  6. Follow Panther's instructions for configuring the Data Transport method you chose:

Step 2: Create and deploy an App Connector in ZPA

If you already have App Connectors deployed as part of your existing Zscaler infrastructure, you can also use them for forwarding logs to Panther. In that case, you can skip this step.

To create and deploy an App Connector:

  1. Add an App Connector in the Zscaler console by following the instructions in the Zscaler Configuring App Connectors documentation.

  2. Deploy the App Connector on the supported platform of your choice by following the relevant guide within App Connector Deployment Guides for Supported Platforms.

You can monitor the status of your App Connector instances in your ZPA console by navigating to Configuration & Control > Private Infrastructure > App Connectors.

An "App Connectors" tab is shown. A table with various columns is visible, e.g., Name, Manager Version, Current Software Version.

Step 3: Configure one or more Log Receivers

A Log Receiver is any storage location that can receive TCP traffic with ZPA logs from your App Connectors, then forward them to your HTTP or S3 log source in Panther.

It's recommended to use Fluent Bit as your Log Receiver, but you may use a different Log Receiver depending on your needs. The instruction set below assumes you are using Fluent Bit.

Step 3.1: Deploy a Fluent Bit service

If you are using HTTP as your Data Transport:

  • Follow the Fluent Bit Onboarding guide in the Panther docs, skipping Steps 1 and 2. (You will use the ZPA HTTP source you have already created.)

    • In the [INPUT] variables:

      • Name: Set this to to tcp

      • Listen: Set to 0.0.0.0

      • Tag: Set to tcp_log

      • Port: Set to your desired port

      • Format: Set to none

      You can optionally enable TLS for your TCP input by adding the following entries to the [INPUT] variables:

      • tls: on

      • tls.verify: on

      • tls.key_file: {tls_key_path}

      • tls.cert_file: {certificate_path}

Your finished configuration file should look similar to the Dummy to a Panther HTTP source example on Fluent Bit Configuration Examples.

Step 3.2: Configure one or more Log Receivers in ZPA

You must create a separate Log Receiver for each log type you'd like to forward to Panther. (For all of these log types, you can use the same Fluent Bit instance and log source [HTTP endpoint or S3 bucket] in Panther.)

  • For each log type you'd like to ingest in Panther, add a log receiver by following the instructions in the Zscaler Configuring a Log Receiver documentation. Take note of the following input guidelines:

    • On the Log Receiver tab:

      • Domain or IP Address: Enter the domain or IP of your Fluent Bit service.

      • TCP Port: Enter the port the Fluent Bit service is running at.

      • TLS Encryption: Select Enabled if you require TLS encryption for the data sent to your Fluent Bit input, and you have enabled it in the Fluent Bit configuration file in the previous step.

    An "Add Log Receiver" pop-up modal is shown. It contains various form fields, such as "Name," "Description," and "Domain or IP Address."

Supported log types

Zscaler.ZPA.AuditLog

The Audit log records key events in the ZPA Console, such as logins, logouts, and resource actions (like create and update). The Audit log is primarily used to investigate potentially suspicious activity or diagnose and troubleshoot errors.

References:

Zscaler.ZPA.UserActivity

The User Activity log captures and records various activities performed by users when they access internal applications via the ZPA service. The User Activity log can be used to investigate unauthorized access attempts, perform compliance monitoring, and identify unusual application access patterns.

Reference: Format of User Activity logs

Zscaler.ZPA.UserStatus

The User Status log provides detailed information about the connection and status of users within the ZPA environment. It helps with monitoring users’ real-time access behavior, diagnosing connectivity issues, and tracking overall system health from a user perspective.

Reference: Format of User Status logs

Zscaler.ZPA.AppConnectorStatus

The App Connector Status log provides detailed information about the health, status, and operational behavior of App Connectors. Monitoring these logs helps administrators ensure that App Connectors are operating efficiently, troubleshoot issues, maintain service reliability, and detect potential security incidents, such as attacks or misuse of applications.

Reference: Format of App Connector Status logs

Zscaler.ZPA.AppConnectorMetrics

The App Connector Metrics log provides detailed information about the operational status and performance of an App Connector. Monitoring these logs can help administrators diagnose key security cases such as resource exhaustion (e.g., DDoS attacks), unauthorized access, data exfiltration attempts, and compromised connectors.

Reference: Format of App Connector Metrics logs

PreviousZscaler ZIANextCustom Logs

Last updated

Was this helpful?