Zscaler ZPA
Connecting ZPA logs to your Panther Console
Last updated
Connecting ZPA logs to your Panther Console
Last updated
Panther supports ingesting Private Access (ZPA) logs by using either an HTTP or AWS S3 Data Transport source. The following ZPA log types are supported:
In order to onboard Zscaler ZPA logs in Panther, you must have a subscription to Zscaler ZPA.
To ingest ZPA logs in Panther, you will create a log source in Panther, then configure App Connectors and Log Receivers.
You must have permission to access the Zscaler ZPA console.
In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.
In the top right, click Create New.
Search for "Zscaler ZPA", then click its tile.
In the Transport Mechanism dropdown in the slide-out panel, select the method you'd like to use for this integration: AWS S3 Bucket or HTTP.
This selection depends on how you'd like to configure your Log Receiver to forward logs (in )—either to a Panther HTTP endpoint, or to an S3 bucket in your environment, which Panther then pulls from.
Click Start Setup.
Follow Panther's instructions for configuring the Data Transport method you chose:
HTTP: Follow Panther's , beginning at Step 5.
During setup, on the security configuration page, is recommended for its simplicity.
Payloads sent to this source are subject to the .
Do not proceed to the next step until the creation of your HTTP endpoint has completed.
S3: Follow .
Follow the , beginning at Step 1.5.
If you already have App Connectors deployed as part of your existing Zscaler infrastructure, you can also use them for forwarding logs to Panther. In that case, you can skip this step.
You can monitor the status of your App Connector instances in your ZPA console by navigating to Configuration & Control > Private Infrastructure > App Connectors.
A Log Receiver is any storage location that can receive TCP traffic with ZPA logs from your App Connectors, then forward them to your HTTP or S3 log source in Panther.
It's recommended to use Fluent Bit as your Log Receiver, but you may use a different Log Receiver depending on your needs. The instruction set below assumes you are using Fluent Bit.
If you are using HTTP as your Data Transport:
In the [INPUT] variables:
Name: Set this to to tcp
Listen: Set to 0.0.0.0
Tag: Set to tcp_log
Port: Set to your desired port
Format: Set to none
You can optionally enable TLS for your TCP input by adding the following entries to the [INPUT] variables:
tls: on
tls.verify: on
tls.key_file: {tls_key_path}
tls.cert_file: {certificate_path}
You must create a separate Log Receiver for each log type you'd like to forward to Panther. (For all of these log types, you can use the same Fluent Bit instance and log source [HTTP endpoint or S3 bucket] in Panther.)
On the Log Receiver tab:
Domain or IP Address: Enter the domain or IP of your Fluent Bit service.
TCP Port: Enter the port the Fluent Bit service is running at.
TLS Encryption: Select Enabled if you require TLS encryption for the data sent to your Fluent Bit input, and you have enabled it in the Fluent Bit configuration file in the previous step.
On the Log Stream tab:
Log Template: Select JSON.
The Audit log records key events in the ZPA Console, such as logins, logouts, and resource actions (like create and update). The Audit log is primarily used to investigate potentially suspicious activity or diagnose and troubleshoot errors.
References:
The User Activity log captures and records various activities performed by users when they access internal applications via the ZPA service. The User Activity log can be used to investigate unauthorized access attempts, perform compliance monitoring, and identify unusual application access patterns.
The User Status log provides detailed information about the connection and status of users within the ZPA environment. It helps with monitoring users’ real-time access behavior, diagnosing connectivity issues, and tracking overall system health from a user perspective.
The App Connector Status log provides detailed information about the health, status, and operational behavior of App Connectors. Monitoring these logs helps administrators ensure that App Connectors are operating efficiently, troubleshoot issues, maintain service reliability, and detect potential security incidents, such as attacks or misuse of applications.
The App Connector Metrics log provides detailed information about the operational status and performance of an App Connector. Monitoring these logs can help administrators diagnose key security cases such as resource exhaustion (e.g., DDoS attacks), unauthorized access, data exfiltration attempts, and compromised connectors.
To create and deploy an :
Add an App Connector in the Zscaler console by following the instructions in the Zscaler documentation.
Deploy the App Connector on the of your choice by following the relevant guide within .
Learn more about deployment on .
Follow the in the Panther docs, skipping Steps 1 and 2. (You will use the ZPA HTTP source you have already created.)
Your finished configuration file should look similar to the .
Follow the in the Panther docs.
Use the as a reference.
For each log type you'd like to ingest in Panther, add a log receiver by following the instructions in the Zscaler documentation. Take note of the following input guidelines:
Log Type: Select one of the .
Reference:
Reference:
Reference:
Reference:
