Skip to main content

Zscaler NSS

Zscaler sits inline between users and the internet, so its logs are the closest thing most organisations have to a complete record of outbound web and DNS activity, including from devices that never touch the corporate network. The Nanolog Streaming Service (NSS) is how those logs leave the Zscaler cloud: an NSS feed streams them to a collector of your choosing, in a format you define.

Filed here, catalogued elsewhere

The catalog files this template under Endpoint Management rather than with the network services. Search for Zsaler NSS: the catalog spells the vendor name without the c, and the search box matches the catalog's spelling, not the correct one.

Zscaler-side Setup​

Create the NSS feed in the ZIA admin portal, following Zscaler's own documentation. Two things about it matter here:

  • This template receives over HEC, so the feed must be configured for a Splunk-compatible endpoint rather than for a syslog collector.
  • The feed's field set is fixed at creation. The NSS feed template determines which fields leave the Zscaler cloud, and a feed defined with the wrong field set cannot be corrected downstream; it has to be redefined at Zscaler.

Install the Application​

In the navigation rail, open Applications and click Install Application, then choose Zsaler NSS from the Endpoint Management category of the Application Catalog. The form has no Configuration section; its two parameters sit in the collapsed Advanced configuration section (click its heading to reach them). Both are required:

ParameterNotes
datalakePre-filled managed.
datalake index namePre-filled Zscaler, correctly spelled, unlike the template name.

Install Zsaler NSS form with the Application section's Instance name and Display name fields, and Advanced configuration expanded to datalake and datalake index name, above Cancel, Dry run and Install Application

Click Install Application. The Applications page opens with the notice Default is launching., and the new application is listed with a green Running badge once the pipeline is up.

Validating the Data​

Browse to a recognisable destination from a device behind Zscaler and confirm the transaction appears in the Zscaler index. Allow for the delay NSS adds between the transaction and the log leaving the cloud.

Last updated on