Zscaler NSS VM Splunk Integration

Realm Security integrates seamlessly with Zscaler NSS VM appliances, enabling intelligent routing and analysis of security event logs.

Zscaler NSS VM

Zscaler NSS VM supports sending log data to configured destinations using the generic syslog protocol in key/value format.

Data Flow:

Zscaler (VM based) NSS > Realm Data Connector (onprem) > Realm Cloud Backend

Prerequisites

• Ensure you have administrative access to your Zscaler NSS VM.
• Realm Collector is set up and running. See Realm Collector install guide for setting up a collector.
• Realm Security syslog collector IP address or FQDN.
• Realm Collector receiving port numbers. In the Realm console, go to Collectors > select collector > More actions (...) for the Zscaler stream > View assigned ports and copy the port number listed for each NSS feed type.

Realm: Setup Source

1. Login to Realm console.
2. Go to Sources > Add > Zscaler ZIA / Splunk (CIM) and add a new Source.

   Name: Zscaler ZIADescription: Zscaler ZIA logs

3. If a collector is already set up, go to Collectors and select your collector. If not, go to Collectors > Add and give it a name and description.
4. Add a Zscaler stream to the Collector. Click Add Stream.

   Product Format: Zscaler ZIA / Splunk (CIM)Source: ZscalerFraming Trailer: Unspecified

5. Click Add Stream.
6. To view all assigned ports for Zscaler ZIA feeds, click VIEW PORTS. The modal shows receiving port numbers for each NSS feed type. You will need these when configuring each Zscaler NSS Syslog feed.

Zscaler: Setup NSS VM feed (Splunk)

Follow these steps to configure an NSS feed for firewall logs to Realm Security Data Fabric.

Use the following values:

Feed Name: Name of the feed
NSS Type: Select type
SIEM Destination Type: SIEM IP Address — enter the IP address of the Realm Data Collector VM
SIEM TCP Port: Port number from the Realm console corresponding to the NSS feed type
Feed Output Type: Splunk CIM

Note: For streaming Zscaler NSS VM logs to Microsoft Sentinel, see the separate Zscaler NSS VM Sentinel Integration guide.

Support

For additional details, refer to the official Zscaler NSS documentation.

If you encounter any issues or require assistance, contact Realm Security support.

Event Metadata

The following additional metadata fields will be included with the events. _sourceCatgeory is only set when sending data to Splunk and is not applied for data going to other SIEMs.

Feed Type	Field Name	Value
All feeds	_sourceCategory	zscaler/zia-splunk

Feed Type	Field Name	Value
ZIA WEB	source_type	zscalernss-web
ZIA TUNNEL	source_type	zscalernss-tunnel
ZIA FIREWALL	source_type	zscalernss-fw
ZIA DNS	source_type	zscalernss-dns
ZIA AUDIT	source_type	zscalernss-audit

References

• Adding NSS Feeds for Firewall Logs
• Understanding Nanolog Streaming Service
• General Guidelines for NSS Feeds and Feed Formats
• NSS Feed Output Format for Firewall Logs
• ZPA and Splunk Deployment Guide
• [Zscaler and CrowdStrike Deployment Guide] (internal upload, Use Cases 6-7: Cloud-to-Cloud CrowdStrike Falcon LogScale / NG-SIEM configuration)