---
url: https://docs.realmsec.info/integration/zscaler.md
---

# Zscaler NSS VM Splunk Integration

Realm Security integrates seamlessly with Zscaler NSS VM appliances, enabling intelligent routing and analysis of security event logs.

## Zscaler NSS VM

[Zscaler NSS VM](https://help.zscaler.com/zia/understanding-nanolog-streaming-service) supports sending log data to configured destinations using the generic syslog protocol in key/value format.

Data Flow:

```text
Zscaler (VM based) NSS > Realm Data Connector (onprem) > Realm Cloud Backend
```

![Zscaler NSS VM overview](../images/zscaler-nss.jpg)

### Prerequisites

* Ensure you have administrative access to your Zscaler NSS VM.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Realm Security syslog collector IP address or FQDN.
* Realm Collector receiving port numbers. In the Realm console, go to **Collectors > select collector > More actions (`...`) for the Zscaler stream > View assigned ports** and copy the port number listed for each NSS feed type.

### Realm: Setup Source

1. Login to Realm console.
2. Go to **Sources > Add > Zscaler ZIA / Splunk (CIM)** and add a new Source.
   > **Name:** `Zscaler ZIA`
   > **Description:** `Zscaler ZIA logs`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Add a Zscaler stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Zscaler ZIA / Splunk (CIM)`
   > **Source:** `Zscaler`
   > **Framing Trailer:** `Unspecified`
5. Click **Add Stream**.
6. To view all assigned ports for Zscaler ZIA feeds, click **VIEW PORTS**. The modal shows receiving port numbers for each NSS feed type. You will need these when configuring each Zscaler NSS Syslog feed.

### Zscaler: Setup NSS VM feed (Splunk)

Follow these steps to configure an [NSS feed for firewall logs](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs) to Realm Security Data Fabric.

Use the following values:

> **Feed Name:** Name of the feed\
> **NSS Type:** Select type\
> **SIEM Destination Type:** `SIEM IP Address` — enter the IP address of the Realm Data Collector VM\
> **SIEM TCP Port:** Port number from the Realm console corresponding to the NSS feed type\
> **Feed Output Type:** `Splunk CIM`

> **Note:** For streaming Zscaler NSS VM logs to **Microsoft Sentinel**, see the separate [Zscaler NSS VM Sentinel Integration](/integration/zscaler_zia_nss_vm_sentinel) guide.

## Support

For additional details, refer to the official [Zscaler NSS documentation](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs).

If you encounter any issues or require assistance, contact Realm Security support.

## Event Metadata

The following additional metadata fields will be included with the events. \_sourceCatgeory is only set when sending data to Splunk and is not applied for data going to other SIEMs.

| Feed Type | Field Name | Value |
| --------- | ---------- | --------------- |
| All feeds | \_sourceCategory | `zscaler/zia-splunk`|

| Feed Type | Field Name | Value |
| --------- | ---------- | --------------- |
| ZIA WEB | source_type| zscalernss-web |
| ZIA TUNNEL | source_type| zscalernss-tunnel |
| ZIA FIREWALL | source_type| zscalernss-fw |
| ZIA DNS | source_type| zscalernss-dns |
| ZIA AUDIT | source_type| zscalernss-audit |

# References

* [Adding NSS Feeds for Firewall Logs](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs)
* [Understanding Nanolog Streaming Service](https://help.zscaler.com/zia/understanding-nanolog-streaming-service)
* [General Guidelines for NSS Feeds and Feed Formats](https://help.zscaler.com/zia/general-guidelines-nss-feeds-and-feed-formats)
* [NSS Feed Output Format for Firewall Logs](https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs)
* [ZPA and Splunk Deployment Guide](https://help.zscaler.com/zpa/zpa-and-splunk-deployment-guide)
* \[Zscaler and CrowdStrike Deployment Guide] (internal upload, Use Cases 6-7: Cloud-to-Cloud CrowdStrike Falcon LogScale / NG-SIEM configuration)