Realm.Security Documentation

Appearance

Zscaler NSS Cloud CrowdStrike Integration ​

This guide covers streaming Zscaler NSS Cloud logs to Realm for eventual delivery to CrowdStrike NG-SIEM (built on Falcon LogScale) via a HEC-style ingest API. Zscaler streams to Realm's Cloud HTTP input feed — Realm normalizes the data and handles onward delivery to your CrowdStrike NG-SIEM/Falcon LogScale tenant separately, as configured on your Realm destination/export settings.

Note: CrowdStrike NG-SIEM and Falcon LogScale share the same underlying HEC-based ingest mechanism, JSON output convention, and escape character requirements — the steps below apply to either product.

Note: This guide covers the Zscaler NSS Cloud based appliance streaming to CrowdStrike. If you're using NSS VM, or sending to Splunk or Microsoft Sentinel instead, see the Zscaler NSS guide.

Data Flow:

text
Zscaler (Cloud based) NSS >  Realm Cloud Backend

Prerequisites ​

  • Ensure you have administrative access to your Zscaler NSS Cloud console.
  • Cloud NSS allows only one feed per log type per instance. If you're already streaming a given log type elsewhere (e.g. to another SIEM), you'll need a second Cloud NSS instance for Realm. To set this up, reach out to your Zscaler account team and request an additional Cloud NSS feed.

Realm: Setup Zscaler NSS Cloud CrowdStrike Source ​

  1. Login to Realm console.
  2. Go to Sources > Add > Zscaler NSS Cloud CrowdStrike and add a new Source.

    Name: Zscaler NSS Cloud.. Description: Zscaler NSS Cloud logs..

  3. Select Cloud HTTP, and give the input feed a name and description.
  4. You can provide your own token, if not, a token will be generated on creation of the feed.
  5. Copy your token and HTTP URL, as this will be used to configure your Zscaler NSS Cloud feeds.

Zscaler: Setup NSS Cloud feed (CrowdStrike) ​

Follow these steps to configure a Cloud NSS feed pointed at Realm, using CrowdStrike's expected schema and escaping so the data is ready for onward delivery.

Use the following values:

Feed Name: Name of the feed

NSS Type: Select type

SIEM Destination Type: Other

API URL: Enter HTTP URL from Realm console (not CrowdStrike's ingest URL — Zscaler streams to Realm, and Realm handles onward delivery to CrowdStrike separately)

HTTP Headers: Set the key to Authorization and set the value to Bearer {Realm Token}

Log Type: Choose the log type corresponding to the NSS feed you are setting up (Web, Firewall, etc.)

Feed Output Type: JSON — turn off JSON Array Notation so data is sent in NDJSON.

Feed Escape Character: ",\ (double quote, comma, backslash) — this differs from the Sentinel escape character (\,=) used in the Zscaler NSS guide. Confirm this is set correctly per feed; it's easy to copy the wrong one if you're configuring multiple SIEM targets side by side.

Note: Ensure that OAuth 2.0 Authentication has been disabled.

Cloud NSS CrowdStrike format strings ​

NSS Web — CrowdStrike NG-SIEM uses the same nested-object Web format as the Splunk variant (not the flat cloud-nss-web.fof used for Sentinel):

text
\{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%d{yy}-%02d{mth}-%02d{dd}
%02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol
":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":
"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{
sip}","clienttranstime":"%d{ctime}","requestmethod":"%s{reqmethod}","refererURL":"%s{
ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP
":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zs
caler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malw
arecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}
","pagerisk":"%d{riskscore}","department":"%s{edepartment}","urlsupercategory":"%s{ur
lsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclas
s}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fi
leclass}","bwthrottle":"%s{bwthrottle}","servertranstime":"%d{stime}","contenttype":"
%s{contenttype}","ssldecrypted":"%s{ssldecrypted}","unscannabletype":"%s{unscannablet
ype}","md5":"%s{bamd5}","deviceowner":"%s{deviceowner}","devicehostname":"%s{deviceho
stname}"\}\}

NSS Firewall, DNS, Tunnel, Audit — use the same flat .fof format strings provided in the Zscaler NSS Cloud Sentinel format strings section of the Zscaler NSS guide (Firewall, DNS, Audit, Tunnel). These log types don't require the nested-object escaping the Web format needs — per Zscaler's own CrowdStrike deployment documentation, the escape-character step is only called out for the Web feed, not Firewall/DNS/Tunnel/Audit.

Note: Ensure that OAuth 2.0 Authentication has been disabled.

Support ​

For additional details, refer to the official Zscaler NSS documentation.

If you encounter any issues or require assistance, contact Realm Security support.

References ​