---
url: https://docs.realmsec.info/integration/zscaler_zia_nss_cloud_crowdstrike.md
---

# Zscaler NSS Cloud CrowdStrike Integration

This guide covers streaming Zscaler NSS Cloud logs to Realm for eventual delivery to **CrowdStrike NG-SIEM** (built on Falcon LogScale) via a HEC-style ingest API. Zscaler streams to **Realm's** Cloud HTTP input feed — Realm normalizes the data and handles onward delivery to your CrowdStrike NG-SIEM/Falcon LogScale tenant separately, as configured on your Realm destination/export settings.

> **Note:** CrowdStrike NG-SIEM and Falcon LogScale share the same underlying HEC-based ingest mechanism, JSON output convention, and escape character requirements — the steps below apply to either product.

> **Note:** This guide covers the Zscaler NSS **Cloud** based appliance streaming to CrowdStrike. If you're using NSS **VM**, or sending to Splunk or Microsoft Sentinel instead, see the [Zscaler NSS Cloud Sentinel](/integration/zscaler_zia_nss_cloud_sentinel) guide.

Data Flow:

```text
Zscaler (Cloud based) NSS >  Realm Cloud Backend
```

## Prerequisites

* Ensure you have administrative access to your Zscaler NSS Cloud console.
* Cloud NSS allows only one feed per log type per instance. If you're already streaming a given log type elsewhere (e.g. to another SIEM), you'll need a second Cloud NSS instance for Realm. To set this up, reach out to your Zscaler account team and request an additional Cloud NSS feed.

## Realm: Setup Zscaler NSS Cloud CrowdStrike Source

1. Login to Realm console.
2. Go to **Sources > Add > Zscaler NSS Cloud CrowdStrike** and add a new Source.
   > **Name:** `Zscaler NSS Cloud`..
   > **Description:** `Zscaler NSS Cloud logs`..
3. Select Cloud HTTP, and give the input feed a name and description.
4. You can provide your own token, if not, a token will be generated on creation of the feed.
5. Copy your token and HTTP URL, as this will be used to configure your Zscaler NSS Cloud feeds.

## Zscaler: Setup NSS Cloud feed (CrowdStrike)

Follow these steps to configure a [Cloud NSS feed](https://help.zscaler.com/zia/adding-cloud-nss-feeds-web-logs) pointed at Realm, using CrowdStrike's expected schema and escaping so the data is ready for onward delivery.

Use the following values:

> **Feed Name:** Name of the feed

> **NSS Type:** Select type

> **SIEM Destination Type:** `Other`

> **API URL:** Enter HTTP URL from Realm console (**not** CrowdStrike's ingest URL — Zscaler streams to Realm, and Realm handles onward delivery to CrowdStrike separately)

> **HTTP Headers:** Set the key to `Authorization` and set the value to `Bearer {Realm Token}`

> **Log Type:** Choose the log type corresponding to the NSS feed you are setting up (Web, Firewall, etc.)

> **Feed Output Type:** `JSON` — turn off **JSON Array Notation** so data is sent in NDJSON.

> **Feed Escape Character:** `",\` (double quote, comma, backslash) — this differs from the Sentinel escape character (`\,=`) used in the [Zscaler NSS Cloud Sentinel](/integration/zscaler_zia_nss_cloud_sentinel) guide. Confirm this is set correctly per feed; it's easy to copy the wrong one if you're configuring multiple SIEM targets side by side.

> **Note:** Ensure that OAuth 2.0 Authentication has been disabled.

### Cloud NSS CrowdStrike format strings

**NSS Web** — CrowdStrike NG-SIEM uses the same nested-object Web format as the Splunk variant (not the flat `cloud-nss-web.fof` used for Sentinel):

```text
\{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%d{yy}-%02d{mth}-%02d{dd}
%02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol
":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":
"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{
sip}","clienttranstime":"%d{ctime}","requestmethod":"%s{reqmethod}","refererURL":"%s{
ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP
":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zs
caler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malw
arecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}
","pagerisk":"%d{riskscore}","department":"%s{edepartment}","urlsupercategory":"%s{ur
lsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclas
s}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fi
leclass}","bwthrottle":"%s{bwthrottle}","servertranstime":"%d{stime}","contenttype":"
%s{contenttype}","ssldecrypted":"%s{ssldecrypted}","unscannabletype":"%s{unscannablet
ype}","md5":"%s{bamd5}","deviceowner":"%s{deviceowner}","devicehostname":"%s{deviceho
stname}"\}\}
```

**NSS Firewall, DNS, Tunnel, Audit** — use the same flat `.fof` format strings provided in the [Zscaler NSS Cloud Sentinel format strings](/integration/zscaler_zia_nss_cloud_sentinel#cloud-nss-sentinel-format-strings-json-fof) section of the Zscaler NSS guide (Firewall, DNS, Audit, Tunnel). These log types don't require the nested-object escaping the Web format needs — per Zscaler's own CrowdStrike deployment documentation, the escape-character step is only called out for the Web feed, not Firewall/DNS/Tunnel/Audit.

> **Note:** Ensure that OAuth 2.0 Authentication has been disabled.

## Support

For additional details, refer to the official [Zscaler NSS documentation](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs).

If you encounter any issues or require assistance, contact Realm Security support.

## References

* [Adding Cloud NSS Feeds for Web Logs](https://help.zscaler.com/zia/adding-cloud-nss-feeds-web-logs)
* [General Guidelines for NSS Feeds and Feed Formats](https://help.zscaler.com/zia/general-guidelines-nss-feeds-and-feed-formats)
* \[Zscaler and CrowdStrike Deployment Guide] (internal upload, Use Cases 6-7: Cloud-to-Cloud CrowdStrike Falcon LogScale / NG-SIEM configuration)