---
url: https://docs.realmsec.info/integration/zscaler_zia_nss_cloud_sentinel.md
---

# Zscaler NSS Cloud Sentinel Integration

Realm Security integrates seamlessly with Zscaler NSS Cloud appliances, enabling intelligent routing and analysis of security event logs.

## Zscaler NSS Cloud

[Zscaler NSS Cloud](https://help.zscaler.com/zia/adding-cloud-nss-feeds) supports sending log data to configured destinations using format strings to format data into the correct schema for a given SIEM/Data store.

Data Flow:

```text
Zscaler (Cloud based) NSS >  Realm Cloud Backend
```

![Zscaler NSS Cloud overview](../images/zscaler-nss-cloud-overview.png)

### Prerequisites

* Ensure you have administrative access to your Zscaler NSS Cloud console.
* Cloud NSS allows only one feed per log type per instance. If you're already streaming a given log type elsewhere (e.g. to another SIEM), you'll need a second Cloud NSS instance for Realm. To set this up, reach out to your Zscaler account team and request an additional Cloud NSS feed.

### Realm: Setup Zscaler NSS Cloud Sentinel Source

1. Login to Realm console.
2. Go to **Sources > Add > Zscaler NSS Cloud Sentinel** and add a new Source.
   > **Name:** `Zscaler NSS Cloud`\
   > **Description:** `Zscaler NSS Cloud logs`
3. Select Cloud HTTP, and give the input feed a name and description.
4. You can provide your own token, if not, a token will be generated on creation of the feed.
5. Copy your token and HTTP URL, as this will be used to configure your Zscaler NSS Cloud feeds.

### Zscaler: Setup NSS Cloud feed

Follow these steps to configure an [NSS feed for web logs](https://help.zscaler.com/zia/adding-cloud-nss-feeds-web-logs) to Realm Security Data Fabric.

![Zscaler NSS cloud setup](../images/zscaler_cloud_nss_setup.png)

Use the following values:

> **Feed Name:** Name of the feed

> **NSS Type:** Select type

> **SIEM Destination Type:** `Other`

> **API URL:** Enter HTTP URL from Realm console

> **HTTP Headers:** Set the key to `Authorization` and set the value to `Bearer {Realm Token}`

> **Log Type:** Choose the log type corresponding to the NSS feed you are setting up (Web, Firewall, etc.)

> **Feed Output Type:** `JSON` — By default it sends JSON data in JSON array notation. You must disable this option so data is sent in NDJSON.

> **Feed Output Format:** Paste the format string for the corresponding Zscaler NSS feed. Confirmed format strings for each supported log type are provided below, sourced directly from Zscaler's [MS Sentinel Format Strings repo](https://github.com/zscaler/microsoft-resources/tree/main/microsoft-sentinel/zia-log-feeds).

* Note: Ensure that OAuth 2.0 Authentication has been disabled.

#### Cloud NSS Sentinel format strings (JSON / `.fof`)

Select the tab below matching the NSS Type you're configuring, and paste the format string exactly as shown into the **Feed Output Format** field.

**NSS Web** [Format String](https://github.com/zscaler/microsoft-resources/blob/main/microsoft-sentinel/zia-log-feeds/web/cloud-nss-web.fof)

```json
{"TimeGenerated":"%d{yy}-%02d{mth}-%02d{dd},%02d{hh}:%02d{mm}:%02d{ss}","sourcetype":"zscalernss","vendor":"Zscaler","product":"NSSWeblog","version":"5.7","act":"%s{action}","Severity":"3","name":"%s{reason}","deviceEventClassId":"%s{action}","app":"%s{proto}","cat":"%s{urlcat}","dhost":"%s{ehost}","dst":"%s{sip}","src":"%s{cip}","in_bytes":"%d{respsize}","in":"%d{respsize}","outcome":"%s{respcode}","out":"%d{reqsize}","request":"%s{eurl}","rt":"%s{mon}","sourceTranslatedAddress":"%s{cintip}","requestClientApplication":"%s{ua}","requestMethod":"%s{reqmethod}","suser":"%s{login}","spriv":"%s{location}","externalId":"%d{recordid}","fileType":"%s{filetype}","reason":"%s{reason}","destinationServiceName":"%s{appname}","cn1":"%d{riskscore}","cn1Label":"riskscore","cs1":"%s{dept}","cs1Label":"dept","cs2":"%s{urlsupercat}","cs2Label":"urlsupercat","cs3":"%s{appclass}","cs3Label":"appclass","cs4":"%s{malwarecat}","cs4Label":"malwarecat","cs5":"%s{threatname}","cs5Label":"threatname","cs6":"%s{dlpeng}","cs6Label":"dlpeng","ZscalerNSSWeblogURLClass":"%s{urlclass}","ZscalerNSSWeblogDLPDictionaries":"%s{dlpdict}","requestContext":"%s{ereferer}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","keyprotectiontype":"%s{keyprotectiontype}","cloudname":"%s{cloudname}","company":"%s{company}","throttlereqsize":"%d{throttlereqsize}","throttlerespsize":"%d{throttlerespsize}","bwthrottle":"%s{bwthrottle}","bwclassname":"%s{bwclassname}","bwrulename":"%s{bwrulename}","module":"%s{module}","app_risk_score":"%s{app_risk_score}","datacenter":"%s{datacenter}","datacentercity":"%s{datacentercity}","datacentercountry":"%s{datacentercountry}","dlpdicthitcount":"%s{dlpdicthitcount}","dlpidentifier":"%d{dlpidentifier}","dlpmd5":"%s{dlpmd5}","dlprulename":"%s{dlprulename}","fileclass":"%s{fileclass}","fname":"%s{filename}","filesubtype":"%s{filesubtype}","upload_fileclass":"%s{upload_fileclass}","upload_filetype":"%s{upload_filetype}","upload_filename":"%s{upload_filename}","upload_filesubtype":"%s{upload_filesubtype}","upload_doctypename":"%s{upload_doctypename}","rdr_rulename":"%s{rdr_rulename}","fwd_type":"%s{fwd_type}","fwd_gw_name":"%s{fwd_gw_name}","fwd_gw_ip":"%s{fwd_gw_ip}","zpa_app_seg_name":"%s{zpa_app_seg_name}","reqdatasize":"%d{reqdatasize}","reqhdrsize":"%d{reqhdrsize}","respdatasize":"%d{respdatasize}","resphdrsize":"%d{resphdrsize}","totalsize":"%d{totalsize}","df_hosthead":"%s{df_hosthead}","df_hostname":"%s{df_hostname}","erefererhost":"%s{erefererhost}","refererpath":"%s{erefererpath}","eurlpath":"%s{eurlpath}","reqversion":"%s{reqversion}","respversion":"%s{respversion}","ua_token":"%s{ua_token}","uaclass":"%s{uaclass}","mobappname":"%s{mobappname}","mobappcat":"%s{mobappcat}","mobdevtype":"%s{mobdevtype}","clt_sport":"%d{clt_sport}","cpubip":"%s{cpubip}","alpnprotocol":"%s{alpnprotocol}","trafficredirectmethod":"%s{trafficredirectmethod}","euserlocationname":"%s{euserlocationname}","erulelabel":"%s{erulelabel}","ruletype":"%s{ruletype}","eurlfilterrulelabel":"%s{eurlfilterrulelabel}","ourlfilterrulelabel":"%s{ourlfilterrulelabel}","eapprulelabel":"%s{eapprulelabel}","fileHash":"%s{bamd5}","sha256":"%s{sha256}","ssldecrypted":"%s{ssldecrypted}","externalspr":"%s{externalspr}","clientsslcipher":"%s{clientsslcipher}","clienttlsversion":"%s{clienttlsversion}","clientsslsessreuse":"%s{clientsslsessreuse}","cltsslfailreason":"%s{cltsslfailreason}","cltsslfailcount":"%d{cltsslfailcount}","srvsslcipher":"%s{srvsslcipher}","srvtlsversion":"%s{srvtlsversion}","srvocspresult":"%s{srvocspresult}","srvcertchainvalpass":"%s{srvcertchainvalpass}","srvwildcardcert":"%s{srvwildcardcert}","serversslsessreuse":"%s{serversslsessreuse}","srvcertvalidationtype":"%s{srvcertvalidationtype}","srvcertvalidityperiod":"%s{srvcertvalidityperiod}","is_ssluntrustedca":"%s{is_ssluntrustedca}","is_sslselfsigned":"%s{is_sslselfsigned}","is_sslexpiredca":"%s{is_sslexpiredca}","threatseverity":"%s{threatseverity}","malwareclass":"%s{malwareclass}","urlcatmethod":"%s{urlcatmethod}","bypassed_traffic":"%d{bypassed_traffic}","bypassed_etime":"%s{bypassed_etime}","deviceappversion":"%s{deviceappversion}","devicemodel":"%s{devicemodel}","devicename":"%s{devicename}","deviceostype":"%s{deviceostype}","devicetype":"%s{devicetype}","external_devid":"%s{external_devid}","flow_type":"%s{flow_type}","ztunnelversion":"%s{ztunnelversion}","productversion":"%s{productversion}","nsssvcip":"%s{nsssvcip}"}
```

**NSS DNS** [Format String](https://github.com/zscaler/microsoft-resources/blob/main/microsoft-sentinel/zia-log-feeds/dns/cloud-nss-dns.fof)

```json
{"TimeGenerated":"%d{yy}-%02d{mth}-%02d{dd},%02d{hh}:%02d{mm}:%02d{ss}","sourcetype":"zscalernss-dns","vendor":"Zscaler","product":"NSSDNSlog","version":"5.7","act":"%s{action}","Severity":"3","name":"%s{rulelabel}","deviceEventClassId":"%s{action}","suser":"%s{login}","cs1":"%s{dept}","cs1Label":"department","cs2":"%s{reqaction}","cs2Label":"reqaction","cs3":"%s{resaction}","cs3Label":"resaction","cs4":"%s{reqtype}","cs4Label":"dns_reqtype","cs5":"%s{req}","cs5Label":"dns_req","cs6":"%s{res}","cs6Label":"dns_resp","cn1":"%d{durationms}","cn1Label":"durationms","flexString1":"%s{reqrulelabel}","flexString1Label":"reqrulelabel","flexString2":"%s{resrulelabel}","flexString2Label":"resrulelabel","cat":"%s{domcat}","src":"%s{cip}","dst":"%s{sip}","dpt":"%d{sport}","spriv":"%s{location}","suid":"%s{deviceowner}","dvchost":"%s{devicehostname}"}
```

**NSS Firewall** [Format String](https://github.com/zscaler/microsoft-resources/blob/main/microsoft-sentinel/zia-log-feeds/fw/cloud-nss-fw.fof)

```json
{"TimeGenerated":"%d{yy}-%02d{mth}-%02d{dd},%02d{hh}:%02d{mm}:%02d{ss}","sourcetype":"zscaler-nss-fw","vendor":"Zscaler","product":"NSSFWlog","version":"5.7","Severity":"3","name":"%s{rulelabel}","deviceEventClassId":"%s{action}","act":"%s{action}","suser":"%s{login}","src":"%s{csip}","spt":"%d{csport}","dst":"%s{cdip}","dpt":"%d{cdport}","deviceTranslatedAddress":"%s{ssip}","deviceTranslatedPort":"%d{ssport}","destinationTranslatedAddress":"%s{sdip}","destinationTranslatedPort":"%d{sdport}","sourceTranslatedAddress":"%s{tsip}","sourceTranslatedPort":"%d{tsport}","proto":"%s{ipproto}","tunnelType":"%s{ttype}","dnat":"%s{dnat}","stateful":"%s{stateful}","spriv":"%s{location}","reason":"%s{rulelabel}","in_bytes":"%ld{inbytes}","in":"%ld{inbytes}","out_bytes":"%ld{outbytes}","deviceDirection":"1","cs1":"%s{dept}","cs1Label":"dept","cs2":"%s{nwsvc}","cs2Label":"nwService","cs3":"%s{nwapp}","cs3Label":"nwApp","cs4":"%s{aggregate}","cs4Label":"aggregated","cs5":"%s{threatcat}","cs5Label":"threatcat","cs6":"%s{threatname}","cs6label":"threatname","cn1":"%d{durationms}","cn1Label":"durationms","cn2":"%d{numsessions}","cn2Label":"numsessions","flexString1Label":"ipCat","flexString1":"%s{ipcat}","destCountry":"%s{destcountry}","avgduration":"%d{avgduration}","epochtime":"%d{epochtime}","cdfqdn":"%s{cdfqdn}","srcip_country":"%s{srcip_country}","cn3Label":"threat_score","cn3":"%d{threat_score}","flexString2Label":"threat_severity","flexString2":"%s{threat_severity}","ipsrulelabel":"%s{ipsrulelabel}","ips_custom_signature":"%d{ips_custom_signature}","duration":"%d{duration}","dnatrulelabel":"%s{dnatrulelabel}","recordid":"%d{recordid}","pcapid":"%s{pcapid}","eedone":"%s{eedone}","shost":"%s{devicehostname}","devicemodel":"%s{devicemodel}","devicename":"%s{devicename}","deviceostype":"%s{deviceostype}","deviceosversion":"%s{deviceosversion}","deviceowner":"%s{deviceowner}","deviceappversion":"%s{deviceappversion}","deviceExternalId":"%s{external_deviceid}","ztunnelversion":"%s{ztunnelversion}","bypassed_session":"%d{bypassed_session}","bypass_etime":"%s{bypass_etime}","flow_type":"%s{flow_type}","datacenter":"%s{datacenter}","datacentercity":"%s{datacentercity}","datacentercountry":"%s{datacentercountry}","rdr_rulename":"%s{rdr_rulename}fwd_gw_name=%s{fwd_gw_name}","zpa_app_seg_name":"%s{zpa_app_seg_name}"}
```

**NSS Audit** [Format String](https://github.com/zscaler/microsoft-resources/blob/main/microsoft-sentinel/zia-log-feeds/audit/cloud-nss-audit.fof)

```json
{"TimeGenerated":"%d{yy}-%02d{mth}-%02d{dd},%02d{hh}:%02d{mm}:%02d{ss}","sourcetype":"zscalernss-audit","vendor":"Zscaler","product":"NSSAuditlog","version":"5.7","Severity":"3","name":"%s{category}","deviceEventClassId":"%s{action}","act":"%s{action}","cs1Label":"category","cs1":"%s{category}","cs2Label":"subcategory","cs2":"%s{subcategory}","cs3Label":"resource","cs3":"%s{resource}","cat":"%s{interface}","suser":"%s{adminid}","src":"%s{clientip}","outcome":"%s{result}","reason":"%s{errorcode}","sourceServiceName":"%s{auditlogtype}","cs4Label":"preaction","cs4":"%s{epreaction}","cs5Label":"postaction","cs5":"%s{epostaction}","deviceExternalId":"%d{recordid}"}
```

**NSS Tunnel** [Format String](https://github.com/zscaler/microsoft-resources/blob/main/microsoft-sentinel/zia-log-feeds/tunnel/cloud-nss-tunnel.fof)

```json
{"TimeGenerated":"%d{yy}-%02d{mth}-%02d{dd} %02d{hh}:%02d{mm}:%02d{ss}","sourcetype":"zscalernss-tunnel","vendor":"Zscaler","product":"NSSTunnellog","version":"5.7","severity":"3","spt":"%d{srcport}","dst":"%s{destvip}","reason":"%s{eventreason}","cs4Label":"locationname","cs4":"%s{locationname}","src":"%s{sourceip}","deviceEventClassId":"%s{tunnelactionname}","cs5Label":"tunneltype","cs5":"%s{tunneltype}","suser":"%s{vpncredentialname}","deviceExternalId":"%d{recordid}","olocationname":"%s{olocationname}","ovpncredentialname":"%s{ovpncredentialname}","dtz":"%s{tz}","name":"%s{event}"}
```

> **Note:** For streaming Zscaler NSS Cloud logs to **Splunk**, see the separate [Zscaler NSS Cloud Splunk Integration](/integration/zscaler_zia_nss_cloud_splunk) guide.

> **Note:** For streaming Zscaler NSS Cloud logs to **CrowdStrike NG-SIEM / Falcon LogScale**, see the separate [Zscaler NSS Cloud CrowdStrike Integration](/integration/zscaler_zia_nss_cloud_crowdstrike) guide.

## Support

For additional details, refer to the official [Zscaler NSS documentation](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs).

If you encounter any issues or require assistance, contact Realm Security support.

## Event Metadata

The following additional metadata fields will be included with the events. \_sourceCatgeory is only set when sending data to Splunk and is not applied for data going to other SIEMs.

| Feed Type | Field Name | Value |
| --------- | ---------- | --------------- |
| All feeds | \_sourceCategory | `zscaler/zia-splunk`|

| Feed Type | Field Name | Value |
| --------- | ---------- | --------------- |
| ZIA WEB | source_type| zscalernss-web |
| ZIA TUNNEL | source_type| zscalernss-tunnel |
| ZIA FIREWALL | source_type| zscalernss-fw |
| ZIA DNS | source_type| zscalernss-dns |
| ZIA AUDIT | source_type| zscalernss-audit |

# References

* [Adding NSS Feeds for Firewall Logs](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs)
* [Understanding Nanolog Streaming Service](https://help.zscaler.com/zia/understanding-nanolog-streaming-service)
* [General Guidelines for NSS Feeds and Feed Formats](https://help.zscaler.com/zia/general-guidelines-nss-feeds-and-feed-formats)
* [NSS Feed Output Format for Firewall Logs](https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs)
* [ZPA and Splunk Deployment Guide](https://help.zscaler.com/zpa/zpa-and-splunk-deployment-guide)
* \[Zscaler and CrowdStrike Deployment Guide] (internal upload, Use Cases 6-7: Cloud-to-Cloud CrowdStrike Falcon LogScale / NG-SIEM configuration)