---
url: https://docs.realmsec.info/integration/zscaler_zia_nss_cloud_splunk.md
---

# Zscaler NSS Cloud Splunk Integration

[Zscaler NSS Cloud](https://help.zscaler.com/zia/adding-cloud-nss-feeds) supports sending log data to configured destinations using format strings to format data into the correct schema for a given SIEM/Data store. This guide covers streaming Zscaler NSS Cloud logs to Realm for delivery to **Splunk**.

> **Note:** This guide covers the Zscaler NSS **Cloud** based appliance streaming to Splunk. If you're using NSS **VM**, or sending to Microsoft Sentinel or CrowdStrike instead, see the [Zscaler NSS Cloud Sentinel](/integration/zscaler_zia_nss_cloud_sentinel) guide.

Data Flow:

```text
Zscaler (Cloud based) NSS >  Realm Cloud Backend
```

## Prerequisites

* Ensure you have administrative access to your Zscaler NSS Cloud console.
* Cloud NSS allows only one feed per log type per instance. If you're already streaming a given log type elsewhere (e.g. to another SIEM), you'll need a second Cloud NSS instance for Realm. To set this up, reach out to your Zscaler account team and request an additional Cloud NSS feed.

## Realm: Setup Zscaler NSS Cloud Splunk Source

1. Login to Realm console.
2. Go to **Sources > Add > Zscaler NSS Cloud Splunk** and add a new Source.
   > **Name:** `Zscaler NSS Cloud`..
   > **Description:** `Zscaler NSS Cloud logs`..
3. Select Cloud HTTP, and give the input feed a name and description.
4. You can provide your own token, if not, a token will be generated on creation of the feed.
5. Copy your token and HTTP URL, as this will be used to configure your Zscaler NSS Cloud feeds.

## Zscaler: Setup NSS Cloud feed

![Zscaler NSS cloud setup](../images/zscaler_cloud_nss_setup.png)

Use the following values:

> **Feed Name:** Name of the feed

> **NSS Type:** Select type

> **SIEM Destination Type:** `Splunk CIM`

> **API URL:** Enter HTTP URL from Realm console

> **HTTP Headers:** Set the key to `Authorization` and set the value to `Bearer {Realm Token}`

> **Log Type:** Choose the log type corresponding to the NSS feed you are setting up (Web, Firewall, etc.)

> **Feed Output Type:** `JSON` **Note**: If creating a Zscaler NSS Web feed, select other and use the format string below.

> **Feed Output Format:** All but Zscaler NSS web logs will require usage of a format string. When creating the Zscaler NSS Web feed, use the following format string:

```text
\{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%d{yy}-%02d{mth}-%02d{dd}
%02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol
":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":
"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{
sip}","clienttranstime":"%d{ctime}","requestmethod":"%s{reqmethod}","refererURL":"%s{
ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP
":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zs
caler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malw
arecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}
","pagerisk":"%d{riskscore}","department":"%s{edepartment}","urlsupercategory":"%s{ur
lsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclas
s}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fi
leclass}","bwthrottle":"%s{bwthrottle}","servertranstime":"%d{stime}","contenttype":"
%s{contenttype}","ssldecrypted":"%s{ssldecrypted}","unscannabletype":"%s{unscannablet
ype}","md5":"%s{bamd5}","deviceowner":"%s{deviceowner}","devicehostname":"%s{deviceho
stname}"\}\}
```

> **Note:** Ensure that OAuth 2.0 Authentication has been disabled.

## Support

For additional details, refer to the official [Zscaler NSS documentation](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs).

If you encounter any issues or require assistance, contact Realm Security support.

## References

* [Adding Cloud NSS Feeds for Web Logs](https://help.zscaler.com/zia/adding-cloud-nss-feeds-web-logs)
* [General Guidelines for NSS Feeds and Feed Formats](https://help.zscaler.com/zia/general-guidelines-nss-feeds-and-feed-formats)