To ingest logs from the Zscaler Cloud into Splunk, an NSS server needs to be deployed. The NSS feed will send CIM formatted logs to Splunk. The Zscaler Technical Adapter for Splunk normalizes the logs into a common format that can be leveraged by different applications.
The Zscaler Splunk App provides pre built reports and dashboards including:
* Threat Intelligence
* Web Usage
* Remote Access Activity
* DLP events and incidents
For additional documentation, reach out to splunk-support@zscaler.com
Bug fixes
PREVIEW: UNDER TEST
Fixes:
- Fixed dashboard panel queries that were not populating data
- Firewall Access Controls
- Private Access Connector Status
- Scanned and vetted the add-on to ensure Python3 and jQuery3.5 compatibility
New panels and dashboards:
- SSL decryption rates: Two new panels showing SSL inspection %'s under Web Traffic Overview dashboard
- Browser Isolation - URLs triggering a browser isolation policy - added to Top 10 dashboard
- Posture Control - New dashboard covering Cloud and IaC alerts for Zscaler Posture Control (CNAPP)
Cleanup:
- Three ZPA panels moved from Lateral Movement to Private Access Performance Overview dashboard
- Moved two sandbox panels from Zscaler Overview to Threat Prevention -> Sandbox dashboard
- Removed Event Flows (Top 100) panel, added Event Types panel and rearranged other panels in Connections dashboard
- All external page references under Zscaler Tools menu now opens in a new tab
Update 4/11/22: The sandbox and audit logs is currently unsupported within the Splunk App. Although the functionality to get these logs still exist within Zscaler, the Splunk App does not currently support fetching these logs.
Notes:
This release upgrades all dashboard to XML 1.1, which will invoke updated JQuery and reestablish compatibility with Splunk Cloud.
Note: new Dashboards for Lateral Movement and Data Protection have been added, some widgets will be searching on new undocumented sourcetypes, full support these sourcetypes (e.g. CIM Mapping, setup instruction) is still be worked on and will be coming in the next TA update, coupled with the needed updates to the Zscaler/Splunk admin/install guide.
Added fix for Tunnel Widget not displaying rules in landing dashboard
Added fixes to make macro edit more friendly
Minor edits to some widgets to work better with RBAC
Now filtering locations from user oriented reports/widgets.
Added exciting new Security and Threat dashboards
- Security overview with Clickable events (pivot based on threats over user)
- Overall Trading info
- Web Traffic overview
Version 2.0.0
Added Reports and Dashboard for new Modular Inputs:
- Admin Audit Logs (ZIA)
- Cloud Sandbox detailed reports
Moved all macros into TA, removed from App
Overview Dashboard modified to better reflect summary of all data inputs
New Private Access Health Dashboard
V1.0 - Initial Release
V1.0.1 - Changed App name to "Zscaler Splunk App"
V1.0.2 - Removed dependabcy for "IMAP Mailbox" as it's not Splunk Certified
V1.0.3 - updated README.txt to include correct links in deps section
V1.0.1 - Changed App name to "Zscaler Splunk App"
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.