proxy.zscaler.zia

Introduction

The tags beginning with proxy.zscaler.zia identify events generated by Zscaler Internet Access (ZIA).

Valid tags and data tables

The full tag must have four levels. The first three are fixed as proxy.zscaler.zia. The fourth level identifies the type of events sent and the fifth the subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

How is the data sent to Devo?

Logs generated by ZIA must be sent to the Devo platform via the Devo Relay to secure communication. See the required relay rules below and see how to define them here.

Relay rule 1 - Alerts

• Source Port → 13003

• Target Tag → proxy.zscaler.zia.alert.syslog

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Open

Relay rule 2 - Web

• Source Port → 13004

• Target Tag → proxy.zscaler.zia.web.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Open

Relay rule 3 - DNS

• Source Port → 13005

• Target Tag → proxy.zscaler.zia.dns.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 4 - Firewall

• Source Port → 13006

• Target Tag → proxy.zscaler.zia.firewall.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 5 - Tunnel

• Source Port → 13007

• Target Tag → proxy.zscaler.zia.tunnel.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 6 - SaaS Collaboration

• Source Port → 13008

• Target Tag → proxy.zscaler.zia.saas_collaboration.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 7 - SaaS CRM

• Source Port → 13009

• Target Tag → proxy.zscaler.zia.saas_crm.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 8 - SaaS Email

• Source Port → 13010

• Target Tag → proxy.zscaler.zia.saas_email.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 9 - SaaS File

• Source Port → 13011

• Target Tag → proxy.zscaler.zia.saas_file.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 10 - SaaS ITSM

• Source Port → 13012

• Target Tag → proxy.zscaler.zia.saas_itsm.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.

Relay rule 11 - SaaS Repository

• Source Port → 13013

• Target Tag → proxy.zscaler.zia.saas_repository.json

• Max packet size (bytes) → 5120

• Select the Sent without syslog tag checkbox.