{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"minLevel":{"value":"2"},"_parentId":{"value":"120920977"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"cd625d07-f50c-4fa0-b569-6fb03875bb4d"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"4c620254-c196-4ac6-bee9-adfa3cd9df82"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Service description","type":"text"}]},{"type":"paragraph","content":[{"text":"Zscaler ","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.zscaler.com/"}}]},{"text":"is a cloud service that offers a centralized door for all the business applications and networks, making easy to control and secure all the data, connecting all the user and employees regardless the location or platform used.","type":"text"}]},{"type":"paragraph","content":[{"text":"Zscaler records the login name and IP address of every admin who logs in to the ZIA Admin Portal and changes policies or configuration settings. Audit logs display an admin's login and logout record (timestamps, actions, IP, etc.) and any configuration changes they completed. If an admin account makes five unsuccessful attempts to log in within one minute, the account will be locked out for five minutes and the failed attempts will be recorded. The audit logs are stored for up to 6 months.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data source description","type":"text"}]},{"type":"paragraph","content":[{"text":"The Zscaler audit logs allow retrieving activities for these resources:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"625e5195-a4c2-4458-b13e-6a042d9c144b"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Resource","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Devo tables","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Audit logs","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Timestamp ","type":"text","marks":[{"type":"strong"}]},{"text":"- The local time of the admin's last login or last logout.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User ","type":"text","marks":[{"type":"strong"}]},{"text":"- Account associated to the Zscaler service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Action ","type":"text","marks":[{"type":"strong"}]},{"text":"- The action performed by the admin in the ZIA Admin Portal or API.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List of all potential actions.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AA in Cloud","type":"text","marks":[{"type":"strong"}]},{"text":" - Zscaler domain where the data is collected, as an example zscaler","type":"text"},{"text":"","type":"text","marks":[{"type":"em"}]},{"text":".net","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Result ","type":"text","marks":[{"type":"strong"}]},{"text":"- The outcome of an action.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Successful","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Failure","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client IP","type":"text","marks":[{"type":"strong"}]},{"text":" - The source IP address for the admin.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Interface ","type":"text","marks":[{"type":"strong"}]},{"text":"- The means by which the user performed their actions.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The interface will either be the Admin UI or an API.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Category ","type":"text","marks":[{"type":"strong"}]},{"text":"- A location in the ZIA Admin Portal where the action was performed.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List of all potential categories.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Sub-Category","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"List of all potential sub-categories.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Resource ","type":"text","marks":[{"type":"strong"}]},{"text":"- The specific location within a sub-category.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pre Action","type":"text","marks":[{"type":"strong"}]},{"text":" - Action programmed to happen before the event.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Post Action","type":"text","marks":[{"type":"strong"}]},{"text":" - Action programmed to happen after the event.","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"my.app.zscaler.audit_logs","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Setup","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the Zscaler site ","type":"text"},{"text":"https://admin.","type":"text","marks":[{"type":"strong"}]},{"text":"","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".net","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter your Login ID and Password and click the ","type":"text"},{"text":"Sign In","type":"text","marks":[{"type":"strong"}]},{"text":" button.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":1600,"id":"138b8866-a80a-4ff5-93c2-89b761e56d24","collection":"contentId-120920977","type":"file","height":440}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on the ","type":"text"},{"text":"Administration ","type":"text","marks":[{"type":"strong"}]},{"text":"menu on the left. Then, select ","type":"text"},{"text":"API Key Management","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":1886,"id":"b277559f-a84d-4b09-a0af-3e7aadac689c","collection":"contentId-120920977","type":"file","height":846}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":". We will use this key to get the Audit logs.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":52.0},"content":[{"type":"media","attrs":{"width":1840,"id":"87272dbb-66ce-4051-a225-f7d1e56c752b","collection":"contentId-120920977","type":"file","height":656}}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (","type":"text"},{"text":"Cloud collector","type":"text","marks":[{"type":"underline"}]},{"text":"), or deploy and host the collector in your own machine using a Docker image (","type":"text"},{"text":"On-premise collector","type":"text","marks":[{"type":"underline"}]},{"text":").","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{"_parentId":{"value":"120920977"}},"macroMetadata":{"macroId":{"value":"75dff841-010a-4631-8730-ff7fbb763041"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/tabs.png"}}],"title":"UI Tabs"}},"localId":"bf40ae2c-7bc9-43d0-a511-658ab5f75117"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"_parentId":{"value":"120920977"},"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"8aaf66489849a3fb6a0be4c1e276dd6c"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"UI Tab"}},"localId":"ef149c21-ec4f-48e6-a310-3f320bc5379e"}},{"type":"paragraph","content":[{"text":"We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, ","type":"text"},{"text":"get in touch with us","type":"text","marks":[{"type":"link","attrs":{"href":"mailto:support@devo.com"}}]},{"text":" and we will guide you through the configuration.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"_parentId":{"value":"120920977"},"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"0deda3005f911cbb288cadc0896f2e83"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"UI Tab"}},"localId":"a11b5f58-b1ca-4ea5-a0d1-ad00d4651646"}},{"type":"paragraph","content":[{"text":"This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for being used when running the Zscaler collector:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── devo-collector-zscaler/\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n └── config/\n └── config-zscaler.yaml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, go to ","type":"text"},{"text":"Administration → Credentials → X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":", download the ","type":"text"},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"Private key","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Chain CA","type":"text","marks":[{"type":"strong"}]},{"text":" and save them in ","type":"text"},{"text":"devo-collector-zscaler/certs","type":"text","marks":[{"type":"code"}]},{"text":"/ Learn more about security credentials in Devo ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/94763701"}}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1822,"id":"3842f0c4-8283-41a5-8cae-65278b54b56c","collection":"contentId-120920977","type":"file","height":471}}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the config-zscaler.yaml file","type":"text"}]},{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"config-zscaler.yaml","type":"text","marks":[{"type":"strong"}]},{"text":" file, replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"

","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":" ","type":"text","marks":[{"type":"code"}]},{"text":"with the proper values.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"3e075836-7f94-4133-8aff-25746d500282"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Value type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Value range","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Special characters are not allowed. Do not exceed the maximum length of 5 characters.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"https://zsapi..net","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Visit ","type":"text"},{"text":"the vendor page","type":"text","marks":[{"type":"link","attrs":{"href":"https://help.zscaler.com/zia/api-getting-started"}}]},{"text":" to find out your assigned ","type":"text"},{"text":"Zscaler Cloud Name","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Comply with the final value as ","type":"text"},{"text":"https://zsapi","type":"text","marks":[{"type":"link","attrs":{"href":"https://zsapi/"}}]},{"text":".","type":"text"},{"text":"","type":"text","marks":[{"type":"em"}]},{"text":".net, being ","type":"text"},{"text":"","type":"text","marks":[{"type":"em"}]},{"text":" the one provided by Zscaler.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Email of an Admin account.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Password of an Admin account.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"API Key provided by the Zscaler tenant.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"1 to 31","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"The maximum number of days used when requesting data by periods.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"10 to 500","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Size of the pagination when requesting data.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Any date between today and the last 6 months.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"If you use the date January 1, 2021 (1609459200000), the collector will calculate the oldest valid date (today - 6 months).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"5 to 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Time delayed by the collector between the request to create and check the report (asynchronous Zscaler process)","type":"text"}]}]}]}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: false\n id: \n name: \n persistence:\n type: filesystem\n config:\n directory_name: state\noutputs:\n devo_1:\n type: devo_platform\n config:\n address: # Choose one -> collector-eu.devo.io or collector-us.devo.io\n port: 443\n type: SSL\n chain: .crt # Use your chain file from Devo\n cert: .crt # Use your domain .crt file from Devo.\n key: .key # User your domain .key file from Devo.\n# console_1:\n# type: console\ninputs:\n zscaler:\n id: # Input a custom ID for this input\n enabled: true\n services:\n zscaler_audit_logs:\n base_url: https://zsapi..net # Use the given Zscaler domain\n credentials:\n username: # Email of an Admin user\n password: # Password of the Admin user\n api_key: # API Key created on Zscaler tenant\n time_range_in_days: # Valid range -> 1 to 31\n audit_logs_page_size_in_items: # Valid range -> 10 to 500\n audit_logs_since_in_epoch_milliseconds: # Valid format -> Epoch in milliseconds\n audit_logs_check_interval_in_seconds: # Valid range -> 5 to 20\n types:\n - audit_logs","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"43f4f24e-9d96-4565-b5e0-54449ed1685f"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"collector-zscaler-docker-image-1.0.0.tgz","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/10mb34riGfmc7dy42_wn4KIVUs5yLL1Nh/view?usp=sharing"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"74c90bb633ea5a4da0d2e742dc30e859f3657c2747f7b9cbe6baf7ae9317d9ce","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text"}]},{"type":"codeBlock","content":[{"text":"gunzip -c collector-zscaler-docker-image-.tgz | docker load","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace \"","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"\" with a proper value.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors/devo-collector-zscaler/","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \\\n--name collector-zscaler\\\n--volume $PWD/certs:/devo-collector/certs \\\n--volume $PWD/config:/devo-collector/config \\\n--volume $PWD/state:/devo-collector/state \\\n--env CONFIG_FILE=config-zscaler.yaml \\\n--rm -it docker.devo.internal/collector/zscaler:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the required value.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors/devo-collector-zscaler/","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-zscaler:\n image: docker.devo.com/collector/zscaler:${IMAGE_VERSION:-latest}\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config-zscaler.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text"},{"text":"/devo-collectors/devo-collector-zscaler/","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text"}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the required value.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"API limitations","type":"text"}]},{"type":"paragraph","content":[{"text":"The API limitations can be seen in the next table: ","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"7ac7170b-f6ca-4599-9e6c-d0b3a7ea6ed9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"Resource URI","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"GET","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"POST","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"PUT","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"DELETE","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"/auditlogEntryReport","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"2/sec and 1000/hr","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"10/min and 40/hour","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"-","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"2/sec and 1000/hr","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"/auditlogEntryReport/download","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"2/sec and 1000/hr","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"-","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"-","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[136.0]},"content":[{"type":"paragraph","content":[{"text":"-","type":"text"}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported