Collect Zscaler DLP logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This document explains how to export Zscaler DLP logs by setting up a Google Security Operations feed and how log fields map to Google SecOps Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google SecOps overview.

A typical deployment consists of Zscaler DLP and the Google SecOps Webhook feed configured to send logs to Google SecOps. Each customer deployment can differ and might be more complex.

The deployment contains the following components:

• Zscaler DLP: the platform from which you collect logs.

• Google SecOps feed: the Google SecOps feed that fetches logs from Zscaler DLP and writes logs to Google SecOps.

• Google Security Operations: retains and analyzes the logs.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the ZSCALER_DLP label.

Before you begin

• Ensure that you have access to Zscaler Internet Access console. For more information, see Secure Internet and SaaS Access ZIA Help.
• Ensure that you are using Zscaler DLP 2024 or later.
• Ensure that all systems in the deployment architecture are configured with the UTC time zone.
• Ensure that you have the API key which is needed to complete feed setup in Google Security Operations. For more information, see Setting up API keys.

Set up an ingestion feed in Google SecOps to ingest Zscaler DLP logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, Zscaler DLP Logs).
4. Select Webhook as the Source Type.
5. Select Zscaler DLP as the Log Type.
6. Click Next.
7. Optional: Specify values for the following input parameters:
   1. Split delimiter: the delimiter that is used to separate the logs lines (leave blank if a delimiter is not used).
   2. Asset namespace: the asset namespace.
   3. Ingestion labels: the label to be applied to the events from this feed.
8. Click Next.
9. Review your new feed configuration in the Finalize screen, and then click Submit.
10. Click Generate Secret Key to generate a secret key to authenticate this feed.

Set up Zscaler DLP

1. In Zscaler Internet Access console, go to Administration > Nanolog Streaming Service > Cloud NSS Feeds.
2. Click Add Cloud NSS Feed.
3. Enter a name for the feed in the Feed Name field.
4. Select NSS for Web in NSS Type.
5. Select the status from the Status list to activate or deactivate the NSS feed.
6. Keep the value in the SIEM Rate menu as Unlimited. To suppress the output stream due to licensing or other constraints, change the value.
7. Select Other in the SIEM Type list.
8. Select Disabled in the OAuth 2.0 Authentication list.
9. Enter a size limit for an individual HTTP request payload to the SIEM's best practice in Max Batch Size (for example, 512 KB).

10. Enter the HTTPS URL of the Chronicle API endpoint in the API URL in the following format:

    https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    

    • CHRONICLE_REGION: region where your Google SecOps instance is hosted (for example, US).
    • GOOGLE_PROJECT_NUMBER: BYOP project number (obtain this from C4).
    • LOCATION: Google SecOps region (for example, US).
    • CUSTOMER_ID: Google SecOps customer ID (obtain this from C4).
    • FEED_ID: Feed ID shown on the Feed UI on the new webhook created.

    Sample API URL:

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    

11. Click Add HTTP Header to add more HTTP headers with keys and values.

    For example:

    • Key: X-goog-api-key
    • Value: API Key generated on Google Cloud BYOP's API Credentials

12. Select Endpoint DLP from the Log Types list.

13. Select JSON in the Feed Output Type list.

14. Set Feed Escape Character to , \ ".

15. To add a new field to the Feed Output Format, select Custom in the Feed Output Type list.

16. Copy-paste the Feed Output Format and add new fields. Ensure the key names match the actual field names.

    The following is the default Feed Output Format:

    \{ "sourcetype" : "zscalernss-edlp", "event" :\{"time":"%s{time}","recordid":"%d{recordid}","login":"%s{user}","dept":"%s{department}","filetypename":"%s{filetypename}","filemd5":"%s{filemd5}","dlpdictnames":"%s{dlpdictnames}","dlpdictcount":"%s{dlpcounts}","dlpenginenames":"%s{dlpengnames}","channel":"%s{channel}","actiontaken":"%s{actiontaken}","severity":"%s{severity}","rulename":"%s{triggeredrulelabel}","itemdstname":"%s{itemdstname}"\}\}
    

17. Select the time zone for the Time field in the output file in the Timezone list. By default, the time zone is set to your organization's time zone.

18. Review the configured settings.

19. Click Save to test connectivity. If the connection is successful, a green tick accompanied by the message Test Connectivity Successful: OK (200) appears.

For more information about Google SecOps feeds, see Google SecOps feeds documentation. For information about requirements for each feed type, see Feed configuration by type.

If you encounter issues when you create feeds, contact Google SecOps support.

UDM Mapping Table

The following table lists the log fields of the ZSCALER_DLP log type and their corresponding UDM fields.

Log field	UDM mapping	Logic
mon	additional.fields[mon]
day	additional.fields[day]
scantime	additional.fields[scantime]
numdlpengids	additional.fields[numdlpengids]
numdlpdictids	additional.fields[numdlpdictids]
recordid	metadata.product_log_id
scanned_bytes	additional.fields[scanned_bytes]
dlpidentifier	security_result.detection_fields[dlpidentifier]
login	principal.user.user_display_name
b64user	principal.user.user_display_name
euser	principal.user.user_display_name
ouser	security_result.detection_fields[ouser]
dept	principal.user.department
b64department	principal.user.department
edepartment	principal.user.department
odepartment	security_result.detection_fields[odepartment]
odevicename	security_result.detection_fields[odevicename]
devicetype	principal.asset.attribute.labels[devicetype]
	principal.asset.platform_software.platform	If the deviceostype log field value matches the regular expression pattern (?i)Windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.
	principal.asset.asset_id	If the devicename log field value is not empty, then the asset_id:devicename log field is mapped to the principal.asset.asset_id UDM field. If the b64devicename log field value is not empty, then the asset_id:b64devicename log field is mapped to the principal.asset.asset_id UDM field. If the edevicename log field value is not empty, then the asset_id:edevicename log field is mapped to the principal.asset.asset_id UDM field.
deviceplatform	principal.asset.attribute.labels[deviceplatform]
deviceosversion	principal.asset.platform_software.platform_version
devicemodel	principal.asset.hardware.model
deviceappversion	additional.fields[deviceappversion]
deviceowner	principal.user.userid
b64deviceowner	principal.user.userid
edeviceowner	principal.user.userid
odeviceowner	security_result.detection_fields[odeviceowner]
devicehostname	principal.hostname
b64devicehostname	principal.hostname
edevicehostname	principal.hostname
odevicehostname	security_result.detection_fields[odevicehostname]
datacenter	target.location.name
datacentercity	target.location.city
datacentercountry	target.location.country_or_region
dsttype	target.resource.resource_subtype
filedoctype	additional.fields[filedoctype]
filedstpath	target.file.full_path
b64filedstpath	target.file.full_path
efiledstpath	target.file.full_path
filemd5	target.file.md5	If the filemd5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the filemd5 log field is mapped to the target.file.md5 UDM field.
filesha	target.file.sha256	If the filesha log field value matches the regular expression pattern ^[0-9a-f]+$, then the filesha log field is mapped to the target.file.sha256 UDM field.
filesrcpath	src.file.full_path
b64filesrcpath	src.file.full_path
efilesrcpath	src.file.full_path
filetypecategory	additional.fields[filetypecategory]
filetypename	target.file.mime_type
itemdstname	target.resource.name
b64itemdstname	target.resource.name
eitemdstname	target.resource.name
itemname	target.resource.attribute.labels[itemname]
b64itemname	target.resource.attribute.labels[itemname]
eitemname	target.resource.attribute.labels[itemname]
itemsrcname	src.resource.name
b64itemsrcname	src.resource.name
eitemsrcname	src.resource.name
itemtype	target.resource.attribute.labels[itemtype]
ofiledstpath	security_result.detection_fields[ofiledstpath]
ofilesrcpath	security_result.detection_fields[ofilesrcpath]
oitemdstname	security_result.detection_fields[oitemdstname]
oitemname	security_result.detection_fields[oitemname]
odlpengnames	security_result.detection_fields[odlpengnames]
oitemsrcname	security_result.detection_fields[oitemsrcname]
srctype	src.resource.resource_subtype
actiontaken	security_result.action_details
	security_result.action	If the actiontaken log field value matches the regular expression pattern (?i)allow, then the security_result.action UDM field is set to ALLOW. Else, if the actiontaken log field value matches the regular expression pattern (?i)block, then the security_result.action UDM field is set to BLOCK.
activitytype	metadata.product_event_type
addinfo	additional.fields[addinfo]
channel	security_result.detection_fields[channel]
confirmaction	security_result.detection_fields[confirmaction]
confirmjust	security_result.description
dlpdictcount	security_result.detection_fields[dlpdictcount]
dlpdictnames	security_result.detection_fields[dlpdictnames]
b64dlpdictnames	security_result.detection_fields[dlpdictnames]
edlpdictnames	security_result.detection_fields[dlpdictnames]
dlpenginenames	security_result.detection_fields[dlpenginenames]
b64dlpengnames	security_result.detection_fields[dlpenginenames]
edlpengnames	security_result.detection_fields[dlpenginenames]
expectedaction	security_result.detection_fields[expectedaction]
logtype	security_result.category_details
odlpdictnames	security_result.detection_fields[odlpdictnames]
ootherrulelabels	security_result.detection_fields[ootherrulelabels]
otherrulelabels	security_result.rule_labels[otherrulelabels]
b64otherrulelabels	security_result.rule_labels[otherrulelabels]
eotherrulelabels	security_result.rule_labels[otherrulelabels]
otriggeredrulelabel	security_result.rule_labels[otriggeredrulelabel]
severity	security_result.severity_details
	security_result.severity	If the severity log field value matches the regular expression pattern (?i)High, then the security_result.severity UDM field is set to HIGH. Else, if the severity log field value matches the regular expression pattern (?i)Medium, then the security_result.severity UDM field is set to MEDIUM. Else, if the severity log field value matches the regular expression pattern (?i)Low, then the security_result.severity UDM field is set to LOW. Else, if the severity log field value matches the regular expression pattern (?i)Info, then the security_result.severity UDM field is set to INFORMATIONAL.
rulename	security_result.rule_name
b64triggeredrulelabel	security_result.rule_name
etriggeredrulelabel	security_result.rule_name
zdpmode	security_result.detection_fields[zdpmode]
tz	additional.fields[tz]
ss	additional.fields[ss]
mm	additional.fields[mm]
hh	additional.fields[hh]
dd	additional.fields[dd]
mth	additional.fields[mth]
yyyy	additional.fields[yyyy]
sourcetype	additional.fields[sourcetype]
eventtime	metadata.event_timestamp
time	metadata.collected_timestamp
rtime	additional.fields[rtime]
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Zscaler.
	metadata.product_name	The metadata.product_name UDM field is set to DLP.
	metadata.event_type	If the activitytype log field value contain one of the following values, then the metadata.event_type UDM field is set to FILE_UNCATEGORIZED. Upload Download Else, if the activitytype log field value is equal to File Copy, then the metadata.event_type UDM field is set to FILE_COPY. Else, if the activitytype log field value is equal to File Read, then the metadata.event_type UDM field is set to FILE_READ. Else, if the activitytype log field value is equal to File Write, then the metadata.event_type UDM field is set to FILE_MODIFICATION. Else, if the activitytype log field value is equal to Email Sent, then the metadata.event_type UDM field is set to EMAIL_UNCATEGORIZED. Else, if the activitytype log field value is equal to Print, then the metadata.event_type UDM field is set to STATUS_UPDATE. Else, the metadata.event_type UDM field is set to GENERIC_EVENT.

Need more help? Get answers from Community members and Google SecOps professionals.