Collect Zscaler Cloud Access Security Broker (CASB) alert logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This document describes how you can collect the Zscaler Cloud Access Security Broker (CASB) alert logs. This parser extracts fields from JSON formatted logs, handling potential formatting inconsistencies. It maps extracted fields to the UDM, creating or merging fields within principal, metadata, additional, and security_result objects, and ultimately merges everything into a unified @output field. The parser also performs several data transformations, including string manipulation and date parsing.

Before you begin

• Ensure you have a Google Security Operations instance.
• Ensure that you are using Windows 2016 or later, or a Linux host with systemd.
• If running behind a proxy, ensure firewall ports are open.
• Ensure you have administrative access to ZScaler.

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File. Save the file securely on the system where BindPlane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer ID from the Organization Details section.

Install BindPlane Agent

Windows Installation

1. Open the Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

Linux Installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

Additional Installation Resources

• For additional installation options, consult this installation guide.

Configure BindPlane Agent to ingest Syslog and send to Google SecOps

1. Access the configuration file:

   • Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
   • Open the file using a text editor (for example, nano, vi, or Notepad).

2. Edit the config.yaml file as follows:

   receivers:
       tcplog:
           # Replace the below port <54525> and IP <0.0.0.0> with your specific values
           listen_address: "0.0.0.0:54525" 
   
   exporters:
       chronicle/chronicle_w_labels:
           compression: gzip
           # Adjust the creds location below according the placement of the credentials file you downloaded
           creds: '{ json file for creds }'
           # Replace <customer_id> below with your actual ID that you copied
           customer_id: <customer_id>
           endpoint: malachiteingestion-pa.googleapis.com
           # You can apply ingestion labels below as preferred
           ingestion_labels:
           log_type: SYSLOG
           namespace: vmware_nsx
           raw_log_field: body
   service:
       pipelines:
           logs/source0__chronicle_w_labels-0:
               receivers:
                   - tcplog
               exporters:
                   - chronicle/chronicle_w_labels
   

3. Replace the port and IP address as required in your infrastructure.

4. Replace <customer_id> with the actual customer ID.

5. Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart BindPlane Agent to apply the changes

• In Linux, to restart the BindPlane Agent, run the following command:

  sudo systemctl restart bindplane-agent
  

• In Windows, to restart the BindPlane Agent, you can either use the Services console or enter the following command:

  net stop BindPlaneAgent && net start BindPlaneAgent
  

Configure Zscaler Cloud Web Security

1. Sign in to the Zscaler Analytics Admin console.
2. Select Administration > Settings > Nanolog streaming service (NSS).
3. Select NSS feeds.
4. Click Add.

5. In the Add NSS feed window that appears, do the following:

   1. Feed name: enter the feed name.
   2. NSS type: select either NSS for web or NSS for firewall depending on your requirements.
   3. NSS name: select NSS virtual machine (VM) that collects logs from the cloud (only one NSS VM can be mapped to a feed).
   4. Status: select Enabled to activate the feed.
   5. SIEM IP: enter the syslog server/Bindplane IP address.
   6. SIEM TCP port: enter the syslog server/Bindplane port number for TCP communication (Zscaler supports only the TCP connection).
   7. Log type: select Web log or Firewall logs based on the NSS type selected.
   8. Feed output type: select Custom.
   9. Feed output format: specify the web log or firewall log.
   10. User obfuscation: select Disabled to display the login usernames in the output. For random values, select Enabled.
   11. Time zone: select the appropriate time zone (default time zone is GMT).
   12. Duplicate logs: enter the number of minutes that NSS takes to send the duplicate logs (you can select the time based on your requirements).
   13. Transactions filters: there are various parameters available based on which you can filter the logs sent by the NSS Virtual machine.

   For more information on different filter sets, see NSS document section in the Help portal.

   Note: Configuring filters is not recommended.

6. Use Policy admin console or Analytics admin console:

   1. To use Policy admin console, click Done.
   2. To use Analytics admin console, click Save. After the Add NSS feed window is closed, return to the previous window, and the added feed details display under the Configure feeds section.

7. Use Policy admin console or Analytics admin console:

   1. To use Policy admin console, do the following:
      • In the Configure feeds section, click Save.
      • Click Activate now (the status of the result appears in a new window).
      • Click Done.
   2. To use Analytics admin console, click Activate now (the status of the result appears on top of the window).

Note: There is no configuration control over the logs coming from the cloud to NSS virtual machine. Therefore, if connectivity between NSS virtual machine and Zscaler cloud firewall is fine, then the logs would automatically be sent to Google SecOps. For more information on connectivity, see the. NSS administrator guide section in the Help portal.

Configure web and firewall log feed

In the Feed output format field, use the following feeds:

• If the collector supports customized format, specify the following web log feed:

  |ZSCALER|DATE|%s{mon} %d{dd} %02d{hh}:%02d{mm}:%02d{ss}|NSSFEEDIP|%s{nsssvcip}|CLIENTINTIP|%s{cintip}|RECORDID|%d{recordid}|LOGINNAME|%s{login}|PROTOCOL|%s{proto}|URL|%s{url}|HOST|%s{host}|ACTION|%s{action}|REASON|%s{reason}|RISKSCORE|%d{riskscore}|APPNAME|%s{appname}|APPCLASS|%s{appclass}|REQSIZE|%d{reqsize}|RESPSIZE|%d{respsize}|CTIME|%d{ctime}|URLCLASS|%s{urlclass}|SUPERCAT|%s{urlsupercat}|URLCAT|%s{urlcat}|MALWARECAT|%s{malwarecat}|MALWARECLASS|%s{malwareclass}|THREATNAME|%s{threatname}|FILETYPE|%s{filetype}|FILECLASS|%s{fileclass}|DLPENGINE|%s{dlpeng}|DLPDICT|%s{dlpdict}|BWTHROTTLE|%s{bwthrottle}|LOCATION|%s{location}|DEPARTMENT|%s{dept}|CLIENTIP|%s{cip}|DESTINATIONIP|%s{sip}|REQMETHOD|%s{reqmethod}|RESPCODE|%s{respcode}|USERAGENT|%s{ua}|REFERER|%s{referer}|MD5HASH|%s{bamd5}|DLPRULENAME|%s{dlprulename}|DLPMD5|%s{dlpmd5}|DLPIDENTIFIER|%d{dlpidentifier}|DLPDICTHITCOUNT|%s{dlpdicthitcount}|\n
          ```
  

• If the collector supports firewall feed subscription, specify the following firewall feed:

  |ZSCALERFIREWALL|DATE|%s{mon}%d{dd} %02d{hh}:%02d{mm}:%02d{ss}|CLIENTIP|%s{csip}|RECORDID|%d{recordid}|LOGINNAME|%s{login}|PROTOCOL|%s{ipproto}|ACTION|%s{action}|DESTINATIONIP|%s{cdip}|SOURCEPORT|%d{csport}|DESTINATIONPORT|%d{cdport}|CLIENTTUNIP|%s{tsip}|CLIENTTUNPORT|%d{tsport}|LOCATION|%s{location}|DEPARTMENT|%s{dept}|DESTINATIONCOUNTRY|%s{destcountry}|INCOMINGBYTES|%ld{inbytes}|NETWORKAPP|%s{nwapp}|NETWORKSVC|%s{nwsvc}|RULELABEL|%s{rulelabel}|NATTING|%s{dnat}|SESSIONDURATION|%d{duration}|AGGREGATEDSESSION|%d{numsessions}|AVERAGEDURATION|%d{avgduration}|TUNNELTYPE|%s{ttype}|SERVERDESTPORT|%d{sdport}|SERVERSOURCEIP|%s{ssip}|SERVERSOURCEPORT|%d{ssport}|IPCAT|%s{ipcat}|\n
  

  Note: Make sure not to change the order or key values of the fields listed in the web log and firewall feed sections.

Configure Zscaler Private Access

1. User activity: select Log type.
2. Log template: select CSV.

3. Log stream: run the following command:

   *%s{LogTimestamp:time} User Activity zpa-lss: %s{Username},%d{ServicePort},%s{ClientPublicIP},%s{ClientCountryCode},%s{ConnectionStatus},%d{IPProtocol},%s{ClientZEN},%s{Policy},%s{Connector},%s{ConnectorZEN},%s{ConnectorIP},%s{Host},%s{ServerIP},%s{TimestampConnectionStart:iso8601},%d{ServerPort}\n*
   

UDM Mapping Table

Log Field	UDM Mapping	Logic
applicationname	principal.application	The value of applicationname from the raw log is assigned to this UDM field.
company	principal.user.company_name	The value of company from the raw log is assigned to this UDM field.
datetime	metadata.event_timestamp	The value of datetime from the raw log is parsed and converted to a timestamp, which is then assigned to this UDM field. The parser uses multiple date formats to handle variations in the raw log.
dept	principal.user.department	The value of dept from the raw log is assigned to this UDM field.
dlpdictcount	additional.fields	If dlpdictcount is present and not "None" or empty in the raw log, a new field with key "dlpdictcount" and a string value of dlpdictcount is added to the additional.fields array.
dlpdictnames	additional.fields	If dlpdictnames is present and not "None" or empty in the raw log, a new field with key "dlpdictnames" and a string value of dlpdictnames is added to the additional.fields array.
dlpenginenames	additional.fields	If dlpenginenames is present and not "None" or empty in the raw log, a new field with key "dlpenginenames" and a string value of dlpenginenames is added to the additional.fields array.
event.extcollabnames	additional.fields	If extcollabnames is present in the raw log, it is split by the "
event.extownername	additional.fields	If extownername is present in the raw log, a new field with key "extownername" and a string value of extownername is added to the additional.fields array.
filedownloadtimems	additional.fields	If filedownloadtimems is present in the raw log, a new field with key "File Download Time" and a string value of filedownloadtimems is added to the additional.fields array.
fileid	additional.fields	If fileid is present in the raw log, a new field with key "fileid" and a string value of fileid is added to the additional.fields array.
filename	principal.process.file.full_path	The value of filename from the raw log is assigned to this UDM field. The parser handles escaped characters and special cases in the filename.
filemd5	principal.process.file.md5	If filemd5 is present and not "None" or empty in the raw log, its value is assigned to this UDM field.
filescantimems	additional.fields	If filescantimems is present in the raw log, a new field with key "File Scan Time" and a string value of filescantimems is added to the additional.fields array.
filesource	additional.fields	If filesource is present in the raw log, a new field with key "File Source" and a string value of filesource is added to the additional.fields array. The parser handles escaped characters and special cases in the filesource.
fullurl	principal.url	If fullurl is present and not "Unknown URL" or empty in the raw log, its value is assigned to this UDM field.
intcollabnames	additional.fields	If intcollabnames is present in the raw log, it is split by the "
lastmodtime	metadata.event_timestamp	If lastmodtime is present in the raw log, it is parsed and converted to a timestamp, which is then assigned to this UDM field. The parser uses multiple date formats to handle variations in the raw log.
login	principal.user.email_addresses, principal.user.userid	If login is present and matches an email address format, its value is assigned to both principal.user.email_addresses and principal.user.userid. If login is present but does not match an email address format, its value is assigned only to principal.user.userid. If login is not present, principal.user.userid is set to "n/a".
policy	security_result.rule_name	If policy is present and not "None" or empty in the raw log, its value is assigned to this UDM field.
recordid	metadata.product_log_id	If recordid is present in the raw log, its value is assigned to this UDM field.
tenant	additional.fields	If tenant is present in the raw log, a new field with key "Tenant" and a string value of tenant is added to the additional.fields array.
threatname	security_result.threat_name	If threatname is present and not "None" or empty in the raw log, its value is assigned to this UDM field.
(Parser Logic)	metadata.event_type	The parser sets this field to "USER_UNCATEGORIZED".
(Parser Logic)	metadata.log_type	The parser sets this field to "ZSCALER_CASB".
(Parser Logic)	metadata.product_name	The parser sets this field to "Zscaler CASB".
(Parser Logic)	metadata.vendor_name	The parser sets this field to "Zscaler".

Changes

2024-06-04

• Added "gsub" function to handle invalid escape characters in the following fields: "filename", "fileid", "filemd5", and "filesource".

2024-03-27

• Added "gsub" function to handle invalid escape character in "filename".

2024-03-05

• Mapped "event.fileid", "event.intcollabnames", "event.extownername", "event.extcollabnames" to "additional.fields".

2024-01-29

• Added "gsubs" function to handle invalid escape character, "," in "filesource".
• Added "gsubs" function to handle invalid escape character in "filename".

2023-12-21

• Added gsubs to handle invalid characters for unparsed JSON logs.

2023-09-30

• Mapped "event.login" to "principal.user.userid". If not available, set "principal.user.userid" to "n/a".
• Added "on_error" check for "date" filter as "event.lastmodtime" which is an optional parameter.

2022-08-16

• Newly created parser