Skip to main content
All Zscaler integration capabilities

​
About

Stream Zscaler Internet Access (ZIA) web, firewall, and DNS logs into Sazabi. A Cloud NSS feed posts batches of JSON log records from the Zscaler cloud straight to your Sazabi intake URL, with no NSS virtual machine to run. You add one feed per log type, and every feed can use the same URL.
Cloud NSS is a ZIA subscription add-on. If the Cloud NSS Feeds tab is missing from the Nanolog Streaming Service page, contact your Zscaler account team.

​
Prerequisites

  • A ZIA subscription that includes Cloud NSS.
  • A Zscaler Admin Console role that can manage Nanolog Streaming Service feeds.
  • Your Sazabi intake URL (shown above).

​
Set up in the dashboard

1

​
Open the Cloud NSS feed form

In the Zscaler Admin Console, go to Data Explorer > Log Streaming > Internet Log Streaming > Nanolog Streaming Service, open the Cloud NSS Feeds tab, and click Add Cloud NSS Feed.
2

​
Set feed values

The public key in the intake URL’s hostname authenticates the feed, so no header or token is needed. Sazabi reads each record’s time from its epochtime field and stores blocked and dropped transactions at warning severity.
3

​
Repeat for each log type

Save the feed, then add one more feed for each remaining log type: Web Log, Firewall Logs, and DNS Logs. Activate the change in the Admin Console.

​
Set up with the CLI

You can also register the Zscaler log source with the Sazabi CLI (installed and authenticated — see CLI reference). Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
The command prints the intake URL for the new source. Copy the whole URL into the API URL of each Cloud NSS feed using the values shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.

​
Verify

Click Test Connectivity on a saved feed; Zscaler reports success when Sazabi accepts the request. Then browse a website from a device that goes through Zscaler. Open the Intake page in the Sazabi dashboard and confirm records from the Zscaler source appear.

​
Troubleshooting

No Cloud NSS Feeds tab — the tenant has no Cloud NSS subscription or your admin role cannot manage NSS feeds. Test Connectivity fails — confirm the API URL is the whole Sazabi intake URL, starting with https://, with nothing appended. Feed saved but no records arrive — confirm Feed Output Type is JSON and that you activated the change. Tab-separated, name-value pair, and custom outputs are not parsed. Cloud NSS drops a batch Sazabi rejects as malformed; set Feed Escape Character to ,\" so backslashes and quotes in fields stay valid JSON.

​
Further reading

Zscaler Cloud NSS feeds

Zscaler’s reference for Cloud NSS feeds.

Intake

See per-source ingestion volume and health in the Intake page.

Log sources

Browse the full log source catalog.