> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Zscaler

> Add Zscaler Cloud NSS feeds pointed at a Sazabi endpoint to stream Zscaler Internet Access web, firewall, and DNS logs.

[All Zscaler integration capabilities](https://docs.sazabi.com/catalogs/integrations/zscaler)

## About

Stream Zscaler Internet Access (ZIA) web, firewall, and DNS logs into Sazabi. A Cloud NSS feed posts batches of JSON log records from the Zscaler cloud straight to your Sazabi intake URL, with no NSS virtual machine to run. You add one feed per log type, and every feed can use the same URL.

> [!WARNING]
>
> Cloud NSS is a ZIA subscription add-on. If the **Cloud NSS Feeds** tab is missing from the Nanolog Streaming Service page, contact your Zscaler account team.

## Prerequisites

* A ZIA subscription that includes **Cloud NSS**.
* A Zscaler Admin Console role that can manage Nanolog Streaming Service feeds.
* Your Sazabi intake URL (shown above).

## Set up in the dashboard

**Step 1**

### Open the Cloud NSS feed form

In the [Zscaler Admin Console](https://admin.zscaler.com), go to **Data Explorer > Log Streaming > Internet Log Streaming > Nanolog Streaming Service**, open the **Cloud NSS Feeds** tab, and click **Add Cloud NSS Feed**.

**Step 2**

### Set feed values

| Field | Value |
| - | - |
| NSS Type | **NSS for Web** for the web feed; **NSS for Firewall** for the firewall and DNS feeds |
| SIEM Type | **Other** |
| OAuth 2.0 Authentication | Off |
| API URL | Your Sazabi intake URL (shown above) |
| HTTP Headers | None needed |
| Log Type | **Web Log**, **Firewall Logs**, or **DNS Logs** |
| Feed Output Type | **JSON** |
| JSON Array Notation | On |
| Feed Escape Character | `,\"` |
| Feed Output Format | Keep the default for the log type |

The public key in the intake URL's hostname authenticates the feed, so no header or token is needed. Sazabi reads each record's time from its `epochtime` field and stores blocked and dropped transactions at warning severity.

**Step 3**

### Repeat for each log type

Save the feed, then add one more feed for each remaining log type: **Web Log**, **Firewall Logs**, and **DNS Logs**. Activate the change in the Admin Console.

## Set up with the CLI

You can also register the Zscaler log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create zscaler --mode manual
```

The command prints the intake URL for the new source. Copy the whole URL into the **API URL** of each Cloud NSS feed using the values shown above. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify

Click **Test Connectivity** on a saved feed; Zscaler reports success when Sazabi accepts the request. Then browse a website from a device that goes through Zscaler. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm records from the **Zscaler** source appear.

## Troubleshooting

**No Cloud NSS Feeds tab** — the tenant has no Cloud NSS subscription or your admin role cannot manage NSS feeds.

**Test Connectivity fails** — confirm the **API URL** is the whole Sazabi intake URL, starting with `https://`, with nothing appended.

**Feed saved but no records arrive** — confirm **Feed Output Type** is **JSON** and that you activated the change. Tab-separated, name-value pair, and custom outputs are not parsed. Cloud NSS drops a batch Sazabi rejects as malformed; set **Feed Escape Character** to `,\"` so backslashes and quotes in fields stay valid JSON.

## Further reading

> [card] [Zscaler Cloud NSS feeds](https://help.zscaler.com/zia/about-cloud-nss-feeds)
>
> Zscaler's reference for Cloud NSS feeds.

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.