Zscaler NSS Data is Marked Failed

Products

• CASB Security Standard
• CASB Security Premium
• CASB Security Advanced
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

CASB Audit datasource for Zscaler processing status failed with message Data Processing Error.

Resolution

CloudSOC requires the following configuration in NSS logging of Zscaler.  The string is one continuous value.  Copy and paste from the PDF will not capture the spaces at the beginning of each line.   

Paste the string into a editor and make sure there is a space after each comma. Then paste the string into Zscaler.

source="%s{CIP.EN_US}", datetime="%s{TIME.EN_US}", tz="%s{TZ.EN_US}", user="%s{LOGIN.EN_US}", dst="%s{SIP.EN_US}", sent="%d{REQSIZE.EN_US}", totalsize="%d{TOTALSIZE.EN_US}", ua="%s{UA.EN_US}", duration="%d{CTIME.EN_US}", url="%s{URL.EN_US}", referer="%s{REFERER.EN_US}", action="%s{ACTION.EN_US}", proto="%s{PROTO.EN_US}", rcvd="%d{RESPSIZE.EN_US}", op="%s{REQMETHOD.EN_US}"\n

 

Additional Information

The updated TechDoc in HTML format for Zscaler NSS logs:

https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/symantec-cloudsoc/cloud/audit-home/zscaler-home/zscalerlog-format.html