Zscaler Internet Access CA

OverviewResources

After the Zscaler Internet Access CA is configured to deliver the Zscaler Internet Access CA events to EventTracker, then the alerts, dashboards, and reports can be configured into EventTracker.

Compliance

Reports

Zscaler Internet Access CA – Tunnel activities: This report gives information about the tunnel traffic. It contains field information like IP address, location, destination IP address, tunnel type, VPN name, etc.

Security

Alerts

Zscaler Internet Access CA - IPS traffic detected: This alert generates whenever Zscaler detects Intrusion prevention traffic.
Zscaler Internet Access CA - Malicious file has been detected: This alert generates whenever Zscaler detects a malicious file.

Reports

Zscaler Internet Access CA – Web access activities: This report gives information about the web access details on your organization. It contains the field information like the username, source IP address, destination IP address, host name, action, reason, URL address, a risk score of URLs, total bytes in, total bytes out, etc.

Operations

Reports

Zscaler Internet Access CA – DNS activities: This report gives information about the domain name service events. It contains the field information like the client IP address, server IP address, datacenter name, datacenter location, record type, username, response type, reason, action, etc.
Zscaler Internet Access CA – SaaS security activities: This report gives information about the current state of the organization security posture for the SaaS application. It contains the field information like action, hostname, application, source IP address, destination IP address, threat name, URL address, etc.

Scope

The configuration details are consistent with the EventTracker version 9.2X and later, and the Zscaler Internet Access CA.

Documentation:

To configure Zscaler Internet Access CA to forwarding logs to EventTracker, refer to the How-to Guide.

For more information please refer to the Integration guide.