Zscaler ZPA

Applies to: Zscaler ZPA

Overview

The Zscaler Private Access (ZPA) is a cloud service that permits organizations to provide access to internal applications and services while ensuring the security of their networks.

EventTracker helps to monitor events from Zscaler ZPA. Its dashboard, alerts and reports will help you to track authentication activities of user and connectors, user activity and status and browser activity to keep you informed about the system and its activities. It will trigger alert whenever any authentication failure is detected to tackle security issues.

EventTracker Knowledge Pack for Zscaler ZPA allows you to monitor the following components.

Security - User Authentication Failure
Operation - Browser activity, User activity and Connector status
Compliance - User Status

Previous Next

Security

Alerts

Zscaler ZPA: User Authentication Failure: This alert is generated when user authentication failure is detected.
Zscaler ZPA: Connector Authentication Failure: This alert is generated when any authentication failure of connector is detected.

Operation

Reports

Zscaler ZPA: Browser Activity - This report gives the information about the HTTP log information related to browser access. Reports contain User email, HTTP method, protocol, request size, response size, user agent, URL, client IP, port and other details used for investigation.
Zscaler ZPA: User Activity - This report gives information related to user activities performed in Zscaler ZPA. Reports contain connection status, IP address, port, application name, username, customer name and other fields which provides a detailed view of the user activity.
Zscaler ZPA: Connector Status – This report gives information about all the connector status of Zscaler ZPA about management, data forwarding and configuration update. Reports contain session type, status, session ID, connector name and IP of connector and other useful details for investigation.

Compliance

Reports

Zscaler ZPA: User Status - This report gives information about the user status connected to Zscaler ZPA. Reports contain IP address, username, email, session status as (connected, disconnected and authenticated) and other useful information.

Scope

The configuration details are consistent with EventTracker version 9.2 and later, and Zscaler ZPA.

Documentation

To configure Zscaler ZPA to send logs to EventTracker, refer the How to Guide.

For more information please refer the Integration guide.