Accenture MDR Quick Start Guide for Zscaler™ Cloud Web Security

Source

Destination

Port

Description

Zscaler Cloud Firewall

    LCP

 601 (TCP)

Default port

Field

Description

Feed Name

Enter a feed name. The feed is used as a log configuration mechanism for sending logs. 

Each feed is a connection between the NSS and Log Collection Platform (LCP), which is a Security Information and Event Management (SIEM) system.

NSS Type

Choose NSS for Web or NSS for Firewall as per the requirement.

NSS Name

Select the NSS Virtual machine (VM) that collects logs from the cloud. Only one NSS VM can be mapped to a feed.

Status

Select Enabled. Note: You must select Enabled to activate the feed.

SIEM IP

Enter the LCP IP address to which the NSS Virtual Machine (VM) will send the logs.

SIEM TCP Port

The recommended port number is 601. However, you can enter any other port number for TCP communication.

The NSS Virtual machine will send the logs to the port number specified.

Note: Zscaler supports only TCP connection.

Log Type

 Select Web Log or Firewall Logs only. (Based on what NSS Type has selected)

Log Type of NSS alerts is not supported.

Feed Output Type

Select Custom.

Note: Collector supports only customized format.

Feed Output Format

You must use the following feed, as the collector supports the customized format only.

Web Log feed:

|ZSCALER|DATE|%s{mon} %d{dd} %02d{hh}:%02d{mm}:%02d{ss}|NSSFEEDIP|%s{nsssvcip}|CLIENTINTIP|%s{cintip}|RECORDID|%d{recordid}|LOGINNAME|%s{login}|PROTOCOL|%s{proto}|URL|%s{url}|HOST|%s{host}|ACTION|%s{action}|REASON|%s{reason}|RISKSCORE|%d{riskscore}|APPNAME|%s{appname}|APPCLASS|%s{appclass}|REQSIZE|%d{reqsize}|RESPSIZE|%d{respsize}|CTIME|%d{ctime}|URLCLASS|%s{urlclass}|SUPERCAT|%s{urlsupercat}|URLCAT|%s{urlcat}|MALWARECAT|%s{malwarecat}|MALWARECLASS|%s{malwareclass}|THREATNAME|%s{threatname}|FILETYPE|%s{filetype}|FILECLASS|%s{fileclass}|DLPENGINE|%s{dlpeng}|DLPDICT|%s{dlpdict}|BWTHROTTLE|%s{bwthrottle}|LOCATION|%s{location}|DEPARTMENT|%s{dept}|CLIENTIP|%s{cip}|DESTINATIONIP|%s{sip}|REQMETHOD|%s{reqmethod}|RESPCODE|%s{respcode}|USERAGENT|%s{ua}|REFERER|%s{referer}|MD5HASH|%s{bamd5}|DLPRULENAME|%s{dlprulename}|DLPMD5|%s{dlpmd5}|DLPIDENTIFIER|%d{dlpidentifier}|DLPDICTHITCOUNT|%s{dlpdicthitcount}|\n

Firewall Feed: ( if firewall feed subscription is available)

|ZSCALERFIREWALL|DATE|%s{mon} %d{dd} %02d{hh}:%02d{mm}:%02d{ss}|CLIENTIP|%s{csip}|RECORDID|%d{recordid}|LOGINNAME|%s{login}|PROTOCOL|%s{ipproto}|ACTION|%s{action}|DESTINATIONIP|%s{cdip}|SOURCEPORT|%d{csport}|DESTINATIONPORT|%d{cdport}|CLIENTTUNIP|%s{tsip}|CLIENTTUNPORT|%d{tsport}|LOCATION|%s{location}|DEPARTMENT|%s{dept}|DESTINATIONCOUNTRY|%s{destcountry}|INCOMINGBYTES|%ld{inbytes}|NETWORKAPP|%s{nwapp}|NETWORKSVC|%s{nwsvc}|RULELABEL|%s{rulelabel}|NATTING|%s{dnat}|SESSIONDURATION|%d{duration}|AGGREGATEDSESSION|%d{numsessions}|AVERAGEDURATION|%d{avgduration}|TUNNELTYPE|%s{ttype}|SERVERDESTPORT|%d{sdport}|SERVERSOURCEIP|%s{ssip}|SERVERSOURCEPORT|%d{ssport}|IPCAT|%s{ipcat}|\n

Note: The order of the fields must be in the same sequence as shown in the table. Do not change the key values, otherwise the collector may fail.

This feed includes all the important information produced by the Firewall log.

User Obfuscation

Select Disabled to display the login usernames in the output. Select Enabled to display random values instead of the usernames. 

It is required to select Disabled

Time Zone

Select the appropriate time zone. Default Time is GMT

Duplicate Logs

Specify the number of minutes that NSS will send duplicate logs. You can select the time based on your requirement.

This will be used if the LCP goes down, or in case of any network issue between the NSS Virtual Machine and LCP.

Example: if the LCP went offline at 6:29:00 p.m., the NSS detected the lost connection at 6:30:00 p.m., and the connection was restored at 6:40:00 p.m., So

If Duplicate Logs was set to five minutes, the NSS will resend the logs from 6:25:00 onward, after the connection is restored. It will send five minutes of duplicate logs.

If Duplicate Logs was disabled, the NSS will resend the logs from 6:30:01 onwards, after the connection gets restored

Transactions filters

There are various parameters available based on which you can actually filter the logs sent by NSS virtual machine to LCP. To see different filter sets, refer NSS guide. 

Configure SECURITY filter For WEB Logs : 

• Go to the Filter Section and select SECURITY

• Select Any for Malware Classes, Malware Names and Advanced Threat. By default - it will be NONE and will not forward threat based logs.

Open

Configure SECURITY filter For FW Logs : 

• Navigate to the Filter section and select SECURITY

• Select Any for Threat Name and Advanced Threat Category. By default - it will be NONE and will not forward threat based logs.

Property

Default Value

Description

 Protocol

TCP

Default protocol for syslog events.

Hostnames / IP Address

Zscaler Interface IP Address

Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ).

Note: If the device sends logs using multiple interfaces, contact the Accenture Security MDR onboarding team.

Signatures

|ZSCALER|,|ZSCALERFIREWALL|,zpa-lss:

MDR recommended signatures processed by the Zscaler Cloud Firewall  event collector.

Port

601

The default port for syslog.

Note: Please discuss with onboarding team if you have any technologies sending logs to CP with same port and protocol