Ship your Zscaler data straight into Cribl Lake without a Pipeline, bypassing Cribl Stream.

Use the Zscaler Direct Access option to land Zscaler Nanolog Streaming Service (NSS) data directly into Cribl Lake for search and analysis, without manually managing infrastructure. Zscaler NSS streams your security event logs to a Cribl Lake ingest endpoint over HTTP, using the Splunk HTTP Event Collector (HEC) format.

How Zscaler Direct Access Works ​

Zscaler Direct Access in Cribl consists of a few main steps. Here’s an overview of the steps you’ll complete in this guide:

1. Create a Lake Dataset to hold the Zscaler data.
2. In Cribl Lake, create a Zscaler Direct Access Source and generate an auth token.
3. In Zscaler NSS, create a Cloud NSS Feed that points to the Cribl Lake ingest endpoint.

Learn About the Implementation ​

The Zscaler Direct Access implementation has the following details:

• You can configure one Zscaler Source per Cribl Lake Workspace.
• You can have one Dataset per Source.
• Data flows directly from Zscaler NSS into Cribl Lake; it doesn’t pass through Cribl Stream.

Create a Zscaler Dataset ​

First, define a Dataset with a partition key. This allows Direct Access to pick up the correct information in order to save the Dataset.

1. In Cribl Lake, navigate to Datasets.
2. Select New Dataset.
3. Enter an ID.
4. Add a default retention period.
5. Select a data format. Selecting Parquet may result in smaller files, reducing total overall storage.
6. In Advanced, create a Lake Partition. Set the value to sourcetype.
7. Select Save.

For more detailed information on Datasets, see Cribl Lake Datasets.

Create a Zscaler Direct Access Source ​

Create the Source in Cribl Lake so that Cribl can provision the ingest endpoint that Zscaler NSS writes to.

1. In Cribl Lake, select Direct Access in the left navbar.
2. On the Source step, select Zscaler, then select Next.
3. On the Configuration step, enter the required fields:
   1. Add Datasets in the Direct Access Datasets drop-down.
   2. In the Auth tokens section, select Generate under Token.
   3. Copy the token value; you’ll paste it into the Zscaler Cloud NSS Feed configuration.
   4. Optionally, add a description and fields to events that reference the token.
   5. Select a Default Dataset this Source will reference.
4. Select Save. The Zscaler Source enters a Provisioning state while Cribl sets up infrastructure. Provisioning usually completes in a few minutes.
5. When the provisioning completes, open the Zscaler Direct Access Source to see the ingest URL.

Create a Cloud NSS Feed in Zscaler NSS ​

Set up a data stream in Zscaler NSS Cloud to send data to your Cribl Lake ingest endpoint. Before you start, ensure you have admin permissions in your Zscaler environment.

1. Log in to Zscaler.
2. In the left menu, select Administration, then Nanolog Streaming Service under Cloud Configuration.
3. Select the Cloud NSS Feeds tab, then select Add Cloud NSS Feed.
4. Enter the following Cloud NSS Feed configuration:
   • Add a Feed Name.
   • Set SIEM TYPE to Splunk.
   • Enter the API URL in the form https://default.<workspace>.<cribl_cloud_name>.cribl.cloud:<port>/services/collector, using the ingest URL from your Cribl Lake Zscaler Source.
   • Add two HTTP headers:
     • Authorization with the value of the token from the Cribl Lake Zscaler Direct Access Source.
     • Content-Encoding with the value gzip.
5. Scroll down, then select a Log Type.
6. Disable JSON Array Notation.
7. Select Save. The feed appears in the Cloud NSS Feed list.

Test the Connection ​

1. In Zscaler NSS, open the Cloud NSS Feed you created.
2. Select the Test Connectivity icon in the far-right column. You’ll see a success message at the top of the console.
3. In Cribl Lake, confirm that the test event lands in your Zscaler Dataset.

Provisioning Lifecycle ​

A Zscaler Direct Access Source will have one of these statuses after you select Save:

Query Zscaler Data with Cribl Search ​

Once your Zscaler data lands in Cribl Lake, your Zscaler Dataset is available in Cribl Search as a cribl_lake Dataset. For details on querying your data, see Search Cribl Lake.