---
title: "Zscaler Internet Access"
slug: "zscaler-zia"
updated: 2026-03-10T00:17:35Z
published: 2026-03-10T00:17:35Z
canonical: "docs.databee.buzz/zscaler-zia"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Zscaler Internet Access

Zscaler Internet Access is a cloud-based secure services edge (SSE) solution that provides secure access to the internet, regardless of their location or device. It offers advanced features such as web filtering, threat protection, data loss prevention (DLP), and SSL inspection to protect against web-based threats and enforce security policies.

**Integration Method**: S3, HTTP Collector (CloudNSS)

**Tables**: Detection Finding (2004), Data Security Findings(2006), HTTP Activity (4002), DNS Activity (4003), Network Activity (4001), Authentication (3002)

| Event | Description |
| --- | --- |
| Web Security Finding | Web security findings such as malware detection, threat detection, and risky activity |
| Web Log | All web traffic logs including allowed and blocked traffic. |
| Firewall Log | Firewall traffic logs including allowed and blocked traffic. |
| DLP Security Finding | DLP engine's detection of a policy match. |
| DNS Log | DNS traffic logs including allowed and blocked traffic. |
| SaaS Security Activity | SaaS security activities such as data access, sharing, and policy violations. |

## Integration

DataBee ingests ZIA web, firewall, DNS and DLP events via CloudNSS.

ZIA supports two ways of sending events using CloudNSS

- Pushing logs via HTTP/s.
- S3 bucket

DataBee supports both methods

### Sending logs from Zscaler via HTTP/s

Zscaler can send logs directly to DataBee via webhook.

#### DataBee Configuration

In this step, we will get the URL and tokens for Zscaler to use when sending events to DataBee.

The high level steps are:

1. Add a Zscaler Data Source with JSON formatted logs
2. Get Authorization token, DatasourceID and TenantID

Detailed steps can be found at [https://docs.databee.buzz/docs/http-collector](https://docs.databee.buzz/docs/http-collector)

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/Screenshot 2026-03-09 at 4.42.46 PM.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)
2. Search for Zscaler Internet Access and select it

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image(464).png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)
3. Select the HTTP Collector ingest option

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/Screenshot 2026-03-09 at 4.46.42 PM.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)
4. Enter a name and contact information of the owner.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image(466).png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)
5. Choose the **json** format and leave the other options as is. Click on **Generate New API Key** and copy the **Endpoint URL, TenantID and API Key**. It will be used later when configuring Zscaler. Click **Submit** when done

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/Screenshot 2026-03-09 at 4.54.16 PM.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)
6. Back in the Data Feeds tab, look for the configured feed card and click on it. Copy the datasource id. It will be used later.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/Screenshot 2026-03-09 at 4.58.55 PM.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

#### Zscaler Configuration (HTTP/s)

We will need to configure ZIA to send logs to the DataBee HTTP collector.

1. Log into the Zscaler console as an Administrator
2. Navigate to the **Administration** button on the left and click on **Nanolog Streaming Service**

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-p8uu8jfp.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

1. Click on the **Cloud NSS** tab and Add a new feed.
2. Enter the following details:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/Screenshot 2026-03-09 at 5.05.15 PM.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)
  - SIEM type: **Other**
  - API URL: Enter the DataBee Endpoint URL found in the previous step
  - Add the following headers
    - Authorization: <API Key>
    - DatasourceID: <Datasource ID>
    - TenantID: <Tenant ID>
3. Set **Feed Output Type** as **JSON,** enable the **JSON Array Notation** and enter ,\” as the **Feed Escape Character**

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image(468).png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

### Sending logs from Zscaler via S3

Sending logs using S3 will require the proper roles and permissions to be set up on AWS.

#### AWS Configuration

S3 setup is only required if this is a destination of choice for CloudNSS. If CloudNSS sends logs directly to the DataBee’s HTTP endpoint, this step can be skipped.

The integration of Cloud NSS and Amazon S3 provides long-term log retention, preprocessing of log data before ingestion, and compatibility with analytics solutions that can easily read log data from S3 buckets.

##### Create a User Group in AWS IAM

To create an AWS IAM user group:

1. Log in to the AWS Management Console.

2. In the search bar, enter IAM and select IAM.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-643uierz.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

3. In the left-side navigation, go to **Access Management > User groups**.

![A screenshot of a screen Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-rzg8dwl8.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

4. Click Create group. The Create user group page appears.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-ys4vvkb2.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

5. On the Create user group page, create a user group:

a. Enter a name for the user group (e.g., Zscaler_Group_Test).

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-dcvu9xui.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

b. Skip the options to add users and attach permissions policies.

c. Click Create group. You are redirected to the User groups page and a success message appears.

Create a User and Access Key in AWS IAM

To create a user and access key in AWS IAM:

1. In the left-side navigation of IAM, go to **Access Management > Users**.

![A screenshot of a screen Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-z50cwwcf.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

2. Click Add users. The Create user wizard appears.

![A screenshot of a web page Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-y3btmwdx.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

3. In the Create user wizard, create a user:

a. Enter a user name (e.g., Zscaler_User_Test), then click Next.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-gi6i2cws.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

b. Add the user to the newly created user group (e.g., Zscaler_Group_Test), then click next. ![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-4e93esiq.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

c. Review your choices, then click Create user.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-5pegar1g.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

You are redirected to the Users page and a success message appears.

4. Click View user in the success message, or use the search bar to find the user by name, then select the new user. ![A screenshot of a web page Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-bj8li2cv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

5. On the Summary page for the newly created user, scroll down and click the Security credentials tab. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-m2a6c9ba.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

6. On the Security credentials tab, scroll down to the Access keys section and click Create access key. The Create access key wizard appears.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-cdltja8r.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

7. In the Create access key wizard, create an access key:

a. Select a use case, then click Next.

![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-pj7y7ux8.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

b. Click Create access key.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-go5fqjyd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

A success message appears.

c. Click Download .csv file to download and save a CSV file containing the access key ID and secret access key required for creating a Cloud NSS feed in the ZIA Admin Portal.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-orwgmh1y.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

Create an S3 Bucket and Folder in Amazon S3

To create an S3 bucket and folder in Amazon S3:

1. In the search bar at the top of the screen, enter S3 and select S3.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-wlmrrdvv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

2. In the left-side navigation, go to Buckets.

![A screenshot of a phone Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-80vj1p4z.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

3. Click Create bucket. The Create bucket page appears.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-m426aq2f.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

4. On the Create bucket page, create a bucket:

a. Enter a name for the bucket (e.g., zscaler-bucket-test). The bucket name is part of its Amazon Resource Name (ARN), which is required for creating a policy in AWS.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-pw9suuox.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

b. Select your AWS Region. The region is part of the URL required for creating a Cloud NSS feed in the ZIA Admin Portal.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-1jsccxol.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

c. (Optional) Maintain the default configurations for the remaining settings (e.g., Bucket Versioning, Default encryption, etc.).

d. Click Create bucket.

You are redirected to the Buckets page and a success message appears.

5. Click View details in the success message, or use the search bar to find the bucket by name, then select the new bucket.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-lypc5rvg.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

6. On the Objects tab of the bucket page, click Create folder. The Create folder page appears. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-bt48mw5z.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

7. On the Create folder page, create a folder:

a. Enter a Folder name (e.g., logs-test).

![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-rcikrp6b.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

b. Maintain the default Server-side encryption settings and click Create folder.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-8z6w2clu.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

You are redirected to the bucket page and a success message appears.

8. Select the folder and click Copy URL. Save the URL (e.g., [https://zscaler-bucket-test.s3.us-west-2](https://zscaler-bucket-test.s3.us-west-2/). amazonaws.com/logs-test/) required for creating a Cloud NSS feed in the ZIA Admin Portal. The name of your region (e.g., us-west-2) must be present in the URL.

![A screenshot of a web page Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-83k7a01v.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

9. Click the Properties tab, then copy and save the ARN (e.g., arn:aws:s3:::zscaler-bucket-test) required for creating a policy in AWS.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-jl46i5e6.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

Create a Policy Granting the User Group Access to the S3 Bucket in Amazon IAM

A policy is a JSON document in AWS that specifies who has access to AWS resources and what actions they can perform on those resources. You can attach a policy to an identity (e.g., user group) or resource (e.g., S3 bucket) to define its permissions.

To integrate with Cloud NSS, the user group (e.g., Zscaler_Group_Test) needs permission to perform the PutObject action on the S3 bucket (e.g., zscaler-bucket-test). The PutObject action adds an object to a bucket. The user must have WRITE permissions to perform the PutObject action..

To create a policy granting the user group PutObject access to the S3 bucket:

1. Go to the IAM Management Console.

2. In the left-side navigation, go to **Access management > Policies**.

3. Click Create policy. The Create policy wizard appears.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-ygqhqfek.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

4. In the Create policy wizard, create a policy:

a. Click the JSON tab.

![A white background with black text Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-2la5cvgj.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)b. In the JSON editor, write a policy that allows PutObject access to the S3 bucket (e.g., zscaler-bucket-test). See the following example.

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "PutObjectActions", "Effect": "Allow", "Action": [

"s3:PutObject"

],

"Resource": [

"arn:aws:s3:::zscaler-bucket-test/*"

]

}

]

}

c. Click Next: Tags.

d. Click Next: Review.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-xbhgv7bn.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D) e. Enter a name for the policy (e.g., zscaler_policy_test).

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-ulklmhmd.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

f. Review the policy Summary information and click Create policy.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-0ub88271.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

You are redirected to the Policies page and a success message appears.

5. Attach the policy to the newly created user group:

a. Click the link in the success message, or use the search bar to filter the policies by name, then select the new policy (e.g., zscaler_policy_test). The policy Summary page appears.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-s4dzo1xg.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

b. On the policy Summary page, click the Policy usage tab, then click Attach. The Attach policy page appears.

![A screenshot of a web page Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-g3w99lew.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

c. On the Attach policy page, search for and select the newly created user group (e.g., zscaler_group_test), then click Attach policy.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-ouh1aqvx.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

You are redirected to the Summary page, which shows the user group (e.g., zscaler_group_test) under Permissions.

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-rtdk88as.jpg?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

### Zscaler Configuration (S3)

Log in to the Zscaler console as an Administrator and go to Nanolog Streaming Service

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-2vk5x219.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

Go to the **Cloud NSS Feeds** tab and add a new destination

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/zscaler-integration-guide-image-dd5qxd5v.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A38%3A39Z&se=2026-10-30T12%3A38%3A39Z&sr=c&sp=r&sig=0Vq4Wkn0ZtsAZwqCmTp7Gu2UYB%2BWg3njw4AD%2F7FsOwE%3D)

See [Adding Cloud NSS Feeds](https://help.zscaler.com/zia/adding-cloud-nss-feeds) and select the type of feed (e.g., Web Logs, Firewall Logs, DNS Logs etc.) that you want to configure. The following fields require specific inputs:

• SIEM Type: Select **S3**.

• AWS Access Id: Enter the access key ID for the user created in AWS.

• AWS Secret Key: Enter the secret access key for the user created in AWS.

• Max Batch Size: This field shows the default maximum batch size for the log type (e.g., 32 MB for Web Log, 8 MB for Tunnel, etc.). Optionally, you can enter a value between 1 MB and 32 MB.

• S3 Folder URL: Enter the URL of the folder created in the S3 bucket (e.g., [https://zscaler-bucket-test](https://zscaler-bucket-test/).s3.us-west-2.amazonaws.com/logs-test/).

• Feed Output Type: Select JSON.

• Feed Escape Character: Enter ,\".

• Feed Output Format: Zscaler recommends adding "time":"%d{epochtime}" to the Feed Output Format.

####