Device Integration: Zscaler NSS Web Logs & Firewall Logs

TABLE OF CONTENTS

• Overview
• Prerequisites
• Configuration Steps
  • Step 1 – Deploy NSS
  • Step 2 – Configure NSS for Web Logs
  • Step 3 – Configure NSS for Firewall Logs
  • Step 4 – Validate NSS Status
• Verification (MSSP Only)
  • On CCE Server
  • On ADR UI

Overview

Zscaler Nanolog Streaming Service (NSS) enables forwarding of web and firewall logs to an external syslog server. By integrating NSS with ADR SIEM, you gain centralized visibility into Zscaler traffic, security events, and policy actions for proactive threat detection.

Prerequisites

• Administrative access to Zscaler Admin Console.

• NSS subscription enabled (Web NSS or Firewall NSS).

• Deployed and running NSS VM (on-premises, Azure, AWS, or GCP).

• ADR CCE IP address reachable from NSS.

• UDP port 514 open for syslog traffic (or TCP/TLS if configured).

Configuration Steps

Step 1 – Deploy NSS

1. Download and deploy the NSS virtual machine from Zscaler Admin Portal (OVA/VHD/AMI).

2. Assign management IP, gateway, and DNS settings.

3. Confirm NSS can reach the ADR CCE IP.

Step 2 – Configure NSS for Web Logs

1. Log in to the Zscaler Admin Console.

2. Navigate to: Administration → Nanolog Streaming Service → NSS Feeds.

3. Select Add NSS Feed → Choose Web Logs.

4. Fill in the details:

   • Name → Seceon-Web-Logs.

   • Format → CEF (recommended for ADR).

   • Syslog Server → Enter ADR CCE IP.

   • Port → 514 (UDP).

   • Facility → Default or as per policy.

   • Log Types → Choose categories (URL filtering, Malware, DLP, Sandbox, etc.).

5. Save and commit changes.

Step 3 – Configure NSS for Firewall Logs

1. Again in NSS Feeds, click Add NSS Feed → Choose Firewall Logs.

2. Provide details:

   • Name → Seceon-Firewall-Logs.

   • Format → CEF.

   • Syslog Server → ADR CCE IP.

   • Port → 514 (UDP).

   • Facility → Default.

   • Log Types → Allow/Block traffic, Threats, VPN events.

3. Save and commit changes.

Step 4 – Validate NSS Status

1. In Admin Console → NSS Dashboard, ensure feeds show Connected/Running.

2. Generate some test traffic (web browsing, firewall rule hits) to confirm logs flow.

Verification (MSSP Only)

On CCE Server

Run tcpdump to confirm incoming logs:

sudo tcpdump -i any port 514 and host <NSS_IP> -s0 -AAA

On ADR UI

1. Log in with administrative rights.

2. Navigate to: System → Logs and Flows Collection Status.

3. Verify that the NSS source IP appears under Source Device IP.