{ "name": "zscaler_zpa", "title": "Zscaler Private Access", "version": "1.19.0", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from Zscaler Private Access (ZPA) with Elastic Agent.", "type": "integration", "download": "/epr/zscaler_zpa/zscaler_zpa-1.19.0.zip", "path": "/package/zscaler_zpa/1.19.0", "icons": [ { "src": "/img/zscaler-logo.svg", "path": "/package/zscaler_zpa/1.19.0/img/zscaler-logo.svg", "title": "Zscaler logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "network", "vpn_security" ], "signature_path": "/epr/zscaler_zpa/zscaler_zpa-1.19.0.zip.sig", "format_version": "3.0.3", "readme": "/package/zscaler_zpa/1.19.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/zscaler-zpa-screenshot.png", "path": "/package/zscaler_zpa/1.19.0/img/zscaler-zpa-screenshot.png", "title": "Zscaler ZPA app connector status dashboard screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/zscaler_zpa/1.19.0/LICENSE.txt", "/package/zscaler_zpa/1.19.0/changelog.yml", "/package/zscaler_zpa/1.19.0/manifest.yml", "/package/zscaler_zpa/1.19.0/validation.yml", "/package/zscaler_zpa/1.19.0/docs/README.md", "/package/zscaler_zpa/1.19.0/img/zscaler-logo.svg", "/package/zscaler_zpa/1.19.0/img/zscaler-zpa-screenshot.png", "/package/zscaler_zpa/1.19.0/kibana/tags.yml", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/manifest.yml", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/sample_event.json", "/package/zscaler_zpa/1.19.0/data_stream/audit/manifest.yml", "/package/zscaler_zpa/1.19.0/data_stream/audit/sample_event.json", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/manifest.yml", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/sample_event.json", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/manifest.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/sample_event.json", "/package/zscaler_zpa/1.19.0/data_stream/user_status/manifest.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_status/sample_event.json", "/package/zscaler_zpa/1.19.0/kibana/dashboard/zscaler_zpa-34f0b8a0-3a71-11ed-9e41-155bc0d23bc2.json", "/package/zscaler_zpa/1.19.0/kibana/dashboard/zscaler_zpa-3b709f70-3a98-11ed-9e41-155bc0d23bc2.json", "/package/zscaler_zpa/1.19.0/kibana/dashboard/zscaler_zpa-893ef040-3a88-11ed-9e41-155bc0d23bc2.json", "/package/zscaler_zpa/1.19.0/kibana/dashboard/zscaler_zpa-a0742450-3a89-11ed-9e41-155bc0d23bc2.json", "/package/zscaler_zpa/1.19.0/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/fields/base-fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/fields/beats.yml", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/fields/fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/audit/fields/base-fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/audit/fields/beats.yml", "/package/zscaler_zpa/1.19.0/data_stream/audit/fields/fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/fields/base-fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/fields/beats.yml", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/fields/fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/fields/base-fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/fields/beats.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/fields/fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_status/fields/base-fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_status/fields/beats.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_status/fields/fields.yml", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/agent/stream/tcp.yml.hbs", "/package/zscaler_zpa/1.19.0/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zpa/1.19.0/data_stream/audit/agent/stream/tcp.yml.hbs", "/package/zscaler_zpa/1.19.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/agent/stream/tcp.yml.hbs", "/package/zscaler_zpa/1.19.0/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/agent/stream/tcp.yml.hbs", "/package/zscaler_zpa/1.19.0/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zpa/1.19.0/data_stream/user_status/agent/stream/tcp.yml.hbs", "/package/zscaler_zpa/1.19.0/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "zscaler_zpa", "title": "Zscaler Private Access logs", "description": "Collect Zscaler Private Access logs.", "inputs": [ { "type": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Zscaler Private Access logs via TCP input", "description": "Collecting Zscaler Private Access logs via TCP input." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "zscaler_zpa.app_connector_status", "title": "App Connector Status Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9015 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zpa-app_connectors_status" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Private Access App Connector Status Logs", "description": "Collect Zscaler Private Access App Connector Status Logs using tcp input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "zscaler_zpa", "path": "app_connector_status" }, { "type": "logs", "dataset": "zscaler_zpa.audit", "title": "Audit Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9016 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zpa-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Private Access Audit Logs", "description": "Collect Zscaler Private Access audit logs using tcp input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "zscaler_zpa", "path": "audit" }, { "type": "logs", "dataset": "zscaler_zpa.browser_access", "title": "Browser Access Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9017 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zpa-browser_access" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Private Access Browser Access Logs", "description": "Collect Zscaler Private Access Browser Access Logs using tcp input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "zscaler_zpa", "path": "browser_access" }, { "type": "logs", "dataset": "zscaler_zpa.user_activity", "title": "User Activity Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9018 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zpa-user_activity" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Private Access User Activity Logs", "description": "Collect Zscaler Private Access User Activity Logs using tcp input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "zscaler_zpa", "path": "user_activity" }, { "type": "logs", "dataset": "zscaler_zpa.user_status", "title": "User Status Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9019 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zpa-user_status" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Private Access User Status Logs", "description": "Collect Zscaler Private Access User Status Logs using tcp input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "zscaler_zpa", "path": "user_status" } ] }