Configure ZIA for Arctic Wolf monitoring — Cloud

You can configure Zscaler Internet Access (ZIA)® to send the necessary logs to Arctic Wolf® for security monitoring.

These resources are required:

  • A Zscaler administrator account that can create and modify Cloud NSS feeds
  • A Cloud NSS subscription
  • After creating a Cloud NSS feed for each log type, notify your CST that you have completed configuration.

Get the webhook token and URL

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Data Collection > Cloud Sensors.
  3. Click Add Account +.
  4. On the Add Account page, click Zscaler ZIA.
  5. In the Name field, enter a unique and descriptive for the account.
  6. Click Generate Token.
  7. Copy the webhook token and webhook URL to a safe, encrypted location to provide to Zscaler in Create Cloud NSS feeds.
    Note: If you lose the webhook token, you must generate a new one. For more information, see Generate a new webhook token.

Create Cloud NSS feeds

You must configure a Cloud NSS feed for all web and firewall log types. Repeat this procedure to create a Cloud NSS feed for admin audit, web log, and firewall logs.

Note: You must use the same webhook URL and webhook token for each Cloud NSS feed that you configure.
  1. Sign in to the Zscaler Cloud Portal.
  2. On the Administration tab, in the Cloud Configuration section, click Nanolog Streaming Service.
  3. Click the Cloud NSS Feeds tab.
  4. Click Add Cloud NSS Feed.
  5. In the General section, configure these settings:

    • Feed Name — Enter a unique and descriptive name for the feed.

    • NSS Type — Select the NSS type for the feed that you are configuring. For example, select NSS for Web or NSS for Firewall.

    • Status — Select Enabled.
    • SIEM Rate — Select Unlimited.
  6. In the SIEM Connectivity section, configure these settings:

    • SIEM Type — Select Other.

    • OAuth 2.0 Authentication — Make sure that the toggle is in the off position.
    • Max Batch Size — Make sure that the value is 512 KB.

    • API URL — Enter the webhook URL from Get the webhook token and URL.

    • Key 1 — Enter Authorization.

    • Value 1 — Enter the webhook token from Get the webhook token and URL with the format Bearer <token>.

  7. In the Formatting section, configure these settings:

    • Log Type — Select the log type for the feed that you are configuring. For example, select Admin Audit, Web Log, or Firewall Logs.

    • Feed Output Type — Select JSON.
    • JSON Array Notation — Make sure that the toggle is in the on position.
    • Feed Escape Character — Make sure that ,\" displays in the field.
  8. Click Save.
  9. Next to the feed that you just created, click the cloud icon.
    A message should display Test Connectivity Successful : OK (200).
    Note: If an error message displays, make sure that the Cloud NSS feed configuration settings are accurate. If you could not resolve the error, take a screenshot and notify your Concierge Security® Team (CST).
  10. Repeat this procedure for each log type.