Configure ZIA for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform URL-based response actions in your network using Zscaler Internet Access (ZIA).

ZIA supports these response actions:
  • Block a malicious URL

For more information, see Response action descriptions.

These resources are required:

  • A ZIA API subscription. For more information, see Viewing Subscriptions.
  • Administrator permissions for the Zscaler Experience Center.
Note: Arctic Wolf supports response actions using the Legacy API only.
  • Contact your CST to validate the Active Response integration. Have an external domain ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create a Zscaler user

Create a dedicated Zscaler user to configure Active Response with least privileges.

  1. Sign in to the Zscaler Experience Center.
  2. Go to Administration > Authentication > Directories > Users.
  3. Click Add User.
  4. Configure these settings:
    • Login ID — Enter a unique ID. Copy the value, and then save it in a safe, encrypted location. You will provide this value to Arctic Wolf later.
    • Status — Select Enabled.
    • Email — Enter a valid email address.
    • First Name — Enter a first name.
    • Last Name — Enter a last name.
  5. Click Next.
  6. Set the password according to your organization's policy and save the password in a safe, encrypted location. You will provide this value to Arctic Wolf later.
  7. Optional: Do not assign any groups.
  8. Click Save.

Create a custom administrator role

Create a custom administrator role that is scoped to the minimum permissions required for Active Response, and then assign your Zscaler user to the role.

  1. In the Zscaler Experience Center, go to Administration > Role Management > Internet & SaaS.
  2. Click Add Administrator Role.
  3. Configure these settings:
    • Name — Enter a descriptive name for the role.
    • Executive Insights — Disable all permissions.
    • Policy & Components — Set Security > Advanced Threat Protection to Full.
      Note: This is the only permission required for Active Response.
    • Other Permissions — Set all other options to None or View Only.
  4. Click Save.
  5. In the navigation menu, click Administration > Role Management > Administrative Entitlements.
  6. Click Zscaler Internet Access > Users tab.
  7. Click Assign Users.
  8. Select the user that you created in Create a Zscaler user.
  9. In the Role list, select the role that you created in this task.
  10. Click Next, and then click Assign.

Retrieve the ZIA base API key and instance name

  1. In the Zscaler Experience Center, go to Administration > API > Legacy API > Internet and SaaS API.
  2. If an API key does not exist, click Add API Key to generate one.
  3. Copy the API Key value, and then save it in a safe, encrypted location.

    You will provide it to Arctic Wolf later.

  4. In the top navigation, click Account Settings.
  5. Under Internet & SaaS Cloud, copy the instance name and then save it in a safe, encrypted location.
    You will provide this value to Arctic Wolf later as part of the base URL.

Provide ZIA Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click Zscaler Internet Access (ZIA).
  5. On the New Active Response Integration page, configure these settings:
    • Integration Name — Enter a unique and descriptive name for the integration, including the tenant name. For example, tenant_name ZIA Active Response Integration.

    • Base URL — Enter the base URL using the instance name from Retrieve the ZIA base API key and instance name, using this format: https://zsapi.instance_name.

      For example, if your instance name is zscalerone.net, your base url would be https://zsapi.zscalerone.net.

    • API Key — Enter the API key value from Retrieve the ZIA base API key and instance name.
    • Username — Enter the Login ID for the user that you created in Create a Zscaler user.
    • Password — Enter the password for the user that you created in Create a Zscaler user.
    • Sandbox Base URL — Leave this field empty.
    • Sandbox API key — Leave this field empty.
    • Ignore List Name — Leave this field empty.
  6. Click Save Integration.