Skip to main content
Flarehawk treats Zscaler as a Zero Trust + network provider on the Zero Trust Exchange:
  • ZIA (Internet Access) — web, firewall, DNS, and Client Connector / Z-Tunnel telemetry via Cloud NSS HTTPS JSON feeds
  • ZPA (Private Access) — user-to-application activity via the Log Streaming Service (LSS), forwarded over HTTPS to Flarehawk
  • OneAPI remediation (optional) — Zidentity client-credentials linking so Flarehawk can apply URL denylist and destination-IP firewall blocks in ZIA
Log ingest is push-based (no browser OAuth). Create a connection in Flarehawk to get destination URLs and an ingest token, then configure each Cloud NSS feed (and optional LSS HTTPS forwarder) in the Zscaler portals. Optionally paste Zidentity OneAPI credentials on the same connection to enable remediation.
Customer-facing connect is invite-only behind the PostHog flag provider_zscaler while the integration is in beta. Targeting is organization-group based (Vigilbase org only today), matching Okta / Auth0 staging pilots — not person email domain.

​
Prerequisites

  • Zscaler Internet Access with Cloud NSS entitlement (for web / firewall / DNS / tunnel)
  • Optional: Zscaler Private Access with LSS for User Activity, plus a small HTTPS forwarder from the App Connector TCP receiver
  • Optional for remediation: a Zidentity API Client (Client Credentials grant) with ZIA security / firewall policy access
  • Permission to add Cloud NSS feeds (ZIA) and/or LSS log receivers (ZPA)
  • A Flarehawk organization where the Zscaler integration is enabled

​
Connect Zscaler

1

Create the connection in Flarehawk

Open Connections → Add connection → Zscaler. Optionally enter a Zero Trust organization / ZIA cloud name (used as the asset identifier). Flarehawk creates the connection, issues an ingest token, and shows HTTPS destination URLs for each dataset.
2

Optional — link Zidentity OneAPI

Paste your Zidentity vanity domain, API client ID, and client secret (and OneAPI cloud if not production). Flarehawk mints tokens with the client_credentials grant — there is no browser login redirect. Leave these blank for ingest-only.
3

Add ZIA Cloud NSS feeds

In the ZIA Admin Portal, go to Logs → Log Streaming → Nanolog Streaming Service, then add a Cloud NSS Feed for Web, Firewall, DNS, and/or Tunnel.
4

Point ZIA feeds at Flarehawk

Set Feed Output Type to JSON. Prefer disabling JSON Array Notation so each delivery is one JSON object per line (NDJSON). Flarehawk also accepts JSON arrays and gzip-compressed bodies.
5

Authenticate ZIA feeds

Set each feed API URL to the matching Flarehawk ingest URL (for example …/zscaler/web_logs/<connection_id> or …/zscaler/dns_logs/<connection_id>). Add an HTTP header Authorization: Bearer <ingest_token>.
6

Optional — forward ZPA LSS User Activity

In the ZPA Admin Portal, configure an LSS receiver for User Activity with a JSON template. LSS delivers over TCP from an App Connector — run a forwarder that POSTs each JSON line to …/zscaler/zpa_user_activity/<connection_id> with the same Bearer token.
7

Confirm delivery

After feeds start streaming, open the connection in Flarehawk. Recent events appear under Logs and the Zscaler analytics overview once batches land.

​
Remediation

With OneAPI credentials linked, Flarehawk can suggest and apply: Rollbacks remove the denylist entry or delete the firewall rule / destination group, then activate again. Grant the Zidentity API Client access to ZIA security and firewall policy resources.

​
Datasets

All datasets use the network analysis family, so existing network detectors and the generic provider-events analytics surface apply without a separate Zscaler-only ruleset. Include at least:
  • Web: datetime, recordid, cip, login, host, url, reqmethod, stcode, action, rulelabel, urlcategory / threatname, cloudname
  • Firewall: datetime, recordid, srcip, dstip, login, action, nwsvc, rulelabel, zpa_app_seg_name, cloudname
  • DNS: datetime / time, recordid, cip, login, req, res, reqaction / resaction, reqrulelabel, domcat, cloudname
  • Tunnel: datetime, recordid, sourceip / cip, login, tunneltype, event, destvip, cloudname
  • ZPA User Activity: LogTimestamp, ConnectionID, Username, ClientPublicIP, Application, AppGroup, Host, ServerIP, ConnectionStatus, Policy, Customer

​
Troubleshooting

  • 401 / 403 on NSS test: Confirm the Bearer token matches the connection ingest token and the URL includes the correct connection id and dataset segment.
  • OneAPI token failures: Confirm vanity domain, client ID/secret, and cloud (production / beta / gov / govus). Legacy ZIA cloud names are not valid for OneAPI.
  • Remediation apply fails with permission errors: Expand the Zidentity API Client access policy to include ZIA security / firewall resources, then re-test the connection.
  • Events missing after a successful test: Confirm the feed is enabled and filters are not dropping all traffic. Check Flarehawk Logs for the connection asset.
  • JSON parse errors: Disable JSON Array Notation or keep it enabled — Flarehawk unwraps arrays. Prefer the Feed Escape Character guidance in Zscaler docs for special characters in string fields.
  • ZPA LSS not arriving: LSS is TCP to your App Connector path — Flarehawk only accepts HTTPS POSTs. Confirm the forwarder is posting NDJSON with the Bearer token to zpa_user_activity.