> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-internet-access.md).

# Ingest logs from Zscaler Internet Access

{% hint style="info" %}

### Notice

Ingestion of logs and data requires a Cortex XDR Pro per GB license.
{% endhint %}

If you use Zscaler Internet Access (ZIA) in your network, you can forward your firewall and network logs to Cortex XDR for analysis. This enables you to take advantage of Cortex XDR anomalous behavior detection and investigation capabilities. Cortex XDR can use the firewall and network logs from ZIA as the sole data source, and can also use these firewall and network logs from ZIA in conjunction with Palo Alto Networks firewall and network logs. For additional endpoint context, you can also use Cortex XDR to collect and alert on endpoint data.

To integrate your logs, you first need to set up an applet in a broker VM within your network to act as a Syslog Collector. You then configure forwarding on your log devices to send logs to the Syslog collector in a **CEF** format. To provide seamless log ingestion, Cortex XDR automatically maps the fields in your traffic logs to the Cortex XDR log format.

As soon as Cortex XDR starts to receive logs, the app performs these actions.

* Begins stitching network connection and firewall logs with other logs to form network stories. Cortex XDR can also analyze your logs to raise Analytics alerts and can apply IOC, BIOC, and Correlation Rule matching. You can also use queries to search your network connection logs.
* Creates a Zscaler Cortex Query Language (XQL) dataset, which enables you to search the logs using XQL Search. The Zscaler XQL datasets are dependent on the ZIA NSS Feed that you've configured for the types of logs you want to collect.
  * Firewall logs: `zscaler_nssfwlog_raw`
  * Web logs: `zscalar_nssweblog_raw`

To ingest logs from Zscaler Internet Access (ZIA):

1. [Activate the Syslog Collector](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md).
2. Increase log storage for ZIA logs. For more information, see Manage Your Log Storage.
3. Configure NSS log forwarding in Zscaler Internet Access to the Syslog Collector in a **CEF** format.
   1. In the Zscaler Internet Access application, select **Administration** → **Nanolog Streaming Service**.
   2. In the **NSS Feeds** tab, **Add NSS Feed**.
   3. In the **Add NSS Feed** screen, configure the fields for the Cortex XDR Syslog Collector.

      The steps below differ depending on the type of NSS Feed you are configuring to collect either firewall logs or web logs. For more information on all the configurations available on the screen, see the ZIA documentation:

      * Firewall logs: See [Adding NSS Feeds for Firewall Logs](https://help.zscaler.com/zia/adding-nss-feeds-firewall-logs).
      * Web logs: See [Adding NSS Feeds for Web Logs](https://help.zscaler.com/zia/adding-nss-feeds-web-logs).

      The following image displays the fields required to add an NSS feed.

      ![zscaler\_add\_nss\_feed.png](/files/QFhwYZAAmAO6Teoxj6uo)

      * **NSS Type**: Select either **NSS for Web** (default) to collect web logs or **NSS for Firewall** to collect firewall logs.
      * **SIEM TCP Port**: Specify the port that you set when activating the Syslog Collector in Cortex XDR. See [Activate the Syslog Collector](#UUID-bea85cf8-1e15-a107-b0e5-830be9adfba9_N1669558051390).
      * **SIEM IP Address**: Specify the IP that you set when activating the Syslog Collector in Cortex XDR. See [Activate the Syslog Collector](#UUID-bea85cf8-1e15-a107-b0e5-830be9adfba9_N1669558051390).
      * **Feed Escape Character**: Specify the feed escape character as `=`.
      * **Feed Output Type**: Select **Custom**.
      * **Feed Output Format**: Specify the output format, which is dependent on the type of logs you are collecting as defined in the **NSS Type** field:

        | Log type      | Feed output format                                                 |
        | ------------- | ------------------------------------------------------------------ |
        | Firewall logs | \`%s{mon} %02d{dd} %02d{hh}:%02d{mm}:%02d{ss} zscaler-nss-fw CEF:0 |
        | Web logs      | \`%s{mon} %02d{dd} %02d{hh}:%02d{mm}:%02d{ss} zscaler-nss CEF:0    |
   4. Click **Save**.
   5. Click **Save** and activate the change according to the [Zscaler Internet Access (ZIA) documentation](https://help.zscaler.com/zia/saving-and-activating-changes-admin-portal).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-internet-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.