> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-private-access.md). # Ingest logs from Zscaler Private Access {% hint style="info" %} ### Notice Ingestion of logs and data requires a Cortex XDR Pro per GB license. {% endhint %} If you use Zscaler Private Access (ZPA) in your network as an alternative to VPNs, you can forward your network logs to Cortex XDR for analysis. This enables you to take advantage of Cortex XDR anomalous behavior detection and investigation capabilities. Cortex XDR can use the network logs from ZPA as the sole data source, and can also use these network logs from ZPA in conjunction with Palo Alto Networks network logs. As soon as Cortex XDR starts to receive logs, the following actions are performed: * Stitching network connection logs with other logs to form network stories. Cortex XDR can also analyze your logs to apply IOC, BIOC, and Correlation Rules matching. You can also use queries to search your network connection logs. * Creates a Zscaler Cortex Query Language (XQL) dataset (`zscaler_zpa_raw`), which enables you to search the logs using XQL Search. To integrate your logs, you first need to set up an applet in a Broker VM within your network to act as a Syslog Collector. You then configure forwarding on your log devices to send logs to the Syslog collector in a **LEEF** format. To provide seamless log ingestion, Cortex XDR automatically maps the fields in your traffic logs to the Cortex XDR log format. **Prerequisite Step** Before you can add a log receiver in Zscaler Private Access, as explained in the task below, you must first deploy your App Connectors. For more information, see [App Connector Deployment Guides for Supported Platforms](https://help.zscaler.com/zpa/app-connector-management/app-connector-deployment-guides-supported-platforms). To ingest logs from Zscaler Private Access (ZPA): 1. [Activate the Syslog Collector](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md). 2. Increase log storage for ZPA logs. For more information, see Manage Your Log Storage. 3. Configure ZPA log forwarding in Zscaler Private Access to the Syslog Collector in a **LEEF** format. 1. In the Zscaler Private Access application, select **Administration** → **Log Receivers**. 2. Click **Add Log Receiver**.

Note

For more information on configuring the parameters on the screen, see the Zscaler Private Access (ZPA) documentation for Configuring a Log Receiver.

3. In the **Add Log Receiver** window, configure the following fields on the **Log Receiver** tab: * **Name**: Specify a name for the log receiver. The name cannot contain special characters, with the exception of periods (.), hyphens (-), and underscores ( \_ ). * **Description**: (Optional) Specify a log receiver description. * **Domain or IP Address**: Specify the fully qualified domain name (FQDN) or IP address for the log receiver that you set when activating the Syslog Collector in Cortex XDR. See [Activate Syslog Collector](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md). * **TCP Port**: Specify the TCP port number used by the log receiver that you set when activating the Syslog Collector in Cortex XDR. See [Activate Syslog Collector](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md). * **TLS Encryption**: Toggle to **Enabled** to encrypt traffic between the log receiver and your Syslog Collector in Cortex XDRusing mutually authenticated TLS communication. To use this setting, the log receiver must support TLS communication. For more information, see [About the Log Streaming Service](https://help.zscaler.com/zpa/about-log-streaming-service#tlsencryption). * **App Connector Groups**: (Optional) Select the App Connector groups that can forward logs to the receiver, and click **Done**. You can search for a specific group, click **Select All** to apply all groups, or click **Clear Selection** to remove all selections. 4. Click **Next**. 5. Configure the following fields in the **Log Stream** tab: * **Log Type**: Select the log type you want to collect, where only the following logs types are currently supported to collect with your Syslog Collector in Cortex XDR:

Note

You can only configure a ZPA log receiver to collect one type of log with your Syslog Collector in Cortex XDR. To configure more that one log type, you'll need to add another log receiver.

* **User Activity**: Information on end user requests to applications. For more information, see [User Activity Log Fields](https://help.zscaler.com/zpa/about-user-activity-log-fields). * **User Status**: Information related to an end user's availability and connection to ZPA. For more information, see [User Status Log Fields](https://help.zscaler.com/zpa/about-user-status-log-fields). * **App Connector Status**: Information related to an App Connector's availability and connection to ZPA. For more information, see [About App Connector Status Log Fields](https://help.zscaler.com/zpa/about-connector-status-log-fields). * **Audit Logs**: Session information for all admins accessing the ZPA Admin Portal. For more information, See [About Audit Log Fields](https://help.zscaler.com/zpa/about-audit-log-fields) and [About Audit Logs](https://help.zscaler.com/zpa/about-audit-logs). * **Log Template**: Select a **Custom** template. * **Log Stream Content**: Create the log template that you require, according to the **Log Type** you've selected, using the Zscaler documentation mentioned in previous steps as a reference. If you copy and modify the following examples in the table below, validate your log template using an editor, ensuring that there are no additional spaces or line breaks, and then copy and paste it into the **Log Stream Content** field. | Log type | Log template | | -------------------- | ------------ | | User activity | \`LEEF:1.0 | | User status | \`LEEF:1.0 | | App connector status | \`LEEF:1.0 | | Audit logs | \`LEEF:1.0 | * (Optional) You can define a streaming **Policy** for the log receiver. This entails configuring the **SAML Attributes**, **Application Segments**, **Segment Groups**, **Client Types**, and **Session Statuses**. For more information on configuring these settings, see the [Log Stream instructions](https://help.zscaler.com/zpa/configuring-log-receiver#Step2). 6. Click **Next**. 7. In the **Review** tab, verify your log receiver configuration. 8. Click **Save**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-private-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.