Setting Up Integrations

Share

Is this article helpful?

Last updated:

Zscaler Integration Guide for Real-Time Coaching

In this article, you'll learn how to integrate Zscaler Web Proxy with Real-Time Coaching. Once you set up this integration, data from Zscaler will be available in the Coaching tab of your KnowBe4 Security Awareness Training (SAT) console. This data can be viewed in Real-Time Coaching reports and used to create detection rules for Real-Time Coaching categories. For general information about Real-Time Coaching, see our overview article.

Important:To configure the Zscaler integration, you'll need access to a Zscaler admin account.

Tip:Real-Time Coaching also supports integrating Zscaler as a Splunk vendor. If your organization uses Splunk for security information and event management, we recommend integrating through Splunk instead by following our Splunk Integrations Guide.

Set Up the Integration in Real-Time Coaching

Before you can set up this integration in your Zscaler console, you must authorize the configuration and copy your organization key from the Coaching tab of your KnowBe4 SAT console. If you are using a Cloud Nanolog Streaming Service (NSS) Zscaler server for the integration, you'll also need to copy your API key.

To locate and copy your organization key and API key, follow the steps below:

  1. Log in to your KnowBe4 SAT console.
  2. Navigate to Coaching > Setup > Security Vendor Integrations.
  3. Locate the Zscaler vendor tile and select Configure.
  4. From the Select Zscaler Server drop-down menu, select your server.
  5. Select Authorize.
  6. In the modal that opens, select OK.

  7. Copy and save your Organization Key. If you selected Zscaler Cloud NSS in step 4 above, also copy and save your API Gateway Key.

    Note: These keys are needed to set up the integration in Zscaler.

Set Up the Integration in Zscaler

Once you've copied the needed keys from Real-Time Coaching, you can set up the Nanolog Streaming Service (NSS) or Cloud NSS integration in your Zscaler console by following the subsections below.

Note:NSS does not support Transport Layer Security (TLS). This means that the NSS integration will send events in plain text. However, Cloud NSS does offer an HTTPS endpoint that supports TLS.

Set Up the Nanolog Streaming Service (NSS) Integration in Your Zscaler Console

Once you've copied your organization key, you can set up the NSS integration in your Zscaler console by following the steps below:

  1. Log in to your Zscaler Admin Portal.
  2. Navigate to Administration > Nanolog Streaming Service.

  3. Select the pencil icon to update the NSS feed.

    Zscaler NSS Feed pencil icon

  4. On the Edit NSS Feed page, edit the fields using the screenshot and list below:Edit NSS Feed
    1. SIEM Destination Type: Select FQDN.

    2. SIEM FQDN: Enter the fully-qualified domain name (FQDN) for your KnowBe4 instance into the field. To find the FQDN for your KnowBe4 instance, see the table below:

      KnowBe4 Instance FQDN
      United States syslog.training.knowbe4.com
      European Union syslog.eu.knowbe4.com
      Canada syslog.ca.knowbe4.com
      United Kingdom syslog.uk.knowbe4.com
      Germany syslog.de.knowbe4.com
    3. SIEM TCP Port: Update the field value to "5000".
    4. Feed Output Type: Select Custom.

    5. Feed Output Format: Copy and paste the code block below into this field. Then, replace [x] with your organization key:

      Note:When pasting the code block, ensure the text is one single line. Besides adding your organization key, do not make any other changes to the code block.
      zscaler-nss CEF:0|Zscaler|NSS|4.1|NULL|NULL|NULL|org_key=[x]\tvendor_code_name=zscaler\tlog_type=web\tcat=%s{action}\tdevTime=%s{mon} %02d{dd} %d{yy} %02d{hh}:%02d{mm}:%02d{ss} %s{tz}\tdevTimeFormat=MMM dd yyyy HH:mm:ssz\tsourceAddress=%s{cip}\tdst=%s{sip}\trealm=%s{location}\tusrName=%s{login}\tsrcBytes=%d{reqsize}\tpolicy=%s{reason}\trecordid=%d{recordid}\thostname=%s{ehost}\tappproto=%s{proto}\turlcategory=%s{urlcat}\tappclass=%s{appclass}\tappname=%s{appname}\tmalwareclass=%s{malwareclass}\tthreatname=%s{threatname}\tdlpdict=%s{dlpdict}\tdlpeng=%s{dlpeng}\tfiletype=%s{filetype}\turl=%s{eurl}\tdevicehostname=%s{devicehostname}\n
    6. User Obfuscation: Select Disabled.
    7. Timezone: Select GMT from the drop-down menu.
    8. Duplicate Logs: Select Disabled from the drop-down menu.
    9. Policy Action: Select Blocked from the drop-down menu.
    10. Policy Reason: Select Any from the drop-down menu.
  5. Select Save.

  6. Next, locate your public IP address for your NSS VM by logging into it and running the following command:

    [zsroot@NSS ~]$ curl ipinfo.io/ip
  7. Copy the IP address that is generated.

  8. Submit a support ticket Submit a support ticket (link opens in new window) to KnowBe4 that includes your NSS VM IP Address. A member of our support team will whitelist your IP address and ensure that Zscaler has been successfully integrated.

    Important:If your NSS VM IP address ever changes, reach out to support again so they can whitelist your new IP address.

Set Up the Cloud Nanolog Streaming Service (NSS) Integration in Your Zscaler Console

Once you've copied your organization key and API key, you can set up the Cloud NSS integration in your Zscaler console. To set up the Cloud NSS integration in your Zscaler console, follow the steps below:

  1. Log in to your Zscaler Admin Portal.
  2. Navigate to Administration > Nanolog Streaming Service.
  3. Select the pencil icon to update the Cloud NSS feed.
  4. On the Edit Cloud NSS Feed page, edit the fields using the screenshot and list below:
    1. SIEM Type: Select Other.

    2. API URL: Enter the URL for your KnowBe4 instance into the field. To find the URL for your KnowBe4 instance, see the table below:

      KnowBe4 Instance URL
      United States https://syslog-webhook.training.knowbe4.com/v1/syslog
      European Union https://syslog-webhook.eu.knowbe4.com/v1/syslog
      Canada https://syslog-webhook.ca.knowbe4.com/v1/syslog
      United Kingdom https://syslog-webhook.uk.knowbe4.com/v1/syslog
      Germany https://syslog-webhook.de.knowbe4.com/v1/syslog
    3. Key1: Enter "x-api-key" into the field.
    4. Value1: Enter your API key into the field.
    5. Feed Output Type: Select JSON.

    6. Feed Output Format: Copy and paste the code block below into this field. Then, replace [x] with your organization key:

      Note:When pasting the code block, ensure the text is one single line. Besides adding your organization key, do not make any other changes to the code block.
      \{"sourcetype": "zscalernss-web","org_key":"[x]","vendor_code_name":"zscaler","log_type":"web","cat":"%s{action}","devTime":"%s{mon} %02d{dd} %d{yy} %02d{hh}:%02d{mm}:%02d{ss} %s{tz}","devTimeFormat":"MMM dd yyyy HH:mm:ssz","policy":"%s{reason}","recordid":"%d{recordid}","malwareclass":"%s{malwareclass}","urlcategory":"%s{urlcat}","realm":"%s{location}","sourceAddress":"%s{cip}","srcBytes":"%d{reqsize}","usrName":"%s{login}","url":"%s{eurl}","hostname":"%s{ehost}","appproto":"%s{proto}","threatname":"%s{threatname}","filetype":"%s{filetype}","appclass":"%s{appclass}","appname":"%s{appname}","dlpeng":"%s{dlpeng}","dlpdict":"%s{dlpdict}","devicehostname":"%s{devicehostname}"\}
    7. Timezone: Select GMT from the drop-down menu.
    8. Policy Action: Select Blocked from the drop-down menu.
    9. Policy Reason: Select Any from the drop-down menu.
  5. Select Save.

Map Your Users

After you've finished integrating Zscaler, you can map your users either through mapping rules (recommended) or through a CSV file upload. For more information about user mapping, see our user mapping article.

Manage Detection Rules

Once you've successfully authorized this integration, you can also manage Zscaler detection rules from Coaching > Detection Rules. For a full list of available system detection rules for this vendor, see our System Detection Rules by Vendor article.

Delete the Integration in Zscaler

For more information on deleting your Zscaler integration, see the subsections below.

Delete the Nanolog Streaming Service (NSS) Integration

To delete the NSS integration in your Zscaler console, follow the steps below:

  1. Log in to your Zscaler Admin Portal.
  2. Navigate to Administration > Nanolog Streaming Service.
  3. Select NSS Feeds.

  4. Locate the fully-qualified domain name (FQDN) you want to remove. To find the FQDN for your KnowBe4 instance, see the table below:

    KnowBe4 Instance FQDN
    United States syslog.training.knowbe4.com
    European Union syslog.eu.knowbe4.com
    Canada syslog.ca.knowbe4.com
    United Kingdom syslog.uk.knowbe4.com
    Germany syslog.de.knowbe4.com

  5. Select the pencil icon.

  6. Select Delete, then select Confirm.

Delete the Cloud Nanolog Streaming Service (NSS) Integration

To delete the Cloud NSS integration in your Zscaler console, follow the steps below:

  1. Log in to your Zscaler Admin Portal.
  2. Navigate to Administration > Nanolog Streaming Service.
  3. Select the Cloud NSS Feeds subtab.

  4. Locate the fully-qualified domain name (FQDN) you want to remove. To find the FQDN for your KnowBe4 instance, see the table below:

    KnowBe4 Instance FQDN
    United States syslog.training.knowbe4.com
    European Union syslog.eu.knowbe4.com
    Canada syslog.ca.knowbe4.com
    United Kingdom syslog.uk.knowbe4.com
    Germany syslog.de.knowbe4.com

  5. Select the pencil icon.

  6. Select Delete, then select Confirm.

Was this article helpful?

2 out of 2 found this helpful

Can't find what you're looking for?

Contact Support