Splunk Enterprise Security

Which Data Model are need to update if I use Zscaler add-on

princemanto2580
Path Finder

Hello All,

I used the Splunk Add-on for Zscaler (https://splunkbase.splunk.com/app/3865/). But what are the data-model need to update in order to see the events IN ES (Enterprise Security) is missing in the documentation section.

It will really great if someone can help me by sharing this information.

0 Karma

dflodstrom
Builder

Have a look at this app's tags.conf. Check out the tag combinations listed for each eventtype and compare to what is required for each CIM data model. It looks like this app tags events to match the following data models: Authentication, Network Traffic, Web, Data Loss Prevention, Intrusion Detection, Malware, Network Session, Network Resolution, and Performance.

Before rebuilding every data model you might want to check the logs you're getting to see if every eventtype is being sent to Splunk and that the logs are being parsed/tagged properly.

This app is tagging by eventtype. `[eventtype=Zscaler_DNS]
dns = enabled
network = enabled
resolution = enabled

[eventtype=Zscaler_CFW]
communicate = enabled
network = enabled

[eventtype=Zscaler_Proxy_General]
communicate = enabled
end = enabled
network = enabled
performance = enabled
proxy = enabled
session = enabled
start = enabled
web = enabled

[eventtype=Zscaler_Proxy_Malware]
attack = enabled
ids = enabled
malware = enabled

[eventtype=Zscaler_Proxy_DLP]
dlp = enabled
incident = enabled

[eventtype=Zscaler_ZPA]
authentication = enabled
communicate = enabled
end = enabled
network = enabled
performance = enabled
session = enabled
start = enabled
vpn = enabled`

The tags required for each data model are listed here http://docs.splunk.com/Documentation/CIM/4.11.0/User/Howtousethesereferencetables

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...