Details
| ID | Zscaler_Private_Access_ModelingRule |
|---|---|
| From Version | 6.8.0 |
| To Version | 6.9.9 |
| Tags | Zscaler Private Access |
Rules (XIF)
[MODEL:model="Network", dataset="zscaler_zpa_raw"]
filter cat in ("ZPA User Status", "ZPA User Activity")
| alter XDM.Network.rule = policy ,
XDM.Network.Destination.port = dstPort,
XDM.Network.event_timestamp = _time,
XDM.Network.Destination.ipv4=dst,
XDM.Network.observation_timestamp = _insert_time,
XDM.Network.Source.ipv4 = src,
XDM.Network.Observer.vendor=_vendor,
XDM.Network.Observer.product=_product,
XDM.Network.Source.user.username = usrName ,
XDM.Network.Observer.name = Connector,
XDM.Network.application_protocol_category=AppGroup ,
XDM.Network.Observer.unique_identifier=ClientZEN,
XDM.Network.session_context_id =SessionID,
XDM.Network.reason=InternalReason ,
XDM.Network.Destination.host.hostname = ApplicationName ,
XDM.Network.outcome=ConnectionStatus,
XDM.Network.tls.cipher=DoubleEncryption ,
XDM.Network.Source.location.country=ClientCountryCode ,
XDM.Network.Source.host.hostname= identHostName ,
XDM.Network.Source.agent.identifier=ConnectionID ,
XDM.Network.original_event_type = cat,
XDM.Network.tls.client_certificate.subject=CertificateCN,
XDM.Network.original_event_sub_type = ApplicationSegment,
XDM.Network.Source.host.ipv4_addresses= arraycreate(coalesce(srcPreNAT, "")),
XDM.Network.application_protocol = to_string (proto),
XDM.Network.Source.host.hostname=identHostName,
XDM.Network.duration = to_integer(PolicyProcessingTime),
XDM.Network.Source.location.geo=concat("lat: ", to_string(ClientLatitude), " lon: ", to_string(ClientLongitude)),
XDM.Network.Destination.process.name=ApplicationName;
[MODEL:model="Audit", dataset="zscaler_zpa_raw"]
filter cat in ("Connector Status")
| alter XDM.Audit.event_timestamp=_time,
XDM.Audit.observation_timestamp =_insert_time,
XDM.Audit.original_event_id =_id,
XDM.Audit.original_event_type=cat,
XDM.Audit.TriggeredBy.agent.version =Version,
XDM.Audit.audited_resource_before.name =Connector,
XDM.Audit.audited_resource.type =cat,
XDM.Audit.cloud_provider=ZEN,
XDM.Audit.TriggeredBy.ipv4 =_final_reporting_device_ip,
XDM.Audit.audited_resource_before.parent_id =Customer,
XDM.Audit.TriggeredBy.location.geo =concat("lat: ", to_string(ClientLatitude), " lon: ", to_string(ClientLongitude)),
XDM.Audit.session_context_id =SessionID,
XDM.Audit.TriggeredBy.location.country =CountryCode,
XDM.Audit.audited_resource_before.type =SessionType;
Schema
zscaler_zpa_raw
| Field | Type | Array? |
|---|---|---|
AppGroup |
string | — |
ApplicationName |
string | — |
ApplicationSegment |
string | — |
CertificateCN |
string | — |
ClientCountryCode |
string | — |
ClientLatitude |
string | — |
ClientLongitude |
string | — |
ClientZEN |
string | — |
ConnectionID |
string | — |
ConnectionStatus |
string | — |
Connector |
string | — |
CountryCode |
string | — |
Customer |
string | — |
DoubleEncryption |
string | — |
InternalReason |
string | — |
Platform |
string | — |
PolicyProcessingTime |
string | — |
SessionID |
string | — |
SessionStatus |
string | — |
SessionType |
string | — |
Version |
string | — |
ZEN |
string | — |
_final_reporting_device_ip |
string | — |
_id |
string | — |
_insert_time |
datetime | — |
_product |
string | — |
_time |
datetime | — |
_vendor |
string | — |
cat |
string | — |
dst |
string | — |
dstBytes |
int | — |
dstPort |
int | — |
identHostName |
string | — |
policy |
string | — |
proto |
string | — |
src |
string | — |
srcBytes |
int | — |
srcPreNAT |
string | — |
usrName |
string | — |
Raw JSON
{ "zscaler_zpa_raw": { "policy": { "type": "string", "is_array": false }, "dstPort": { "type": "int", "is_array": false }, "_time": { "type": "datetime", "is_array": false }, "_insert_time": { "type": "datetime", "is_array": false }, "dst": { "type": "string", "is_array": false }, "src": { "type": "string", "is_array": false }, "_vendor": { "type": "string", "is_array": false }, "_product": { "type": "string", "is_array": false }, "usrName": { "type": "string", "is_array": false }, "Connector": { "type": "string", "is_array": false }, "AppGroup": { "type": "string", "is_array": false }, "ClientZEN": { "type": "string", "is_array": false }, "SessionID": { "type": "string", "is_array": false }, "InternalReason": { "type": "string", "is_array": false }, "ApplicationName": { "type": "string", "is_array": false }, "ConnectionStatus": { "type": "string", "is_array": false }, "DoubleEncryption": { "type": "string", "is_array": false }, "ClientCountryCode": { "type": "string", "is_array": false }, "identHostName": { "type": "string", "is_array": false }, "ConnectionID": { "type": "string", "is_array": false }, "cat": { "type": "string", "is_array": false }, "CertificateCN": { "type": "string", "is_array": false }, "ApplicationSegment": { "type": "string", "is_array": false }, "srcPreNAT": { "type": "string", "is_array": false }, "ClientLatitude": { "type": "string", "is_array": false }, "ClientLongitude": { "type": "string", "is_array": false }, "PolicyProcessingTime": { "type": "string", "is_array": false }, "proto": { "type": "string", "is_array": false }, "srcBytes": { "type": "int", "is_array": false }, "dstBytes": { "type": "int", "is_array": false }, "Platform": { "type": "string", "is_array": false }, "SessionStatus": { "type": "string", "is_array": false }, "_id": { "type": "string", "is_array": false }, "Version": { "type": "string", "is_array": false }, "ZEN": { "type": "string", "is_array": false }, "Customer": { "type": "string", "is_array": false }, "_final_reporting_device_ip": { "type": "string", "is_array": false }, "CountryCode": { "type": "string", "is_array": false }, "SessionType": { "type": "string", "is_array": false } } }