Team: Huntress Managed Security Information and Event Management (SIEM)
Product: SIEM Syslog
Environment: Zscaler NSS Server (on-premises Nanolog Streaming Service virtual appliance)
Summary: Configuration Guide for forwarding Zscaler NSS Server web logs to Huntress Managed SIEM over syslog.
Vendor Information
| Vendor | Zscaler |
| Supported Model Name/Number | NSS Virtual Appliance (on-premises NSS VM for Zscaler Internet Access) |
| Supported Software Version(s) | N/A — NSS VM configuration is managed from the cloud-hosted ZIA Admin Portal |
| Collection Method | Syslog |
| Provider Name | Syslog-ZscalerNSS |
| Additional Information | About NSS Servers · Adding NSS Feeds for Web Logs · NSS Feed Output Format: Web Logs · General Guidelines for NSS Feeds and Feed Formats |
Please note that Huntress provides third-party vendor instructions as a best effort to expedite onboarding. Vendor documentation and versions frequently change, and so it may be necessary to find the appropriate documentation for syslog logging for your version of the vendor software or service.
This page only covers the device-specific configuration. You'll still need to read Collecting Syslog Sources with Huntress SIEM to enable the syslog collector on your Huntress Agent and open the receiving port in your software firewall.
Device Configuration Checklist
Zscaler NSS Server (also called VM-based NSS) requires an NSS virtual appliance deployed in your environment that pulls logs from the Zscaler cloud and forwards them to a syslog destination you configure. This is distinct from Cloud NSS, which streams logs directly from Zscaler's cloud over HTTPS.
See the companion SIEM: HEC - Zscaler Cloud NSS guide if you want that path instead.
Create an NSS Feed for Web Logs
- In the ZIA Admin Portal, go to Administration > Nanolog Streaming Service > NSS Feeds.
- Click Add NSS Feed.
- Configure the feed:
| Setting | Value |
|---|---|
| Feed Name | Any identifying name (for example, Huntress-SIEM-Web) |
| NSS Type | NSS for Web |
| NSS Server | Select your deployed NSS VM |
| Status | Enabled |
| SIEM Destination Type | IP Address (or FQDN) |
| SIEM IP Address | Internal IP or FQDN of the Huntress Agent configured as your syslog collector |
| SIEM TCP Port | The port you configured on the Huntress Syslog Collector (default 514) |
| Protocol | UDP or TCP — Huntress SIEM does not support TLS or encrypted syslog, so do not enable it here |
| SIEM Rate | Unlimited, unless you need to throttle for licensing reasons |
| Log Type | Web Log |
| Feed Output Type | Custom |
| Feed Escape Character | Leave blank |
- In Feed Output Format, paste the following and remove any introduced line breaks:
act=%s{action} app=%s{proto} cat=%s{urlcat} dhost=%s{ehost} dst=%s{sip} request=%s{eurl} sourceTranslatedAddress=%s{cintip} src=%s{cip} suser=%s{elogin} devicehostname=%s{devicehostname} ZscalerNSSWeblogURLClass=%s{urlclass}
- Click Save, then Activate the change.
Important: Huntress identifies this traffic as originating from a Zscaler NSS Server based on the presence of a field named ZscalerNSSWeblogURLClass in the message body. Keep that field name in the Feed Output Format exactly as shown (mapped from %s{urlclass}). If it's missing or renamed, Huntress SIEM stores the logs as unparsed Generic Syslog rather than from the dedicated Zscaler NSS Server source, and none of the fields below are extracted.
You may add other Zscaler fields (for example reason=%s{reason} or location=%s{location}) to the format string for additional context. Anything beyond the fields below is stored and searchable, just not mapped to a normalized field.
Field Mapping
| ECS Field | Zscaler Feed Field | Example |
|---|---|---|
| event.provider | (fixed) | Syslog-ZscalerNSS |
| event.category | (fixed) | network |
| event.action | act (%s{action}) | Allowed, Blocked |
| network.application | app (%s{proto}) | HTTPS, HTTP_PROXY |
| destination.domain | dhost (%s{ehost}) | mail.google.com |
| destination.ip | dst (%s{sip}) | 203.0.113.5 |
| url.original | request (%s{eurl}) | mail.google.com/mail/u/0 |
| source.ip | src (%s{cip}) | 10.20.30.40 |
| source.nat.ip | sourceTranslatedAddress (%s{cintip}) | 198.51.100.9 |
| user.name | suser (%s{elogin}) | jdoe@example.com |
| host.hostname | devicehostname (%s{devicehostname}) | LAPTOP-01 |
Every key=value pair sent in the message is also stored and searchable under the zscaler_nss.* prefix (for example zscaler_nss.cat for URL category or zscaler_nss.ZscalerNSSWeblogURLClass), regardless of whether it maps to a field above.
Example Log Messages
<134>Oct 14 09:12:33 nss-server act=Allowed app=HTTPS cat=Corporate Marketing dhost=mail.google.com dst=203.0.113.5 request=mail.google.com/mail/u/0 sourceTranslatedAddress=198.51.100.9 src=10.20.30.40 suser=jdoe@example.com devicehostname=LAPTOP-01 ZscalerNSSWeblogURLClass=Business Use
<134>Oct 14 09:14:07 nss-server act=Blocked app=HTTP_PROXY cat=Malware Sites dhost=malicious.example.net dst=198.51.100.44 request=malicious.example.net/payload.exe sourceTranslatedAddress=198.51.100.9 src=10.20.30.41 suser=asmith@example.com devicehostname=DESKTOP-09 ZscalerNSSWeblogURLClass=Security Risk
Troubleshooting
- Logs appear under Generic Syslog instead of Zscaler NSS Server: Double-check the Feed Output Format in Zscaler includes ZscalerNSSWeblogURLClass=%s{urlclass} exactly as written (case-sensitive) or contact Huntress Support.
- No data arrives at all: Confirm the Huntress Syslog Collector is enabled for the right organization and host, that the SIEM IP Address/Port in the NSS Feed matches the Huntress Agent's listening IP and port, and that your software firewall allows the traffic. See Collecting Syslog Sources with Huntress SIEM and Troubleshooting SIEM Local Syslog Collection.
- Feed won't save: Zscaler requires the Feed Output Format to be free of unexpected whitespace/line breaks when pasted into some portal versions. Paste it as a single line.