SIEM: HEC - Zscaler Cloud NSS

Team: Huntress Managed Security Information and Event Management (SIEM) 
Product: Zscaler Cloud NSS 
Environment: Zscaler Internet Access (ZIA) Admin Portal; Huntress Platform 
Summary: Forward Zscaler Cloud NSS web logs to Huntress Managed SIEM over an HTTP Event Collector (HEC) integration.

In this Article

Before You Begin
Configure the Source in the Huntress Platform
Configure the Cloud NSS Feed in Zscaler
Timestamps and Time Zones
Search Zscaler Logs in Managed SIEM
Example Log Messages
Troubleshooting

Before You Begin

Before setting up this integration, ensure you have:

• Cloud NSS is enabled on your ZIA tenant. Cloud NSS is disabled by default. If Cloud NSS Feeds doesn't appear under Administration > Nanolog Streaming Service, open a request with Zscaler Support to have it enabled.
• Admin permission in the ZIA Admin Portal to manage Cloud NSS Feeds.
• A Huntress account with the Managed SIEM entitlement.
• Available Cloud NSS feed capacity. Web log feeds are limited per Cloud NSS subscription; if you're at the cap, remove or repurpose an unused feed first.

If you only have an on-premises NSS VM instead of a Cloud NSS subscription, use the companion SIEM: Syslog - Zscaler NSS Server guide instead.

Configure the Source in the Huntress Platform

1. Log in to the Huntress Platform and go to SIEM > Source Management.
2. Select Source Catalog, search for Zscaler, and choose Zscaler Cloud NSS.
3. Click Add, select the organization the source belongs to, name the source, and save your changes.
4. On the source edit page, copy the HTTP Event Collector URL and HTTP Event Collector Token. You'll paste both into Zscaler in the next step.

Configure the Cloud NSS Feed in Zscaler

1. Log in to the ZIA Admin Portal with administrator permissions.
2. Go to Administration > Nanolog Streaming Service > Cloud NSS Feeds.
3. Click Add Cloud NSS Feed.
4. Configure the feed:

5. In Feed Output Format, paste the following and remove any introduced line breaks:

{ "sourcetype": "zscalernss-web", "event": { "action":"%s{action}", "appname":"%s{appname}", "ClientIP":"%s{cip}", "clientpublicIP":"%s{cintip}", "devicehostname":"%s{devicehostname}", "epochtime":"%d{epochtime}", "hostname":"%s{ehost}", "serverip":"%s{sip}", "url":"%s{eurl}", "user":"%s{elogin}" } }

6. Set Timezone and review the Timestamps and Time Zones section below before saving.
7. Add any Web Log Filters you want to narrow the feed, then click Save and Activate the change.
8. Events appear under the new source in Source Management within a few minutes.

Timestamps and Time Zones

Cloud NSS never includes a time zone marker in the JSON it sends. The feed's Timezone setting, which defaults to your organization's configured ZIA time zone, only controls which wall-clock value is written to the datetime/time field; it does not add that zone to the output itself. Without more information, Huntress has no way to know which zone a plain datetime string is in.

Give Huntress one of two unambiguous ways to resolve the correct event time:

• Recommended - epoch time: Include %d{epochtime} as the epochtime field, as already shown in the Feed Output Format above. Epoch time is zone-agnostic, so Huntress parses it correctly regardless of the Timezone the feed uses.
• Alternative - paired zone: If you also want a human-readable timestamp, add both a datetime field (%s{time}) and a tz field (%s{tz}) to the Feed Output Format, for example "datetime":"%s{time}","tz":"%s{tz}". Huntress only trusts datetime when it appears alongside a tz field.

If you send datetime on its own, without epochtime or a paired tz, Huntress cannot determine the time zone and falls back to the time Huntress received the event. This drifts from the real event time whenever the feed's Timezone isn't UTC/GMT or there's any delay in delivery.

Search Zscaler Logs in Managed SIEM

Huntress normalizes Zscaler Cloud NSS web log events to ECS fields. Every original field sent in the JSON is also searchable under the zscaler_nss.* prefix (for example zscaler_nss.appname or zscaler_nss.epochtime).

Note: Field names in the Feed Output Format are case-sensitive (e.g. ClientIP and clientpublicIP must be typed exactly as shown) or Huntress won't recognize them.

Example Log Messages

The examples below show Cloud NSS events after Huntress normalizes them. Values are sanitized using IETF documentation IP address blocks.

Allowed browsing event:

{ "@timestamp": "2026-10-14T14:12:33.000Z", "event.provider": "HEC-ZscalerNSS", "event.category": "network", "event.action": "Allowed", "source.ip": "198.51.100.10", "source.nat.ip": "198.51.100.11", "host.hostname": "LAPTOP-07", "destination.domain": "mail.google.com", "destination.ip": "203.0.113.5", "url.original": "mail.google.com/mail/u/0", "user.name": "jdoe@example.com", "message": "Allowed mail.google.com", "zscaler_nss.appname": "General Browsing", "zscaler_nss.epochtime": "1760450000" }

Blocked malware event:

{ "@timestamp": "2026-10-14T14:14:07.000Z", "event.provider": "HEC-ZscalerNSS", "event.category": "network", "event.action": "Blocked", "source.ip": "198.51.100.20", "source.nat.ip": "198.51.100.11", "host.hostname": "DESKTOP-09", "destination.domain": "malicious.example.net", "destination.ip": "198.51.100.44", "url.original": "malicious.example.net/payload.exe", "user.name": "asmith@example.com", "message": "Blocked malicious.example.net", "zscaler_nss.appname": "Malware Sites", "zscaler_nss.epochtime": "1760450047" }

Troubleshooting

No data arrives:

• Confirm Cloud NSS is enabled on your tenant, and the feed Status shows Enabled and Activated. Zscaler requires an explicit Activate step after saving.
• Confirm the API URL in Zscaler exactly matches the HTTP Event Collector URL from the Huntress source edit page, with no extra path appended.
• Confirm the Authorization HTTP header is Splunk <token> (including the literal word Splunk and a space) and the token matches the Huntress source's HTTP Event Collector Token.
• Confirm your Huntress account has the Managed SIEM entitlement and the source is active.

Events arrive, but fields aren't parsed (everything lands under generic_hec.*):

• Confirm Feed Output Type is JSON and the Feed Output Format matches the flat object nested under "event" shown above.
• Confirm field names are typed with the exact casing shown (for example ClientIP, not clientip).

Timestamps are off by hours or show the wrong date: See the Timestamps and Time Zones section above. Add epochtime, or add datetime paired with tz.