zscaler alert.md
For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.
ZScaler (Beta)
The Dropzone platform integrates with ZScaler, a cloud-based security platform offering services such as cloud firewalls, data loss prevention, zero trust network access (ZTNA), and automated threat inspections.
Create an API Key
ZScaler requires a ZScaler Posture Control API key to enable.
To obtain an API Key, do the following:
Navigate to Administration > Authentication & Authorization > API Keys
Click "Create API Key"
Name the key something memorable, such as "DropzoneAI"
Assign the key the "SecOps" role
Select a expiration date from the dropdown under "Revocation"
Click "Create"
Create the API Key
- Copy the API key for use later in the Dropzone UI where it is called "Client Secret," then close the window
- In the table of API Keys, locate the key you just generated
- Copy the Client ID shown for use later in the Dropzone UI, where it is called "Client ID"
Copy the Client ID
Enable ZScaler
To enable the Alert Source integration, you will need the following information:
| Dropzone Field | Source |
|---|---|
| Client ID | The Client ID value you generated earlier |
| Client Secret | The Client Secret value you generated earlier |
| Vanity Domain | The domain name of your organization, e.g. https://<your_domain>.zslogin.net |
| Cloud | Your Cloud environment, e.g. zscalerone, zscloud, etc |
- Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
- In the bottom left hand corner, navigate to Settings > Integrations
Integrations Dropdown
- Click "Available"
Click Available
- In the Search bar, search ZScaler, then click "Configure"
The ZScaler Tile
- Under the Alert Source header, input the Client ID, Client Secret, and Vanity Domain
- Select your cloud environment from the dropdown
The ZScaler Alert Source Configuration (pt 1)
- If you wish, you may choose to filter alerts by event name
- Under "Event Filter Mode," select whether to include or exclude the names matching the filters
- Click "Add Item" under "Event Name Regexes" section, then input a custom regex pattern to filter results
The ZScaler Alert Source Configuration (pt 2)
- Input your desired poll interval and lookback
The ZScaler Alert Source Configuration (pt 3)
- If you wish to further filter alerts using the Python CEL package, check the box labeled "Use advanced filtering"
- Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
- Contact your Dropzone AI support representative for more information about this feature
The ZScaler Alert Source Configuration (pt 4)
- Click "Test & Save" to finish
If you have any errors engage your Dropzone AI support representative.