ZScaler (Beta) | Dropzone AI Documentation

For the complete documentation index, see llms.txt. This page is also available as Markdown.

This is integration is currently in Beta. At this point in its development, any attempts to integrate with it will return a success, regardless of whether the information entered is accurate or not. For more information about our beta integrations, engage your Dropzone support representative.

The Dropzone platform integrates with ZScaler, a cloud-based security platform offering services such as cloud firewalls, data loss prevention, zero trust network access (ZTNA), and automated threat inspections.

Create an API Key

ZScaler requires a ZScaler Posture Control API key to enable.

To obtain an API Key, do the following:

• Navigate to Administration > Authentication & Authorization > API Keys
• Click "Create API Key"
• Name the key something memorable, such as "DropzoneAI"
• Assign the key the "SecOps" role
• Select a expiration date from the dropdown under "Revocation"

To reduce the number of times you need to perform this integration, we recommend selecting Never or 3 Months

• Click "Create"

Create the API Key

• Copy the API key for use later in the Dropzone UI where it is called "Client Secret," then close the window
• In the table of API Keys, locate the key you just generated
• Copy the Client ID shown for use later in the Dropzone UI, where it is called "Client ID"

Copy the Client ID

Enable ZScaler

To enable the Alert Source integration, you will need the following information:

• Source: Client ID - The Client ID value you generated earlier

• Client Secret - The Client Secret value you generated earlier

• Vanity Domain - The domain name of your organization, e.g. https://.zslogin.net

• Cloud - Your Cloud environment, e.g. zscalerone, zscloud, etc

• Navigate to your Dropzone AI tenant home page e.g. https:// mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

Integrations Dropdown

• Click "Available"

Click Available

• In the Search bar, search ZScaler, then click "Configure"

The ZScaler Tile

• Under the Alert Source header, input the Client ID, Client Secret, and Vanity Domain
• Select your cloud environment from the dropdown

The ZScaler Alert Source Configuration (pt 1)

• If you wish, you may choose to filter alerts by event name
  • Under "Event Filter Mode," select whether to include or exclude the names matching the filters
  • Click "Add Item" under "Event Name Regexes" section, then input a custom regex pattern to filter results

The ZScaler Alert Source Configuration (pt 2)

• Input your desired poll interval and lookback

The ZScaler Alert Source Configuration (pt 3)

• If you wish to further filter alerts using the Python CEL package, check the box labeled "Use advanced filtering"
• Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
• Contact your Dropzone AI support representative for more information about this feature

The ZScaler Alert Source Configuration (pt 4)

• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.