Forum Discussion
MCAS Help with ZSCaler
I recently implemented Cloud App Security with a ZSCaler instance. I am getting the logs to come over into MCAS, but when they are doing so, they user ID is coming anonymized. I have checked in MC...
It turns out that the source for ZScaler data needs to be NSS. It is hard coded into the MCAS software.
there are main settings for zscaler for mcas:
NSS
The source with zscaler QRadar LEEF
The receiver type = Syslog - UDP
and for your issue is the anonymize private information.
I work with zscaler and mcas together and it does a great job.
