Forum Discussion

Pranesh1060's avatar
Pranesh1060
Brass Contributor
Apr 24, 2020

Azure Sentinel + Zscaler

Hi,   We have successfully connected Sentinel with Zscaler and so far the logs that are getting ingested into the workspace are more or less the urls that are getting allowed/blocked. Is there anyt...
Davethepilot's avatar
Davethepilot
Copper Contributor
May 11, 2022

Pranesh1060 

The data you are looking for like active/inactive, last connected time etc, is all stored in the Zscaler Client Connector Portal. The only data that streams to the NSS is the ZIA (the actual proxy server that processes network traffic from the clients and then to the internet).  Client Connector Portal (formerly known as mobile portal) doesn't do anything with live traffic. I too am anxious to see API opened for the mobile portal to pull similar data that you want. 

 

It is natural for any proxy server, on prem or in the cloud, to only log transactional details of the actions the proxy took when it processed a web request sent from a proxy client. 

 

And certainly using the sentinel query budget is lightning faster than waiting on the zsc admin portal to produce any useful report. 😛 haha

Dave

Resources