icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Cancel Visit New Splunkbase Visit
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

ISC Licensing

Splunk Websites Terms and Conditions of Use

Thank You

Downloading Zscaler Technical Add-On for Splunk
SHA256 checksum (zscaler-technical-add-on-for-splunk_410.tgz) 50d3b68e9d5221e227320857467a1d93cd327d3af859110dfe61e43d287f87f5 SHA256 checksum (zscaler-technical-add-on-for-splunk_4016.tgz) f5b3e7bd6e5899c63587fd630476af9ea8b780a9cf0a789a79da76624b756a66 SHA256 checksum (zscaler-technical-add-on-for-splunk_4013.tgz) 7f658de01de03d7d53805b96a382e25eab8268e43e19c3c3ace11cc9f52b833f SHA256 checksum (zscaler-technical-add-on-for-splunk_4010.tgz) 9373f8bb4799c2b0aef34be3a82071bdf5ef986334c80e51a8c2cb2aa76a8ab8 SHA256 checksum (zscaler-technical-add-on-for-splunk_407.tgz) c88ebac801940e944ae5b939d0f3423753e853d5cb2fdce4b47f345cbb1f9a4d SHA256 checksum (zscaler-technical-add-on-for-splunk_403.tgz) c8aab6a83b3d9c30c96a026ec5a802efe9544f2b783ff0ad2d32859afc19bb52 SHA256 checksum (zscaler-technical-add-on-for-splunk_402.tgz) 437a44bc6976295b3b682a7f61a46d55ce9e4f47c5ce916346151c0fbc81852e SHA256 checksum (zscaler-technical-add-on-for-splunk_314.tgz) d4421e19d6bb9ed7921f4bb68f9543cdc9cfd6d1e30b9a7a2cd48cc8c50aa6d4 SHA256 checksum (zscaler-technical-add-on-for-splunk_313.tgz) ce2e85f1c750e0b11f777d6f84b70ef223449ea0b7d505d2a6590b6c67eea388 SHA256 checksum (zscaler-technical-add-on-for-splunk_312.tgz) 3aa45025a610d59c0608d2df34335bc5ab820000d5246d7d277aa7fef0c48db5 SHA256 checksum (zscaler-technical-add-on-for-splunk_310.tgz) a6dc271cce904352e0c98ca27e8824e90fafc14d014fdf5ae28317c55dffce77 SHA256 checksum (zscaler-technical-add-on-for-splunk_306.tgz) 23cdb09ee07346f0822361b14ae9958b8b41553a0550739bc4b8a6cb50758c74 SHA256 checksum (zscaler-technical-add-on-for-splunk_302.tgz) 254ec23c28fb68754f2ee2af68675ec5736b705e48936900033cc43b17db4bfd SHA256 checksum (zscaler-technical-add-on-for-splunk_301.tgz) 2d487cc5d74db64d9495d106811277ad8bc815ca862ac472d48a19f071f9d1e7 SHA256 checksum (zscaler-technical-add-on-for-splunk_300.tgz) 4e062d5df0b9979fb3dbd5922175b30eb622f333a88bdfedc06be0f33ca4c1f1 SHA256 checksum (zscaler-technical-add-on-for-splunk_214.tgz) 9c9f2d12cbc6269dbc70a712c8512aa726b90a976869e0bc616d055e0e17728b SHA256 checksum (zscaler-technical-add-on-for-splunk_213.tgz) 5e449e2072897e0886a42a8d32df8f5efc0323ed12032ec0c8762e36a4133b98 SHA256 checksum (zscaler-technical-add-on-for-splunk_210.tgz) dafd066120e8544f236216cc270e8c9517b89db54a2774cf029a2671a615978d SHA256 checksum (zscaler-technical-add-on-for-splunk_204.tgz) f9d81bc54f8090926ecf495cea323aedea64e5b1b6d25147124630f8aa9979b4 SHA256 checksum (zscaler-technical-add-on-for-splunk_202.tgz) 2798ecc16ede58fa881d4905965aa9d3176f2af6eae9191c9105fc85baa48e7d SHA256 checksum (zscaler-technical-add-on-for-splunk_200.tgz) 363701dfb694085f8026f05cc05e5f92369185a759b9c5c7cdd1d6faffa39931 SHA256 checksum (zscaler-technical-add-on-for-splunk_104.tgz) dbe112e556248efddf1efccca639a52eaf1af50dc611805acb98aca5299d57fa SHA256 checksum (zscaler-technical-add-on-for-splunk_103.tgz) ce1f81808975159929b920cde1697a663c581572c313be0ab64ecf0f7615e149 SHA256 checksum (zscaler-technical-add-on-for-splunk_102.tgz) acf8a3840c35642ec7004a234c910821a5066dafff52122b581f099014af7b52 SHA256 checksum (zscaler-technical-add-on-for-splunk_10.tgz) 151f7997757d68a3111c081a45b456633b1d1a58e3c5d79ab7a5ad40f13ca4eb
To install your download
To install apps and add-ons from within Splunk Enterprise
  1. Log into Splunk Enterprise.
  2. On the Apps menu, click Manage Apps.
  3. Click Install app from file.
  4. In the Upload app window, click Choose File.
  5. Locate the .tar.gz file you just downloaded, and then click Open or Choose.
  6. Click Upload.
  7. Click Restart Splunk, and then confirm that you want to restart.
To install apps and add-ons directly into Splunk Enterprise
  1. Put the downloaded file in the $SPLUNK_HOME/etc/apps directory.
  2. Untar and ungzip your app or add-on, using a tool like tar -xvf (on *nix) or WinZip (on Windows).
  3. Restart Splunk.
After you install a Splunk app, you will find it on Splunk Home. If you have questions or need more information, see Manage app and add-on objects.

Flag As Inappropriate
splunk

Zscaler Technical Add-On for Splunk

Splunk Cloud
Overview
The Zscaler Technical Add-On for Splunk takes events from Zscaler data sources and maps these to Splunk’s Common Information Model, this can be leveraged by Splunk Enterprise Security and and app leveraging the CIM Data Model, including the Zscaler App for Splunk

This TA should be installed as per Splunk's guidelines on TA installation, e.g. http://docs.splunk.com/Documentation/ES/5.0.0/Install/InstallTechnologyAdd-ons

Full App and TA Documentarian is available here --> https://help.zscaler.com/downloads/zscaler-technology-partners/operations/zscaler-and-splunk-deployment-guide/Zscaler-Splunk-Deployment-Guide-FINAL.pdf

Release Notes

Version 4.1.0
March 3, 2025

This version uses Splunk SDK for Python (2.0.2)
Version 4.0.16
Aug. 28, 2024
Version 4.0.13
Aug. 12, 2024

fixing zsten compatibility issue
Version 4.0.10
June 26, 2024

Fixing Splunk cloud compatibility issues
Version 4.0.7
April 25, 2024
Version 4.0.3
Oct. 17, 2023

Bug fixes related to app compat testing
Version 4.0.2
Jan. 17, 2023
  • Added a new Zscaler Cloud instance - zsapi.zscalerten.net
  • Scanned and vetted the add-on to ensure Python3 and jQuery3.5 compatibility
  • Added parsing for below sourcetype
  • zscalerlss-zpa-app
  • zscalerlss-zpa-audit
  • zscalerlss-zpa-auth
  • zscalerlss-zpa-bba
  • zscalerlss-zpa-connector
  • zscalerlss-zpa-pse
  • zscalerlss-zpa-web-inspection
  • zscaler-posturecontrol-alerts
  • CIM normalization done including field alias, calculated fields, eventtypes and tags for below sourcetypes
  • zscalerlss-zpa-app
  • zscalerlss-zpa-audit
  • zscalerlss-zpa-auth
  • zscalerlss-zpa-bba
  • zscalerlss-zpa-web-inspection
  • Recreated scheduled alert - New MD5 to index - CSV - that populates pending sandbox detonations as a scheduled report that directly write the MD5 hashes to lookup within the query instead of as an Alert action. This will now work on Splunk Free version as well where Alert Action triggers are not available
Version 3.1.4
July 19, 2022
  • Improved Sandbox detonation results
Version 3.1.3
March 1, 2022

Fixed support for proxies configured in the TA settings
Version 3.1.2
Oct. 21, 2021

Regression fix - removed predefined-testing stanzas from inputs.conf
Version 3.1.0
Aug. 25, 2021

Updated to latest Splunk SDK as per update in Add-On Builder 4.0; maintain Splunk Cloud compatibility
Version 3.0.6
April 12, 2021

Fixed proxy support - no longer needs code changes, functions with Splunk UI
CIM Corrections
Added Source-type for Zscaler DLP Incident Receiver
Change in how Audit logs events are ingested - each event is logged separately, not nested in the report/JSON
Removed predefined ZDMEO::Beta inputs accidentally inserted in previous release
Added ZscalerGov back into Cloud Types, this is a repaired regression

Full doc here --> https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728

Note - Release 3.0.3 - 3.0.5 were only released privately.
Version 3.0.2
Oct. 5, 2020

3.0.2 - Fixes an issues where ZIA Audit Logs were missing or duplicated in some corner cases
Version 3.0.1
Aug. 17, 2020

3.0.1

Modified to macro "z-metricis" to value of index=_metrics so as to pass app-inspect validation - you will still need to modify this for your metrics index as per the full doc

Full doc here --> https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728

3.0.0.

Zscaler's Technical Add-on for Splunk has been fully rebuilt in latest Splunk Add-On builder (needed to pass new app-inspect and cloud-vetting requirements)

New ! - Connector Heath - requires admin to bond to Metrics-type Splunk index (default expected is z-metrics, can change in macros.conf)

  • Now using AoB2/AoB3/splunklib with python 3 compatibility (Zscaler SDK is already pithing 2/3 compat)
  • Enabled Proxy Settings in TA (not working for API)
  • Added new saved search to export connector metrics to metric index
  • Fixed Sandbox saved search and event logging
  • New requires python3 (per latest Splunk guidance) - reversion to python 2 via manual config changes
Version 3.0.0
Aug. 10, 2020

Zscaler's Technical Add-on for Splunk has been fully rebuilt in latest Splunk Add-On builder (needed to pass new app-inspect and cloud-vetting requirements)

New ! - Connector Heath - requires admin to bond to Metrics-type Splunk index (default expected is z-metrics, can change in macros.conf)

  • Now using AoB2/AoB3/splunklib with python 3 compatibility (Zscaler SDK is already pithing 2/3 compat)
  • Enabled Proxy Settings in TA configuration
  • Added new saved search to export connector metrics to metric index
  • Fixed Sandbox saved search and event logging
  • New requires python3 (per latest Splunk guidance) - reversion to python 2 via manual config changes

Full doc here --> https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728
Version 2.1.4
Jan. 9, 2020

Added fix to prevent extraction in proxied URL field

NOTE: When upgrading to this versions of the TA prior to 2.1.0 you will need to recreate your sandbox and/or audit-log modular inputs as these now use Global Accounts as per requirements for Splunk Cloud. The process for creating these inputs has been updated in the supporting documentation which is available here: https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728
Version 2.1.3
Dec. 31, 2019

Added fixes to make macro edit more friendly
Disabled KV Auto-Extract on web/proxy sourcetype to event URL query string extrapolation & overwrite at search time.
Minor app.manifest config fix for Splunk App Inspect pass
Version 2.1.0
Nov. 27, 2019

This version of the TA contains fixes for Splunk Cloud appvetting, it is the first API enabled version of the TA to be available for Splunk Cloud usage.

NOTE: When upgrading to this versions of the TA you will need to recreate your sandbox and/or audit-log modular inputs as these now use Global Accounts as per requirements for Splunk Cloud. The process for creating these inputs has been updated in the supporting documentation which is available here: https://community.zscaler.com/t/zscaler-splunk-app-design-and-installation-documentation/4728
Version 2.0.4
Oct. 21, 2019

Minor fix - correctly added ZIA-tunnel sourcetype
Version 2.0.2
Aug. 5, 2019

2.0.2 - added transforms.conf stanza for sandbox lookup (needed for App Inspect pass)
Version 2.0.0
July 9, 2019

Version 2.0.0
Added Modular Inputs for Zscaler API's
- Admin Audit Logs (ZIA)
- Cloud Sandbox detailed reports

Moved all macros into TA, removed from App

Added and cleaned CIM mapping
Version 1.0.4
May 3, 2018
Version 1.0.3
May 2, 2018
Version 1.0.2
April 16, 2018
Version 1.0
Jan. 30, 2018
61,772
Downloads
Share Subscribe LOGIN TO DOWNLOAD
Version
Built by
Zscaler
Support
Developer Supported
Contact Developer Questions on Splunk Answers Flag as inappropriate App Contents: Inputs App Contents: Inputs App Contents: Inputs App Contents: Alert Actions, Inputs App Contents: Alert Actions, Inputs App Contents: Alert Actions, Inputs App Contents: Alert Actions App Contents: Alert Actions App Contents: Alert Actions App Contents: Alert Actions
Compatibility
This version of the app (4.0.16) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (4.0.13) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (4.0.10) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (4.0.7) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (4.0.3) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (4.0.2) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.1.4) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.1.3) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.1.2) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.1.0) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.0.6) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.0.2) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.0.1) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (3.0.0) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (2.1.4) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (2.1.3) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (2.1.0) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (2.0.4) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (2.0.2) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (2.0.0) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (1.0.4) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (1.0.3) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (1.0.2) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
This version of the app (1.0) is not available for Splunk Cloud. However, version 4.1.0 of this app is available for Splunk Cloud.
Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise
Splunk Versions: 10.0, 9.4, 9.3 Platform: Platform Independent CIM Versions: 6.x, 5.x Splunk Versions: 9.4, 9.3, 9.2, 9.1 Platform: Platform Independent CIM Versions: 5.x, 4.x Splunk Versions: 9.4, 9.3, 9.2 Platform: Platform Independent CIM Versions: 5.x Splunk Versions: 9.4, 9.3, 9.2, 9.1 Platform: Platform Independent CIM Versions: 5.x, 4.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2 Platform: Platform Independent CIM Versions: 5.x, 4.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1 Platform: Platform Independent CIM Versions: 5.x, 4.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1 Platform: Platform Independent CIM Versions: 5.x, 4.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1 Platform: Platform Independent CIM Versions: 5.x, 4.x, 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0 Platform: Platform Independent CIM Versions: 5.x, 4.x, 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0 Platform: Platform Independent CIM Versions: 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2 Platform: Platform Independent CIM Versions: 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 8.1, 8.0 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 7.3, 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.3, 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.3, 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x, 3.x Splunk Versions: 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.0 Platform: Platform Independent CIM Versions: 4.x
Licensing
ISC Licensing
Category & Contents
Categories: IT Operations, Security, Fraud & Compliance
App Type: Add-on
Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Submit New Splunk App Dev Resources
PLATFORM
Data-to-Everything Platform
Splunk Cloud
Splunk Enterprise
Splunk Machine Learning Toolkit
Splunk Data Stream Processor
Pricing
Free Trials & Downloads
SECURITY PRODUCTS
Splunk Enterprise Security
Splunk Phantom
Splunk Mission Control
Splunk User Behavior Analytics
IT OPERATIONS & OBSERVABILITY PRODUCTS
Splunk Infrastructure Monitoring
Splunk IT Service Intelligence
Splunk Application Performance Monitoring
Splunk On-Call
SOLUTIONS BY INITIATIVE
Cloud Transformation
SOLUTIONS BY FUNCTION
Security
IT
Devops
SOLUTIONS BY INDUSTRY
Aerospace & Defense
Communications
Energy & Utilities
Financial Services
Healthcare
Higher Education
Manufacturing
Nonprofits
Online Services
Public Sector
Retail
WHY SPLUNK?
Why Splunk?
Customer Stories
Partners
Data-to-Everything
Diversity & Inclusion
SUPPORT
Support Portal
Support Programs
Splunk Answers
Contact Us
Product Security Updates
RESOURCES
Events
Webinars
Blogs
Customer Success
Expert Services
Data Insider
View All Resources
FOR DEVELOPERS
Documentation
Best Practices
Get Started with Splunk
Training & Certification
User Groups
Community
Splunkbase
Splunk dev
COMPANY
About Splunk
Careers
Leadership
Splunk for Good
Splunk Ventures
Splunk Protects
Newsroom
COVID-19 Response
SPLUNK SITES
.conf
Splunk Live!
T-Shirt Store
Investor Relations
Follow Us:
© 2005-2025 Splunk LLC All rights reserved.
Sitemap | Privacy | Website Terms of Use | Splunk Licensing Terms | Export Control | Modern Slavery Statement | Splunk Patents | Report a Problem
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk LLC in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.