Web & Access

Zscaler Internet Access (ZIA)

Zscaler ZIA cloud proxy — NSS web log feed with URL categorization, threat/malware blocking, DLP content inspection, browser isolation, bandwidth throttling, and file type control across 20 users and 16 endpoints.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/proxy-zscaler/generator.yml \
  --id zscaler-zia \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
allowed	Normal allowed web traffic	~80%	web
blocked-policy	Blocked by URL filtering policy	~8%	web
throttled	Bandwidth throttled (streaming)	~5%	web
blocked-security	Blocked by security threat	~3%	web
blocked-filetype	Blocked executable/archive downloads	~2%	web
cautioned-dlp	DLP policy violation detected	~1.5%	web
isolated	Browser Isolation for risky sites	~0.5%	web

Realism Features

Log-normal distributions for request/response byte sizes
Weighted URL categories across Zscaler's 3-level hierarchy (class/super/sub)
Realistic TLS details — cipher suites, TLS versions, certificate validation, OCSP results
Multi-device fleet — 16 endpoints (Windows, macOS, iOS, Android) with varied OS versions
DLP engine simulation — HIPAA, PCI, GDPR, Code Protection with dictionary hit counts
21 cloud applications with class and risk score

Sample Output

{
    "@timestamp": "2026-02-22T19:11:26+00:00",
    "event": {
        "action": "allowed",
        "category": ["web"],
        "module": "zscaler_zia",
        "outcome": "success"
    },
    "url": {
        "domain": "www.zendesk.com",
        "full": "https://www.zendesk.com/agent/dashboard"
    },
    "user": { "email": "jmorales@safemarch.com", "name": "jmorales" },
    "zscaler_zia": {
        "web": {
            "action": "Allowed",
            "app": { "class": "Collaboration", "name": "Slack" },
            "department": "Engineering",
            "url": {
                "category": { "super": "Business and Economy" },
                "class": "Business Use"
            }
        }
    }
}

Parameters

Parameter	Default	Description
company	SafeMarch Inc	Organization name
cloudname	zscaler.net	Zscaler cloud name
datacenter	US-CA1 Client Node DC	Zscaler datacenter
nss_server	nss-feed-01	NSS feed server name
agent_id	a1b2c3d4-...	Filebeat agent UUID
agent_version	8.17.0	Elastic Agent version

Related Generators

Web & Access

Nginx Access & Error Logs

Nginx reverse proxy and web server — access logs with upstream timing, error logs with module context, bot/crawler traffic, scanner probes, and correlated 4xx/5xx error entries.

Web & Access

Apache HTTP Server

Apache httpd access and error logs — page/asset/API requests, bot crawlers (Googlebot, GPTBot), scanner probes, 3xx redirects, and correlated 4xx/5xx error log entries with module context.

Web & Access

Cisco AnyConnect VPN

Cisco ASA AnyConnect SSL VPN — session lifecycle from RADIUS authentication through tunnel establishment, IP assignment, DAP policy evaluation, session roaming between gateways, to graceful disconnection.