Skip to main content
  1. Login to Wirespeed
  2. Navigate to Integrations > Add Integration
  3. Select Zscaler ZPA (Syslog) and click Integrate
  4. This integration uses Wirespeed’s generic JSON mapper under the hood (while ingesting over syslog transport), with Zscaler-specific labeling in the UI.
  5. After you have clicked Integrate, select Chat on the left-hand navigation and ask the support team to provide you with a hostname:port combination
  6. Once the team has provided that to you, login to the ZPA Admin Portal
  7. Navigate to Configuration & Control > Private Infrastructure > Log Streaming Service > Log Receivers
  8. Click Add Log Receiver and configure the Log Receiver tab:
    1. Name: A descriptive name (e.g., “Wirespeed”)
    2. Domain or IP Address: Wirespeed-provided hostname
    3. TCP Port: Wirespeed-provided port
    4. App Connector Groups: Select the groups whose logs you want to forward
  9. Click Next and configure the Log Stream tab:
    1. Log Type: Select the desired log type (e.g., User Activity, Browser Access)
    2. Log Template: Select JSON
    3. Log Stream Content: Use the default template
  10. Click Save
ZPA logs should reflect shortly underneath the Events page.
Zscaler ZPA sends logs via App Connectors, not directly from the ZPA cloud. Ensure the selected App Connector Groups have network connectivity to the Wirespeed hostname and port.