# ZScaler Cloud NSS Feed

In this guide, you will create custom log formats for ZScaler NSS Cloud log configuration. This is required in order to send ZScaler logs to Radiant Security through HTTPS.

### Add the data connector in Radiant Security

1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings > Data Connectors** and click **+ Add Connector**. 
3. Search for and select the **ZScaler NSS (webhook)** option and then click **Data Feeds**, then click **Credentials**. 
4. Under **Credential Name**, give the credential an identifiable name (e.g. `ZScaler Cloud NSS - Token`). If you already have a credential in place, select it from the drop-down menu. 
5. In the **Connector** **tag** field, enter a random value. This value will act as the salt to randomize the **Token** you’ll download in the next step.
6. Click **Add** **Connector**.
7. Copy and save the **Token** and **Webhook URL** values. Click **Download** **File** to download the SSL Certificate and **Custom** **Template** as you will need these files when configuring the HTTPS source.  
8. Click **Done** to save your changes.

### Set up NSS Cloud Integration with the Radiant Security Connector

Some log types have specific parameters, please refer to the table at the end of this section to check those parameters.

1. Log in to the ZScaler admin portal and go to the **Administration > Nanolog streaming service > Cloud NSS Feed** section.

   <div align="left"><figure><img src="https://2439665791-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPsFulb2ZOtSPcRSc2rXE%2Fuploads%2FFtTyE1dyCecDYcscgKRI%2FZScaler%20Cloud%20NSS%20Feed_05.png?alt=media&#x26;token=09199012-7507-4d92-a457-8134b71a64f2" alt=""><figcaption></figcaption></figure></div>
2. Click **Add** **Cloud NSS** **Feed**.

   <div align="left"><figure><img src="https://2439665791-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPsFulb2ZOtSPcRSc2rXE%2Fuploads%2Fop7xci3x7FQjLLAUg6fI%2FZScaler%20Cloud%20NSS%20Feed_06.png?alt=media&#x26;token=e1294158-1c73-480c-9bdc-1522b5bb6bb1" alt=""><figcaption></figcaption></figure></div>
3. Enter the following information:
   * Enter the feed name, preferably with the `radiantSecurity_` prefix to easily identify the feed.&#x20;

     <div align="left"><figure><img src="https://2439665791-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPsFulb2ZOtSPcRSc2rXE%2Fuploads%2FOYkrjFopA1OyDEWU0DtJ%2FZScaler%20Cloud%20NSS%20Feed_07.png?alt=media&#x26;token=959784aa-1855-4638-9a0b-c73e21ed47e9" alt=""><figcaption></figcaption></figure></div>
   * Select **NSS for Web** in the **NSS Type** field.
   * **Select the SIEM destination type**: **Other.**
   * For **SIEM** **Rate**, select **Unlimited**.
   * **Max Batch Size**: `1024 KB`
   * For the **API URL** field, enter the **Webhook URL** provided during the Radiant Connector setup.
   * Under **HTTP** **Headers**, add a new header with the following parameters:
     * **Name**: `rs_token`
     * **Value**: enter the `Token` value provided during the Radiant Connector setup
   * For **Log** **Type**, select **Web Log**.
   * For **Feed** **Output** Type, select **Custom**.
   * **Feed Escape Character**: **`\",`**
   * **Feed Output Format**:
     * Paste the format according to the log type selected. The custom formats can be found on the **Custom** **Templates** file that you downloaded during the Radiant Security data connector setup. <br>

       <div align="left"><figure><img src="https://2439665791-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPsFulb2ZOtSPcRSc2rXE%2Fuploads%2FE3bVSeKpb9NbArmHHWyk%2FZScaler%20Cloud%20NSS%20Feed_08.png?alt=media&#x26;token=ea72d63b-7297-4de3-a831-a4531d0c2b25" alt=""><figcaption></figcaption></figure></div>
   * Set the **Timezone** to **GMT**.
   * Click **Save**.
   * Click **Activate**.
4. Repeat **step 2** for each log type listed in the table below. Some log types require additional parameters, as indicated in the table.

   | **Log Type**                | **Parameters**                                                                                         |
   | --------------------------- | ------------------------------------------------------------------------------------------------------ |
   | Web Logs                    | NSS Type: NSS for Web                                                                                  |
   | Firewall Logs               | <p>NSS Type: NSS for Firewall<br>Log Domain: Firewall<br>Firewall Log Type: Aggregate Logs</p>         |
   | DNS Logs                    | Log Domain: Firewall                                                                                   |
   | Tunnel Logs                 | <p>NSS Type: NSS for Web<br>Record Type: Tunnel Event</p>                                              |
   | SaaS Security Logs          | <p>NSS Type: NSS for Web<br>Application Category: Select all the application categories that apply</p> |
   | SaaS Security Activity Logs | NSS Type: NSS for Web                                                                                  |
   | Endpoint DLP Logs           | NSS Type: NSS for Web                                                                                  |
   | Email DLP Logs              | NSS Type: NSS for Web                                                                                  |
   | Alerts                      | Default Settings                                                                                       |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/data-connectors/zscaler-cloud-nss-feed.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.