> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/network-security/zscaler/zscaler-zpa.md).

# ZScaler ZPA

Zscaler Private Access (ZPA) is a zero trust network access service that brokers user connections to internal applications without exposing them to the public internet, mitigating lateral movement and unauthorized access threats. Connecting ZPA forwards user activity, user status, browser access, AppProtection, and microsegmentation flow logs to Radiant Security through the Radiant Agent. Radiant uses these logs to extract artifacts during Enrichment and to answer triage questions about user access, application activity, and policy violations.

### Prerequisites

* [ ] Admin access to Zscaler ZPA
* [ ] A deployed [Radiant Agent](https://help.radiantsecurity.ai/radiant-connectors/data-connectors/install-the-radiant-security-agent) reachable from your ZPA App Connectors

### Add the data connector in Radiant Security

1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, select **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Radiant Agent**, then click **Data Feeds**. 
4. Under **Select your data feeds**, select **Zscaler ZPA** and click **Credentials**.
5. In the **Credential Name** field, enter an identifiable name for the Radiant Agent integration (for example, `Radiant Agent integration`). To reuse an existing Radiant Agent credential, select it from the drop-down menu.
6. In the **Connector tag** field, enter any string. Radiant uses this value as salt when generating the authentication token for your connector.
7. Click **Add Connector**.
8. Click **Done** to save your changes.

### Configure ZPA to forward logs through the Radiant Agent

Zscaler's Log Streaming Service (LSS) forwards events from the ZPA cloud through your on-premises ZPA App Connectors to a log receiver. In this configuration, the Radiant Agent is the log receiver. For background on LSS, see Zscaler's [About Log Streaming Service](https://help.zscaler.com/zpa/about-log-streaming-service) and [Configuring Log Receiver](https://help.zscaler.com/zpa/configuring-log-receiver) documentation.

Before you start, confirm the IP address or hostname of the Radiant Agent and the port configured to receive Zscaler ZPA data. If you do not know the port, contact your Customer Success representative.

{% stepper %}
{% step %}

#### Open the Log Receivers configuration

Log in to the ZPA Admin Portal and navigate to **Administration** > **Log Streaming Service** > **Log Receivers**.
{% endstep %}

{% step %}

#### Add a new log receiver

Click **Add Log Receiver**.
{% endstep %}

{% step %}

#### Configure the log receiver

On the **Add Log Receiver** page, enter the following:

* **Name**: a descriptive name (for example, `Radiant Security Log Receiver`).
* **Domain or IP Address**: the IP address or hostname of the Radiant Agent.
* **Port**: the port configured on the Radiant Agent to receive Zscaler ZPA data.
* **TLS Encryption**: **Yes** (recommended).
* **App Connector Groups**: **ALL**.
  {% endstep %}

{% step %}

#### Configure the log stream

On the **Log Stream** page, enter the following:

* **Log Stream**: select **User Activity**, **User Status**, **Browser Access Logs**, **AppProtection**, and **Microsegmentation Flow**.
* **Log Template**: **JSON**.
* **Log Stream Content**: keep the default.
* **Policy**: **Any SAML attribute from an IdP**. Leave all other tabs at their default settings.

  <figure><img src="/files/5RnyrEel6G4WTB1WEUGD" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

#### Review and save

Click **Next** to review the configuration, then click **Save**.

<div align="left"><figure><img src="/files/kaUyhvIlZtG3XCG4jKY5" alt="" width="375"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}

### Verify ingestion

After Zscaler ZPA begins forwarding, confirm alerts and events are reaching Radiant.

1. In Radiant, navigate to [Log Management](https://app.radiantsecurity.ai/logs).
2. Filter by `rs_connectorType:"zscaler_zpa"`.
3. Confirm recent alerts and events appear.

{% hint style="info" %}
Allow several minutes for alerts and events to be parsed, indexed, and available for search.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/network-security/zscaler/zscaler-zpa.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.