---
updatedAt: 2026-02-10T07:49:32.000Z
agentTools:
  projectIndex: https://help.zluri.com/llms.txt
---

# Connect

Use this guide to configure Zscaler to send web logs to Zluri using Cloud NSS and an S3 bucket.

## Prerequisites

* Admin access to Zscaler
* Zscaler API key

## Step 1: Connect Zscaler in Zluri

**1.** Go to **Source → Integrations → Browse Catalog**, search for **Zscaler**, and click **Connect Integration**.

<Image align="center" border={false} src="https://files.readme.io/148398282573c1b79c03d1f31e46b985b264ac1147029a71631163c77cf948cf-Screenshot_2025-08-01_at_4.14.51_PM.png" />

**2.** In the scope selection screen, add the optional scope:

1. **Read NSS Logstream Logs** - for NSS Logs Ingestion
2. **Read users** - For Users fetching

> 🚧 The scopes are not selected by default and must be added manually to enable log ingestion or to fetch users data.

Click **Continue**.

<Image align="center" border={false} src="https://files.readme.io/65af0620560c1207b512ff0df8d9d13dfb95c95f411ef40b3db7a10c722f4fba-Screenshot_2025-10-31_at_5.51.01_PM.png" />

**3.** Log in using Zscaler credentials:

* **API Key**: Go to `Administration → Cloud Service API Key Security` in Zscaler
* **Username and Password**: Use the same credentials used to log into Zscaler
* **Subdomain**: Use the organization's Zscaler cloud name (e.g., `zscaler.net`, `zscalerthree.net`)

**4.** Enter the **Bucket Name** (shared by Zluri Support).

> 🚧 The "Bucket Name" becomes mandatory when the `Read NSS Logstream Logs` scope is selected.
>
> ### The "API Key + Username Password + Subdomain" becomes mandatory when the `Read Users`scope is selected.
>
> ### All form fields becomes mandatory when both scopes are selected.
>
> If the scope is enabled but the bucket name is missing, the integration will fail.

<Image align="center" border={false} src="https://files.readme.io/ce17f6d5505f4cc3bfdd01136b5ecfff945c1d7f10ecd516216df96ff827ad5e-Screenshot_2025-10-31_at_5.52.48_PM.png" />

**5.** Click **Connect**.

## Step 2: Configure NSS Feed in Zscaler

**1.** In Zscaler, go to **Administration → Nanolog Streaming Service (NSS)** and click **Add NSS Feed**.

<Image align="center" border={false} src="https://files.readme.io/fe142300c7136678635d1ab2e24a7a1d37a9fdc95c8e11f03f2080af631a2c46-Zsc1.webp" />

**2.** Fill in *General*:

* Feed Name (e.g., `LogsZluri`)
* NSS Type: NSS for Web
* Status: Enabled
* SIEM Rate: Unlimited

**3.** Under *SIEM Connectivity*, select `S3` and enter:

* AWS Access Key (ID) and AWS Secret Access Key (shared by Zluri)
* S3 Folder URL in the following format:\
  `https://{bucket-name}//{orgId}/{integrationId}/{orgintegrationId}`\
  Use the exact path shared by Zluri after integration.

## Step 3: Format the Feed

Configure the formatting section:

* Log Type:  `Web Logs`
* Feed Output Type: `JSON`
* Enable JSON Array Notation
* Keep the Feed Output Format line

<Image align="center" border={false} src="https://files.readme.io/713672a5dac22221a3f58d5593d695ea35b2f33b684c22f1a7e9e8a39bd8c6bd-ZSC2.webp" />

## Step 4: Finalise the Setup

**1.** Click **Test Connectivity**. A `200 OK` message confirms success.

**2.** Set the preferred log push frequency (e.g., hourly or daily).

**3.** Click **Save** to complete the feed setup.

## Final Notes

* Please reach out to **Zluri Support** to get:
  * S3 credentials (access key & secret)
  * Org-specific S3 folder path
* Ensure **exact formatting** and **scope alignment** to avoid setup issues