Skip to main content

Zscaler

Visualize Zscaler Internet Access (ZIA) resources including accounts, users, roles, sites, applications, policies, and destinations. Monitor security policy configurations, track user access roles, and understand your Zscaler deployment through queries and alerts.

Installation​

The Zscaler integration supports two authentication methods. ZIdentity + OneAPI (OAuth2) is the recommended modern approach, while legacy session-based authentication remains available for backward compatibility.

Configuring the Integration in JupiterOne​

To install the Zscaler integration in JupiterOne, navigate to the Integrations tab and select Zscaler. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Zscaler account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • An authentication method (see below).

Click Create once all values are provided to finalize the integration.

ZIdentity + OneAPI (OAuth2) — Recommended​

This method uses OAuth2 Client Credentials via ZIdentity. It requires:

  • Client ID: The OAuth2 Client ID from your ZIdentity API client.
  • Client Secret: The OAuth2 Client Secret from your ZIdentity API client.
  • Vanity Domain: Your Zscaler tenant vanity domain (e.g., mycompany for mycompany.zslogin.net).
  • Zscaler Cloud (optional): The Zscaler cloud environment (e.g., zscaler, zscalerone, zscalertwo). Leave blank for the default cloud.

To create OAuth2 credentials:

  1. Log in to the ZIdentity Admin Portal.
  2. Create an API client with the Client Credentials grant type.
  3. Note the Client ID and Client Secret.
  4. Note your Vanity Domain — this is the subdomain portion of your zslogin.net URL.

Legacy Authentication (API Key + Session)​

This method uses an API key, username, and password to create a session-based connection to the Zscaler ZIA API. It requires:

  • API Key: The API key used to authenticate with Zscaler.
  • Username: The API user email address.
  • Password: The API user password.
  • Cloud Name: Your Zscaler cloud instance (e.g., zscaler, zscalerone, zscalertwo, zscalerthree, zscloud, zscalerbeta).

To create legacy API credentials:

  1. Log in to your Zscaler Admin Portal.
  2. Navigate to Administration > API Key Management.
  3. Generate or retrieve your API key.
  4. Note the cloud name from your Zscaler URL (the subdomain before .net).
info

See the Zscaler API documentation for more information on generating API keys.

AppTotal Configuration (Optional)​

To ingest third-party SaaS app inventory and SSPM posture findings from Zscaler AppTotal, provide the following additional credentials when creating your integration instance. These fields are optional — leaving them blank disables AppTotal data collection without affecting the core ZIA integration.

FieldDescription
AppTotal API KeyAPI key for the Zscaler AppTotal service. When provided, the integration ingests the SaaS app inventory and posture findings linked to the specified App View.
AppTotal App View IDUUID of the AppTotal App View whose apps should be ingested. Required when an AppTotal API Key is provided.

To obtain these credentials:

  1. Log in to the AppTotal portal.
  2. Navigate to Settings to generate or copy your API key.
  3. Go to App Views, select the view you want to ingest, and copy its UUID.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.