Zscaler Private Access

The IBM QRadar DSM for Zscaler Private Access (ZPA) collects syslog events from a Zscaler Private Access service.

To integrate Zscaler Private Access with QRadar, complete the following steps:
  1. If automatic updates are not enabled, download the most recent versions of the RPMs from the IBM® support website (https://www.ibm.com/support).
    • DSM Common RPM
    • ZscalerPrivateAccess DSM RPM
  2. Configure your Zscaler Private Access service to send events to QRadar. For more information, see Configuring Zscaler Private Access to send events to QRadar.
  3. If QRadar does not automatically detect the log source, add a Zscaler Private Access log source on the QRadar Console.