> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Zscaler ZIA Cloud NSS sozlamasi

> Zscaler Internet Access veb-jurnallarini Cloud NSS oqimi orqali Living Security tizimiga yuboring.

Veb-jurnallarni Living Security tizimiga yuborish uchun Zscaler Internet Access (ZIA) Cloud Nanolog Streaming Service (NSS) oqimini ulang. Bu push (ma'lumotlarni yuborish) integratsiyasidir. U pull (ma'lumotlarni so'rab olish) asosidagi [Zscaler Client Connector](/uz/integrations/catalog/zscaler-client-connector-custom) integratsiyasidan alohida.

## Ushbu integratsiya nimani ta'minlaydi

Veb-jurnal oqimi veb-faoliyatda ishtirok etgan foydalanuvchi va qurilmani aniqlashi hamda bloklangan so'rovlar, zararli manzillar, ma'lumot uzatishning bloklanishi va generativ AI'dan foydalanish kabi normallashtirilgan faoliyatni taqdim etishi mumkin. Natija Zscaler'da sozlangan maydonlar va filtrlarga bog'liq.

## Boshlashdan oldin

Sizga quyidagilar kerak bo'ladi:

* ZIA Cloud NSS obunasi va Cloud NSS oqimlarini boshqarish huquqi
* Living Security tizimida integratsiyalar va kirish kalitlarini boshqarish huquqi
* Living Security'dagi maqsadli tashkilot uchun region
* yaratilgan kirish kalitini saqlash uchun xavfsiz joy

Zscaler HTTPS Cloud NSS manzili uchun ommaviy ishonchli TLS sertifikatini talab qiladi. Living Security'ning mintaqaviy endpointlari bu talabga javob beradi.

## 1. Living Security'ni tayyorlash

<Steps>
  <Step title="Manba va oqimni yaratish">
    **Settings → Integrations → Catalog** bo'limiga o'ting, **Custom Push Source** qo'shing va quyidagi marshrutlash kalitlarini aynan shunday kiriting:

    | Field | Value |
    | - | - |
    | Data Source Name | `zscaler-nss-feed` |
    | Stream Name | `web_logs` |

    `web_logs` ichidagi pastki chiziq majburiy. Boshqa juftlik ma'lumotlarni qabul qilishi mumkin, lekin qo'llab-quvvatlanadigan Zscaler NSS interpretatoridan foydalanmaydi.
  </Step>

  <Step title="Kirish kalitini yaratish">
    **Settings → Access Keys** bo'limiga o'ting, **Push Ingest** doirasiga ega kirish kalitini yarating va uning qiymatini darhol nusxalab oling.
  </Step>

  <Step title="Manzil URL'ini shakllantirish">
    Living Security regioniga mos URL'dan foydalaning:

    * Qo'shma Shtatlar: `https://api.us-east-1.livingsecurity.ai/api/v1/push-ingest/zscaler-nss-feed/web_logs`
    * Yevropa Ittifoqi: `https://api.eu-west-1.livingsecurity.ai/api/v1/push-ingest/zscaler-nss-feed/web_logs`
  </Step>
</Steps>

## 2. Cloud NSS oqimini yaratish

Joriy ZIA Admin Portal'da **Logs → Log Streaming → Internet Log Streaming — Nanolog Streaming Service** bo'limiga o'ting, **Cloud NSS Feeds** bo'limini oching va **Add Cloud NSS Feed** tugmasini tanlang. Menyu nomlari ZIA portalining eski versiyalarida farq qilishi mumkin; portal bo'ylab navigatsiya bo'yicha Zscaler'ning [Cloud NSS veb-jurnallari bo'yicha ko'rsatmalari](https://help.zscaler.com/zia/adding-cloud-nss-feeds-web-logs) asosiy manba hisoblanadi.

Oqimni sozlang:

| Zscaler field | Value |
| - | - |
| Feed Name | Tanish nom, masalan `Living Security web logs` |
| NSS Type | **NSS for Web** |
| Status | Sozlash vaqtida **Disabled**; tekshiruvdan keyin yoqing |
| SIEM Rate | Tashkilotingiz siyosati pastroq tezlikni talab qilmasa, **Unlimited** |
| SIEM Type | **Other** |
| OAuth 2.0 Authentication | **Disabled** |
| Max Batch Size | **512 KB** |
| API URL | 1-bosqichdagi Living Security mintaqaviy URL'i |
| HTTP Header 1 | `Authorization` = `Bearer <access-key>` |
| HTTP Header 2 | `Content-Type` = `application/json` |
| Log Type | **Web Log** |
| Feed Output Type | **JSON** |
| JSON Array Notation | **Enabled** |
| Feed Escape Character | `,\"` |

<Warning>
  `x-api-key` dan foydalanmang va eski API kaliti hamda secret'ni nuqta bilan
  birlashtirmang. Living Security'ning joriy push ingest xizmati doirasi
  cheklangan kirish kalitini faqat `Authorization: Bearer …` sarlavhasida qabul qiladi.
</Warning>

Bir qatorda yozilgan quyidagi aniq, yassi **Feed Output Format** formatidan foydalaning:

```text theme={null}
{"datetime":"%d{yy}-%02d{mth}-%02d{dd} %02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{sip}","requestmethod":"%s{reqmethod}","refererURL":"%s{ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zscaler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malwarecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}","riskscore":"%d{riskscore}","department":"%s{edepartment}","urlsupercategory":"%s{urlsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclass}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fileclass}","bwthrottle":"%s{bwthrottle}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","keyprotectiontype":"%s{keyprotectiontype}"}
```

<Warning>
  Barcha maydonlarni yuqori darajada saqlang. Eskirgan Unify qo'llanmasi bu
  maydonlarni `event` obyekti ichiga joylab, `sourcetype` ni qo'shgan edi. Bunday
  o'ram JSON sifatida qabul qilinishi mumkin, lekin joriy interpretatorga mos
  kelmaydi, shuning uchun hech qanday foydalanuvchi yoki faoliyat hosil
  bo'lmaydi.
</Warning>

Zscaler voqealarini ko'rib chiqishda operatsion jamoangiz kutadigan vaqt mintaqasini tanlang. Living Security oqim taqdim etgan `datetime` qiymatini tahlil qiladi.

## 3. Oqimni filtrlash va yoqish

Inson xavfi dasturingiz uchun zarur veb-faoliyatni yuborish maqsadida Zscaler'ning **Policy Action** va **Policy Reason** filtrlaridan foydalaning. Trafik keskin oshganda jurnallarning tashlab yuborilishiga olib kelishi mumkin bo'lgan past sekundiga voqealar sonidan saqlaning. Agar tashkilotingiz oqimni cheklashi shart bo'lsa, sozlash paytida ham Zscaler yetkazib berishini, ham Living Security Push History bo'limini kuzatib boring.

Oqimni saqlang, Zscaler'ning ulanish testini ishga tushiring va keyin **Status** qiymatini **Enabled** ga o'rnating.

## 4. Yetkazib berish va talqinni tekshirish

1. Living Security'da **Settings → Integrations → Connected → zscaler-nss-feed** bo'limini oching.
2. **Push History** bo'limida yaqinda bajarilgan `web_logs` ishga tushirilishi kutilgan yozuvlar sonini ko'rsatayotganini tasdiqlang.
3. Zscaler'ning so'nggi foydalanuvchilari yoki qurilma IP manzillari kutilgan odamlarga bog'langanini va veb-faoliyat keyingi bosqichlarda mavjudligini tasdiqlang.
4. Agar ishga tushirish qabul qilingan bo'lsa-yu, hech qanday faoliyat ko'rinmasa, aniq manba, oqim va yassi chiqish formatini qayta tekshiring.

## Nosozliklarni bartaraf etish

| Symptom | Check |
| - | - |
| `401 Unauthorized` | `Authorization` dan `Bearer <access-key>` qiymati bilan foydalaning; muddati tugagan yoki bekor qilingan kalitni almashtiring |
| `403 Forbidden` | Kalitni **Push Ingest** doirasi bilan yarating |
| `404 Not Found` | `zscaler-nss-feed` va `web_logs` ni ro'yxatdan o'tkazing, so'ng aynan shu URL'dan foydalaning |
| `400 Bad Request` | JSON Array Notation'ni yoqing va chiqish yassi obyektlarning yuqori darajadagi massivi ekanini tasdiqlang |
| `202`, lekin hech qanday foydalanuvchi yoki faoliyat yo'q | Eskirgan `sourcetype` / `event` o'ramini olib tashlang va aniq marshrutlash kalitlarini tekshiring |
| `429` | IP darajasidagi vaqtinchalik cheklovdan so'ng kutib turing va `Retry-After` mavjud bo'lsa, unga rioya qiling |
| `503` | Paketni qayta urinish uchun saqlab qo'ying, `Retry-After` gacha kuting va uni o'zgartirmasdan qayta yuboring |
| Connectivity test fails | Mintaqaviy host nomi, Bearer sarlavhasi, kalit holati va ommaviy TLS inspeksiya siyosatini tekshiring |

API har bir so'rovda ko'pi bilan 10,000 yozuv va 10 MB ni, har bir tashkilot uchun 60 soniyada 600 ta so'rovni qabul qiladi. Javoblar va qayta urinishlar shartnomasi bilan to'liq tanishish uchun [Custom Push Source API](/uz/integrations/custom-push-source) bo'limiga qarang.

## Related

<CardGroup cols={2}>
  <Card title="Custom Push Source API" icon="arrow-up-from-bracket" href="/uz/integrations/custom-push-source">
    Autentifikatsiya, yuklama cheklovlari, javoblar, qayta urinishlar va ishga tushirishni tekshirish bilan tanishib chiqing.
  </Card>

  <Card title="Zscaler Client Connector" icon="laptop" href="/uz/integrations/catalog/zscaler-client-connector-custom">
    Qurilma va holat ma'lumotlari uchun alohida Client Connector API'sini ulang.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.