收集 Zscaler ZPA 記錄

本文說明如何設定 Bindplane 代理程式，匯出 Zscaler ZPA 記錄，以及記錄欄位如何對應至 Google SecOps 統一資料模型 (UDM) 欄位。

詳情請參閱「將資料匯入 Google SecOps 總覽」。

一般部署作業包括 Zscaler ZPA 和 Bindplane 代理程式，並已設定將記錄傳送至 Google SecOps。每個客戶的部署作業可能有所不同，且可能更為複雜。

部署作業包含下列元件：

• Zscaler ZPA：收集記錄的平台。

• Bindplane 代理程式：Bindplane 代理程式會從 Zscaler ZPA 擷取記錄，並將記錄傳送至 Google SecOps。

• Google SecOps：保留並分析記錄檔。

擷取標籤可識別剖析器，將原始記錄資料正規化為具結構性的 UDM 格式。本文中的資訊適用於標示為 ZSCALER_ZPA 的剖析器。

事前準備

• 確認您可以存取 Zscaler Private Access 控制台。詳情請參閱安全私人存取 (ZPA) 說明
• 請確認您使用的是 Zscaler ZPA 2024 以上版本。
• 請確認部署架構中的所有系統都已設定世界標準時間。

在 Zscaler Private Access 中設定 Log Receiver

請按照下列步驟在 Zscaler Private Access 中設定及管理 Log Receiver：

新增記錄接收器

1. 依序選取「Configuration & Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 按一下「新增記錄接收器」。
3. 在「Log Receiver」分頁中執行下列操作：
   1. 在「Name」 欄位中輸入記錄接收器的名稱。
   2. 在「Description」欄位輸入說明。
   3. 在「網域或 IP 位址」欄位中，輸入記錄接收器的完整網域名稱 (FQDN) 或 IP 位址。
   4. 在「TCP Port」欄位中，輸入記錄接收器使用的 TCP 通訊埠編號。
   5. 在「TLS 加密」中選取加密類型，即可啟用或停用應用程式連接器與記錄接收器之間的流量加密功能。這項設定預設為停用。
   6. 在「應用程式連接器群組」清單中，選取可將記錄轉送至接收器的群組。
   7. 點按「Next」。

4. 在「Log Stream」分頁中，執行下列操作：

   1. 從選單中選取「Log Type」。
   2. 從選單中選取「記錄範本」。
   3. 複製貼上「Log Stream Content」，然後新增欄位。確認鍵名稱與實際欄位名稱相符。以下是各記錄類型的預設「記錄串流內容」設定：

   • 使用者活動：

     {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"ConnectionID": %j{ConnectionID},"InternalReason": %j{InternalReason},"ConnectionStatus": %j{ConnectionStatus},"IPProtocol": %d{IPProtocol},"DoubleEncryption": %d{DoubleEncryption},"Username": %j{Username},"ServicePort": %d{ServicePort},"ClientPublicIP": %j{ClientPublicIP},"ClientPrivateIP": %j{ClientPrivateIP},"ClientLatitude": %f{ClientLatitude},"ClientLongitude": %f{ClientLongitude},"ClientCountryCode": %j{ClientCountryCode},"ClientZEN": %j{ClientZEN},"Policy": %j{Policy},"Connector": %j{Connector},"ConnectorZEN": %j{ConnectorZEN},"ConnectorIP": %j{ConnectorIP},"ConnectorPort": %d{ConnectorPort},"Host": %j{Host},"Application": %j{Application},"AppGroup": %j{AppGroup},"Server": %j{Server},"ServerIP": %j{ServerIP},"ServerPort": %d{ServerPort},"PolicyProcessingTime": %d{PolicyProcessingTime},"ServerSetupTime": %d{ServerSetupTime},"TimestampConnectionStart": %j{TimestampConnectionStart:iso8601},"TimestampConnectionEnd": %j{TimestampConnectionEnd:iso8601},"TimestampCATx": %j{TimestampCATx:iso8601},"TimestampCARx": %j{TimestampCARx:iso8601},"TimestampAppLearnStart": %j{TimestampAppLearnStart:iso8601},"TimestampZENFirstRxClient": %j{TimestampZENFirstRxClient:iso8601},"TimestampZENFirstTxClient": %j{TimestampZENFirstTxClient:iso8601},"TimestampZENLastRxClient": %j{TimestampZENLastRxClient:iso8601},"TimestampZENLastTxClient": %j{TimestampZENLastTxClient:iso8601},"TimestampConnectorZENSetupComplete": %j{TimestampConnectorZENSetupComplete:iso8601},"TimestampZENFirstRxConnector": %j{TimestampZENFirstRxConnector:iso8601},"TimestampZENFirstTxConnector": %j{TimestampZENFirstTxConnector:iso8601},"TimestampZENLastRxConnector": %j{TimestampZENLastRxConnector:iso8601},"TimestampZENLastTxConnector": %j{TimestampZENLastTxConnector:iso8601},"ZENTotalBytesRxClient": %d{ZENTotalBytesRxClient},"ZENBytesRxClient": %d{ZENBytesRxClient},"ZENTotalBytesTxClient": %d{ZENTotalBytesTxClient},"ZENBytesTxClient": %d{ZENBytesTxClient},"ZENTotalBytesRxConnector": %d{ZENTotalBytesRxConnector},"ZENBytesRxConnector": %d{ZENBytesRxConnector},"ZENTotalBytesTxConnector": %d{ZENTotalBytesTxConnector},"ZENBytesTxConnector": %d{ZENBytesTxConnector},"Idp": %j{Idp},"ClientToClient": %j{c2c},"ClientCity": %j{ClientCity},"MicroTenantID": %j{MicroTenantID},"AppMicroTenantID": %j{AppMicroTenantID}}\n
     

   • 使用者狀態：

     {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"Username": %j{Username},"SessionID": %j{SessionID},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"ZEN": %j{ZEN},"CertificateCN": %j{CertificateCN},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"Idp": %j{Idp},"Hostname": %j{Hostname},"Platform": %j{Platform},"ClientType": %j{ClientType},"TrustedNetworks": [%j(,){TrustedNetworks}],"TrustedNetworksNames": [%j(,){TrustedNetworksNames}],"SAMLAttributes": %j{SAMLAttributes},"PosturesHit": [%j(,){PosturesHit}],"PosturesMiss": [%j(,){PosturesMiss}],"ZENLatitude": %f{ZENLatitude},"ZENLongitude": %f{ZENLongitude},"ZENCountryCode": %j{ZENCountryCode},"FQDNRegistered": %j{fqdn_registered},"FQDNRegisteredError": %j{fqdn_register_error},"City": %j{City},"MicroTenantID": %j{MicroTenantID}}\n
     

   • 瀏覽器存取權

     {"LogTimestamp":%j{LogTimestamp:time},"ConnectionID":%j{ConnectionID},"Exporter":%j{Exporter},"TimestampRequestReceiveStart":%j{TimestampRequestReceiveStart:iso8601},"TimestampRequestReceiveHeaderFinish":%j{TimestampRequestReceiveHeaderFinish:iso8601},"TimestampRequestReceiveFinish":%j{TimestampRequestReceiveFinish:iso8601},"TimestampRequestTransmitStart":%j{TimestampRequestTransmitStart:iso8601},"TimestampRequestTransmitFinish":%j{TimestampRequestTransmitFinish:iso8601},"TimestampResponseReceiveStart":%j{TimestampResponseReceiveStart:iso8601},"TimestampResponseReceiveFinish":%j{TimestampResponseReceiveFinish:iso8601},"TimestampResponseTransmitStart":%j{TimestampResponseTransmitStart:iso8601},"TimestampResponseTransmitFinish":%j{TimestampResponseTransmitFinish:iso8601},"TotalTimeRequestReceive":%d{TotalTimeRequestReceive},"TotalTimeRequestTransmit":%d{TotalTimeRequestTransmit},"TotalTimeResponseReceive":%d{TotalTimeResponseReceive},"TotalTimeResponseTransmit":%d{TotalTimeResponseTransmit},"TotalTimeConnectionSetup":%d{TotalTimeConnectionSetup},"TotalTimeServerResponse":%d{TotalTimeServerResponse},"Method":%j{Method},"Protocol":%j{Protocol},"Host":%j{Host},"URL":%j{URL},"UserAgent":%j{UserAgent},"XFF":%j{XFF},"NameID":%j{NameID},"StatusCode":%d{StatusCode},"RequestSize":%d{RequestSize},"ResponseSize":%d{ResponseSize},"ApplicationPort":%d{ApplicationPort},"ClientPublicIp":%j{ClientPublicIp},"ClientPublicPort":%d{ClientPublicPort},"ClientPrivateIp":%j{ClientPrivateIp},"Customer":%j{Customer},"ConnectionStatus":%j{ConnectionStatus},"ConnectionReason":%j{ConnectionReason},"Origin":%j{Origin},"CorsToken":%j{CorsToken}}\n
     

   • Private Service Edge 狀態：

     {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"PackageVersion": %j{PackageVersion},"Platform": %j{Platform},"ZEN": %j{ZEN},"ServiceEdge": %j{ServiceEdge},"ServiceEdgeGroup": %j{ServiceEdgeGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostUpTime": %j{HostUpTime},"ServiceEdgeStartTime": %j{ServiceEdgeStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n
     

   • 應用程式連接器狀態：

     {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"Platform": %j{Platform},"ZEN": %j{ZEN},"Connector": %j{Connector},"ConnectorGroup": %j{ConnectorGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"ServiceCount": %d{ServiceCount},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostStartTime": %j{HostStartTime},"ConnectorStartTime": %j{ConnectorStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n
     

   • 應用程式連接器指標：

     {"LogTimestamp":%j{LogTimestamp:time},"Connector":%j{Connector},"CPUUtilization":%j{CPUUtilization},"SystemMemoryUtilization":%j{SystemMemoryUtilization},"ProcessMemoryUtilization":%j{ProcessMemoryUtilization},"AppCount":%j{AppCount},"ServiceCount":%j{ServiceCount},"TargetCount":%j{TargetCount},"AliveTargetCount":%j{AliveTargetCount},"ActiveConnectionsToPublicSE":%j{ActiveConnectionsToPublicSE},"DisconnectedConnectionsToPublicSE":%j{DisconnectedConnectionsToPublicSE},"ActiveConnectionsToPrivateSE":%j{ActiveConnectionsToPrivateSE},"DisconnectedConnectionsToPrivateSE":%j{DisconnectedConnectionsToPrivateSE},"TransmittedBytesToPublicSE":%j{TransmittedBytesToPublicSE},"ReceivedBytesFromPublicSE":%j{ReceivedBytesFromPublicSE},"TransmittedBytesToPrivateSE":%j{TransmittedBytesToPrivateSE},"ReceivedBytesFromPrivateSE":%j{ReceivedBytesFromPrivateSE},"AppConnectionsCreated":%j{AppConnectionsCreated},"AppConnectionsCleared":%j{AppConnectionsCleared},"AppConnectionsActive":%j{AppConnectionsActive},"UsedTCPPortsIPv4":%j{UsedTCPPortsIPv4},"UsedUDPPortsIPv4":%j{UsedUDPPortsIPv4},"UsedTCPPortsIPv6":%j{UsedTCPPortsIPv6},"UsedUDPPortsIPv6":%j{UsedUDPPortsIPv6},"AvailablePorts":%j{AvailablePorts},"SystemMaximumFileDescriptors":%j{SystemMaximumFileDescriptors},"SystemUsedFileDescriptors":%j{SystemUsedFileDescriptors},"ProcessMaximumFileDescriptors":%j{ProcessMaximumFileDescriptors},"ProcessUsedFileDescriptors":%j{ProcessUsedFileDescriptors},"AvailableDiskBytes":%j{AvailableDiskBytes},"MicroTenantID": %j{MicroTenantID}}\n
     

   • AppProtection：

     {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"ConnectionID": %j{ConnectionID},"UserID": %j{UserID},"AssistantID": %j{AssistantID},"ExchangeSequenceIndex": %d{ExchangeSequenceIndex},"TimestampRequestReceiveStart": %d{TimestampRequestReceiveStart},"TimestampRequestReceiveHeaderFinish": %d{TimestampRequestReceiveHeaderFinish},"TimestampRequestReceiveFinish": %d{TimestampRequestReceiveFinish},"TimestampRequestTransmitStart": %d{TimestampRequestTransmitStart},"TimestampRequestTransmitFinish": %d{TimestampRequestTransmitFinish},"TimestampResponseReceiveFinish": %d{TimestampResponseReceiveFinish},"TimestampResponseTransmitStart": %d{TimestampResponseTransmitStart},"TimestampResponseTransmitFinish": %d{TimestampResponseTransmitFinish},"TotalTimeRequestReceive": %d{TotalTimeRequestReceive},"TotalTimeRequestTransmit": %d{TotalTimeRequestTransmit},"TotalTimeResponseReceive": %d{TotalTimeResponseReceive},"TotalTimeResponseTransmit": %d{TotalTimeResponseTransmit},"Domain": %j{Domain},"Method": %j{Method},"Protocol": %j{Protocol},"ProtocolVersion": %j{ProtocolVersion},"ContentType": %j{ContentType},"ContentEncoding": %j{ContentEncoding},"TransferEncoding": %j{TransferEncoding},"Host": %j{Host},"Destination": %j{Destination},"OriginDomain": %j{OriginDomain},"URL": %j{URL},"UserAgent": %j{UserAgent},"HTTPError": %j{HTTPError},"ClientPublicIp": %j{ClientPublicIp},"ClientPort": %d{ClientPort},"UpgradeHeaderPresent": %d{UpgradeHeaderPresent},"StatusCode": %d{StatusCode},"RequestHdrSize": %d{RequestHdrSize},"ResponseHdrSize": %d{ResponseHdrSize},"RequestBodySize": %d{RequestBodySize},"ResponseBodySize": %d{ResponseBodySize},"Application": %d{Application},"ApplicationGroup": %d{ApplicationGroup},"InspectionPolicy": %d{InspectionPolicy},"InspectionProfile": %d{InspectionProfile},"ParanoiaLevel": %d{ParanoiaLevel},"InspectionControlsHitCount": %d{InspectionControlsHitCount},"InspectionRuleProcessingTime": %d{InspectionRuleProcessingTime},"InspectionReqHeadersProcessingTime": %d{InspectionReqHeadersProcessingTime},"InspectionReqBodyProcessingTime": %d{InspectionReqBodyProcessingTime},"InspectionRespHeadersProcessingTime": %d{InspectionRespHeadersProcessingTime},"InspectionRespBodyProcessingTime": %d{InspectionRespBodyProcessingTime},"CertificateId": %d{CertificateId},"DoubleEncryption": %d{DoubleEncryption},"SSLInspection": %d{SSLInspection},"TotalBytesProcessed": %d{TotalBytesProcessed},"InspectionControls": [%j(,){InspectionControlArray}],"InspectionControlTypes": [%j(,){ControlTypeArray}],"InspectionControlCategories": [%j(,){InspectionControlCategories}],"Actions": [%j(,){Actions}],"Severities": [%j(,){SeveritiesArray}],"Descriptions": [%j(,){DescriptiveExplanationsArray}]}\n
     

   • Private Service Edge 指標：

     {"LogTimestamp":%j{LogTimestamp:time},"PrivateSE":%j{PrivateSE},"CPUUtilization":%j{CPUUtilization},"SystemMemoryUtilization":%j{SystemMemoryUtilization},"ProcessMemoryUtilization":%j{ProcessMemoryUtilization},"UsedTCPPortsIPv4":%j{UsedTCPPortsIPv4},"UsedUDPPortsIPv4":%j{UsedUDPPortsIPv4},"UsedTCPPortsIPv6":%j{UsedTCPPortsIPv6},"UsedUDPPortsIPv6":%j{UsedUDPPortsIPv6},"AvailablePorts":%j{AvailablePorts},"SystemMaximumFileDescriptors":%j{SystemMaximumFileDescriptors},"SystemUsedFileDescriptors":%j{SystemUsedFileDescriptors},"ProcessMaximumFileDescriptors":%j{ProcessMaximumFileDescriptors},"ProcessUsedFileDescriptors":%j{ProcessUsedFileDescriptors},"AvailableDiskBytes":%j{AvailableDiskBytes}}\n
     

   1. 編輯「Log Stream Content」中的記錄串流內容，即可建立自訂記錄範本。
   2. 在「SAML 屬性」中，按一下「選取 IdP」，然後選取要納入政策中的 IdP 設定。
   3. 在「應用程式區隔」選單中，選取要納入的應用程式區隔，然後按一下「完成」。
   4. 在「區隔群組」選單中，選取要納入的區隔群組，然後按一下「完成」。
   5. 在「Client Types」選單中，選取要納入的用戶端類型，然後按一下「Done」。
   6. 在「工作階段狀態」選單中，選取要排除的工作階段狀態代碼，然後按一下「完成」。
   7. 點按「Next」。

5. 在「查看」分頁中查看記錄接收器設定，然後按一下「儲存」。

注意：ZSCALER_ZPA Gold 剖析器僅支援 JSON 記錄格式，因此請務必在設定記錄串流時，從選單中選取「JSON」做為「記錄範本」。

複製記錄接收器

1. 依序選取「Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 在表格中找出要修改的記錄接收器，然後按一下「複製」。
3. 在「Add Log Receiver」視窗中，視需要修改欄位。如要進一步瞭解各個欄位，請參閱「新增記錄接收器」一節中的程序。
4. 按一下 [儲存]。

編輯記錄接收器

1. 依序選取「Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 在表格中找出要修改的記錄接收器，然後按一下「編輯」。
3. 在「Edit Log Receiver」視窗中，視需要修改欄位。如要進一步瞭解各個欄位，請參閱「新增記錄接收器」一節中的程序。
4. 按一下 [儲存]。

刪除記錄接收器

1. 依序選取「Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 在表格中找出要修改的記錄接收器，然後按一下「刪除」。
3. 在「確認」視窗中，按一下「刪除」。

使用 Bindplane 代理程式將記錄轉送至 Google SecOps

1. 安裝並設定 Linux 虛擬機器。
2. 在 Linux 上安裝及設定 Bindplane 代理程式，將記錄轉送至 Google SecOps。如要進一步瞭解如何安裝及設定 Bindplane 代理程式，請參閱 Bindplane 代理程式安裝和設定操作說明。

如果在建立動態饋給時遇到問題，請與 Google SecOps 支援團隊聯絡。

支援的 Zscaler ZPA 記錄格式

Zscaler ZPA 剖析器支援 JSON 格式的記錄。

支援的 Zscaler ZPA 範例記錄

• JSON

  {
    "LogTimestamp": "Wed Jun 12 23:54:04 2024",
    "Customer": "Dummy User",
    "SessionID": "oKbLDDwJQN8C0lNHtAkh",
    "ConnectionID": "oKbLDDwJQN8C0lNHtAkh,WkyDJqMGv8TzkHKsK7uq",
    "InternalReason": "APP_NOT_REACHABLE",
    "ConnectionStatus": "close",
    "IPProtocol": 6,
    "DoubleEncryption": 0,
    "Username": "ZPA LSS Client",
    "ServicePort": 30161,
    "ClientPublicIP": "198.51.100.0",
    "ClientPrivateIP": "",
    "ClientLatitude": 45.823400,
    "ClientLongitude": -119.725700,
    "ClientCountryCode": "US",
    "ClientZEN": "US-CA-9390",
    "Policy": "0",
    "Connector": "0",
    "ConnectorZEN": "0",
    "ConnectorIP": "",
    "ConnectorPort": 0,
    "Host": "198.51.100.1",
    "Application": "Pune COE Receiver Logs - User Logs",
    "AppGroup": "Pune COE Receiver Logs - User Logs",
    "Server": "0",
    "ServerIP": "",
    "ServerPort": 30161,
    "PolicyProcessingTime": 66,
    "ServerSetupTime": 0,
    "TimestampConnectionStart": "2024-06-12T23:54:04.733Z",
    "TimestampConnectionEnd": "2024-06-12T23:54:04.735Z",
    "TimestampCATx": "2024-06-12T23:54:04.733Z",
    "TimestampCARx": "",
    "TimestampAppLearnStart": "",
    "TimestampZENFirstRxClient": "",
    "TimestampZENFirstTxClient": "",
    "TimestampZENLastRxClient": "",
    "TimestampZENLastTxClient": "",
    "TimestampConnectorZENSetupComplete": "",
    "TimestampZENFirstRxConnector": "",
    "TimestampZENFirstTxConnector": "",
    "TimestampZENLastRxConnector": "",
    "TimestampZENLastTxConnector": "",
    "ZENTotalBytesRxClient": 0,
    "ZENBytesRxClient": 0,
    "ZENTotalBytesTxClient": 0,
    "ZENBytesTxClient": 0,
    "ZENTotalBytesRxConnector": 0,
    "ZENBytesRxConnector": 0,
    "ZENTotalBytesTxConnector": 0,
    "ZENBytesTxConnector": 0,
    "Idp": "0",
    "ClientToClient": "0",
    "ClientCity": "Boardman",
    "MicroTenantID": "0",
    "AppMicroTenantID": "0"
  }
  

UDM 對應表

欄位對應參考資料：ZSCALER_ZPA

下表列出 ZSCALER_ZPA 記錄類型的記錄欄位，以及對應的 UDM 欄位。

還有其他問題嗎？向社群成員和 Google SecOps 專家尋求解答。