Skip to content

Zscaler DNS

Zscaler DNS


By using sophisticated machine learning techniques, the Zscaler service can detect DNS tunneling occurring in your network. You can create granular rules to control DNS tunnels as part of your DNS Control policy. You can also analyze and visualize your DNS tunnels and network applications. The service logs all detected DNS tunnels and network apps in DNS Insights. You can also view the most commonly encountered tunnels and apps in the DNS Overview dashboard.

Product Details

Vendor URL: Zscaler DNS

Product Type: DNS

Product Tier: Tier I

Integration Method: Custom

Log Guide: Sample Logs by Log Type

Parser Details

Log Format: JSON

Expected Normalization Rate: near 100%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
DNS metadata.product_name
Zscaler metadata.vendor_name
DNS network.application_protocol
event.srv_dip target.ip
event.srv_dport target.port
event.devicehostname principal.asset.hostname
event.clt_sip principal.ip
event.deviceowner principal.user.userid
event.department principal.user.department
Enumerated DNS questions dns_questions.type
event.durationms dns_answers.ttl
ALLOW or BLOCK security_result.action
event.category security_result.category_details
event.reqrulelabel security_result.rule_name

Product Event Types

Event UDM Event Classification
all events GENERIC_EVENT
srv_dport = 53 NETWORK_DNS

Log Sample

{"sourcetype":"zscalernss-dns","event":{"reqrulelabel":"Default Firewall DNS Rule","dns_req":"","category":"Finance","resrulelabel":"None","clt_sip":"","srv_dip":"","respipcategory":"Other","deviceowner":"userid","resaction":"Allow","dns_reqtype":"A","srv_dport":"53","datetime":"Sat Jul 16 00:05:53 2022","user":"userid","department":"Technology%20Services","location":"an office","reqaction":"Allow","dns_resp":"NXDOMAIN","durationms":"34000","devicehostname":"hostname"}}

Sample Parsing

metadata.event_type = "NETWORK_DNS"
metadata.vendor_name = "Zscaler"
metadata.product_name = "DNS"
principal.hostname = "hostname"
principal.user.userid = "userid"
principal.user.department = "Technology Services"
principal.ip = "" = "an office"
principal.asset.hostname = "hostname"
principal.asset.ip = ""
target.ip = ""
target.port = 53
target.asset.ip = ""
security_result.rule_name = "Default Firewall DNS Rule"
security_result.action = "ALLOW"
network.application_protocol = "DNS" = ""
network.dns.questions.type = 1
network.dns.answers.ttl = 34000 = "Other"

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon