> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/integrations/alert/zscaler_alert.md).

# ZScaler (Beta)

{% hint style="warning" %}
This is integration is currently in Beta. At this point in its development, any attempts to integrate with it will return a success, regardless of whether the information entered is accurate or not. For more information about our beta integrations, engage your Dropzone support representative.
{% endhint %}

The Dropzone platform integrates with [ZScaler](https://www.zscaler.com/company/about-zscaler), a cloud-based security platform offering services such as cloud firewalls, data loss prevention, zero trust network access (ZTNA), and automated threat inspections.

## Create an API Key

ZScaler requires a ZScaler Posture Control API key to enable.

To obtain an API Key, do the following:

* Navigate to Administration > Authentication & Authorization > API Keys
* Click "Create API Key"
* Name the key something memorable, such as "DropzoneAI"
* Assign the key the "SecOps" role
* Select a expiration date from the dropdown under "Revocation"

{% hint style="info" %}
To reduce the number of times you need to perform this integration, we recommend selecting Never or 3 Months
{% endhint %}

* Click "Create"

<figure><img src="/files/DbNLct8yEDAvd0UdH3v2" alt=""><figcaption><p>Create the API Key</p></figcaption></figure>

* Copy the API key for use later in the Dropzone UI where it is called "Client Secret," then close the window
* In the table of API Keys, locate the key you just generated
* Copy the Client ID shown for use later in the Dropzone UI, where it is called "Client ID"

<figure><img src="/files/pRjidsSfLyXAU5JG4FNC" alt=""><figcaption><p>Copy the Client ID</p></figcaption></figure>

## Enable ZScaler

To enable the Alert Source integration, you will need the following information:

| Dropzone Field | Source                                                                          |
| -------------- | ------------------------------------------------------------------------------- |
| Client ID      | The Client ID value you generated earlier                                       |
| Client Secret  | The Client Secret value you generated earlier                                   |
| Vanity Domain  | The domain name of your organization, e.g. https\://\<your\_domain>.zslogin.net |
| Cloud          | Your Cloud environment, e.g. zscalerone, zscloud, etc                           |

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

<figure><img src="/files/zN02u3HObDaemUY8E1kD" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Available"

<figure><img src="/files/brI7n2Ux40Tk0jTwBCVh" alt=""><figcaption><p>Click Available</p></figcaption></figure>

* In the Search bar, search ZScaler, then click "Configure"

<figure><img src="/files/5ulthQQQPxd3QiCvAmjY" alt=""><figcaption><p>The ZScaler Tile</p></figcaption></figure>

* Under the Alert Source header, input the Client ID, Client Secret, and Vanity Domain
* Select your cloud environment from the dropdown

<figure><img src="/files/ZJiawKKH2RLWWwxbXa2J" alt=""><figcaption><p>The ZScaler Alert Source Configuration (pt 1)</p></figcaption></figure>

* If you wish, you may choose to filter alerts by [event name](https://help.zscaler.com/zpa/viewing-and-managing-events-diagnostics#eventTable:~:text=the%20Component%20section.-,Event,-Name%3A%20See)
  * Under "Event Filter Mode," select whether to include or exclude the names matching the filters
  * Click "Add Item" under "Event Name Regexes" section, then input a custom regex pattern to filter results

<figure><img src="/files/7IUq4jytiLrp0pd6nIeO" alt=""><figcaption><p>The ZScaler Alert Source Configuration (pt 2)</p></figcaption></figure>

* Input your desired poll interval and lookback

<figure><img src="/files/EbxJMIbYnSnzbZd7V2Da" alt=""><figcaption><p>The ZScaler Alert Source Configuration (pt 3)</p></figcaption></figure>

* If you wish to further filter alerts using the Python [CEL](https://python-common-expression-language.readthedocs.io/en/stable/tutorials/cel-language-basics/) package, check the box labeled "Use advanced filtering"
* Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
* Contact your Dropzone AI support representative for more information about this feature

<figure><img src="/files/infLIQONnAkvK8XGXOi4" alt=""><figcaption><p>The ZScaler Alert Source Configuration (pt 4)</p></figcaption></figure>

* Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.