Zscaler NSS web — configured JSON

Zscaler NSS web — configured JSON. A configured NSS web JSON export with an event envelope.

Source and collection

Device logging subsystem / configured remote syslog or vendor export.

Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 38e1d5ff8ce421c6dbd3566b2964ce850269608fb92cdc4c945b9074c8f0be2b

{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Mon Oct 16 22:55:48 2023","cloudname":"zscaler.net","host":"mail.google.com","serverip":"81.2.69.144","external_devid":"1234","devicemodel":"20L8S7WC08","action":"Allowed","recordid":"123456789","reason":"File Attachment Cautioned","threatseverity":"Critical (90–100)","tz":"GMT","filesubtype":"rar","upload_filesubtype":"rar","sha256":"81ec78bc8298568bb5ea66d3c2972b670d0f7459b6cdbbcaacce90ab417ab15c","bamd5":"196a3d797bfee07fe4596b69f4ce1141","filename":"nssfeed.txt","upload_filename":"nssfeed.exe","filetype":"RAR Files","devicename":"PC11NLPA:5F08D97BBF43257A8FB4BBF4061A38AE324EF734","devicehostname":"THINKPADSMITH","deviceostype":"iOS","deviceosversion":"Version 10.14.2 (Build 18C54)","devicetype":"Zscaler Client Connector","reqsize":"1300","reqmethod":"invalid","b64referer":"d3d3LmV4YW1wbGUuY29t","respsize":"10500","respcode":"100","reqversion":"1.1","respversion":"1","proto":"HTTP","company":"Zscaler","dlpmd5":"154f149b1443fbfa8c121d13e5c019a1","apprulelabel":"File_Sharing_1","dlprulename":"DLP_Rule_1","rulelabel":"URL_Filtering_1","urlfilterrulelabel":"URL_Filtering_1","cltip":"10.0.0.2","cltintip":"192.168.1.10","cltsourceport":"1235","threatname":"EICAR Test File","cltsslcipher":"SSL3_CK_RSA_NULL_MD5","clttlsversion":"SSL2","b64url":"d3d3LnRyeXRoaXNlbmNvZGV1cmwuY29tL2luZGV4","useragent":"Mozilla/5.0","login":"jdoe@safemarch.com","applayerprotocol":"FTP","appclass":"Administration","appname":"Adobe Connect","appriskscore":"None","bandwidthclassname":"Entertainment","bandwidthrulename":"Office 365","bwthrottle":"Yes","bypassedtime":"Mon Oct 16 22:55:48 2023","bypassedtraffic":"0","cltsslsessreuse":"Unknown","cltpubip":"10.0.0.3","cltsslfailcount":"100","cltsslfailreason":"Bad Record Mac","client_tls_keyex_pqc_offers":0,"client_tls_keyex_non_pqc_offers":0,"client_tls_keyex_hybrid_offers":1,"client_tls_keyex_unknown_offers":1,"client_tls_sig_pqc_offers":1,"client_tls_sig_non_pqc_offers":0,"client_tls_sig_hybrid_offers":1,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"X23319LMKEM788","client_tls_sig_alg":"rsa_pss_rsae_sha256","contenttype":"application/vnd_apple_keynote","datacentercity":"Sa","datacentercountry":"US","datacenter":"CA Client Node DC","day":"Mon","day_of_month":"16","dept":"Sales","dstip_country":"India","deviceappversion":"192.168.1.100","deviceowner":"jsmith","df_hosthead":"df_hosthead","df_hostname":"df_hostname","dlpdicthitcount":"4","dlpdict":"Credit Cards","dlpeng":"HIPAA","dlpidentifier":"6646484838839026000","eedone":"Yes","epochtime":"1578128400","fileclass":"Active Web Contents","flow_type":"Direct","forward_gateway_ip":"10.1.1.1","forward_gateway_name":"FWD_1","forward_type":"Direct","ft_rulename":"FT Name","hour":"22","is_sslexpiredca":"Yes","is_sslselfsigned":"Yes","is_ssluntrustedca":"Pass","is_src_cntry_risky":"Yes","is_dst_cntry_risky":"No","keyprotectiontype":"HSM Protection","location":"Headquarters","malwarecategory":"Adware","malwareclass":"Sandbox","minute":"55","mobappcategory":"Communication","mobappname":"Amazon","mobdevtype":"Google Android","module":"Administration","month":"Oct","month_of_year":"10","nssserviceip":"192.168.2.200","oapprulelabel":"5300295980","obwclassname":"10831489","ocip":"6200694987","ocpubip":"624054738","odevicehostname":"2168890624","odevicename":"2175092224","odeviceowner":"10831489","odlpdict":"10831489","odlpeng":"4094304256","odlprulename":"6857275752","ofwd_gw_name":"8794487099","ologin":"4094304256","ordr_rulename":"3399565100","ourlcat":"7956407282","ourlfilterrulelabel":"4951704103","ozpa_app_seg_name":"7648246731","externalsslpolicyreason":"Blocked","productversion":"5.0.902.95524_04","prompt_req":"Prompt","rdr_rulename":"FWD_Rule_1","refererhost":"www.example.com for http://www.example.com/index.html","reqheadersize":"300","reqdatasize":"1000","respheadersize":"500","respdatasize":"10000","riskscore":"10","ruletype":"File Type Control","second":"48","srcip_country":"India","srvcertchainvalpass":"Unknown","srvcertvalidationtype":"EV (Extended Validation)","srvcertvalidityperiod":"Short","srvsslcipher":"SSL3_CK_RSA_NULL_MD5","serversslsessreuse":"Unknown","server_tls_keyex_alg":"X23319LMKEM788","server_tls_sig_alg":"rsa_pss_rsae_sha256","srvocspresult":"Good","srvtlsversion":"SSL2","srvwildcardcert":"Unknown","ssldecrypted":"Yes","ssl_rulename":"SSL Policy","throttlereqsize":"5","throttlerespsize":"7","totalsize":"11800","trafficredirectmethod":"DNAT (Destination Translation)","unscannabletype":"Encrypted File","upload_doctypename":"Corporate Finance","upload_fileclass":"upload_fileclass","upload_filetype":"RAR Files","urlcatmethod":"Database A","urlsubcat":"Entertainment","urlsupercat":"Travel","urlclass":"Bandwidth Loss","useragentclass":"Firefox","useragenttoken":"Google Chrome (0.x)","userlocationname":"userlocationname","year":"2023","ztunnelversion":"ZTUNNEL_1_0","zpa_app_seg_name":"ZPA_test_app_segment"}}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`version`	str
`sourcetype`	str
`event.time`	str
`event.cloudname`	str
`event.host`	str
`event.serverip`	str
`event.external_devid`	str
`event.devicemodel`	str
`event.action`	str
`event.recordid`	str
`event.reason`	str
`event.threatseverity`	str
`event.tz`	str
`event.filesubtype`	str
`event.upload_filesubtype`	str
`event.sha256`	str
`event.bamd5`	str
`event.filename`	str
`event.upload_filename`	str
`event.filetype`	str
`event.devicename`	str
`event.devicehostname`	str
`event.deviceostype`	str
`event.deviceosversion`	str
`event.devicetype`	str
`event.reqsize`	str
`event.reqmethod`	str
`event.b64referer`	str
`event.respsize`	str
`event.respcode`	str
`event.reqversion`	str
`event.respversion`	str
`event.proto`	str
`event.company`	str
`event.dlpmd5`	str
`event.apprulelabel`	str
`event.dlprulename`	str
`event.rulelabel`	str
`event.urlfilterrulelabel`	str
`event.cltip`	str
`event.cltintip`	str
`event.cltsourceport`	str
`event.threatname`	str
`event.cltsslcipher`	str
`event.clttlsversion`	str
`event.b64url`	str
`event.useragent`	str
`event.login`	str
`event.applayerprotocol`	str
`event.appclass`	str
`event.appname`	str
`event.appriskscore`	str
`event.bandwidthclassname`	str
`event.bandwidthrulename`	str
`event.bwthrottle`	str
`event.bypassedtime`	str
`event.bypassedtraffic`	str
`event.cltsslsessreuse`	str
`event.cltpubip`	str
`event.cltsslfailcount`	str
`event.cltsslfailreason`	str
`event.client_tls_keyex_pqc_offers`	int
`event.client_tls_keyex_non_pqc_offers`	int
`event.client_tls_keyex_hybrid_offers`	int
`event.client_tls_keyex_unknown_offers`	int
`event.client_tls_sig_pqc_offers`	int
`event.client_tls_sig_non_pqc_offers`	int
`event.client_tls_sig_hybrid_offers`	int
`event.client_tls_sig_unknown_offers`	int
`event.client_tls_keyex_alg`	str
`event.client_tls_sig_alg`	str
`event.contenttype`	str
`event.datacentercity`	str
`event.datacentercountry`	str
`event.datacenter`	str
`event.day`	str
`event.day_of_month`	str
`event.dept`	str
`event.dstip_country`	str
`event.deviceappversion`	str
`event.deviceowner`	str
`event.df_hosthead`	str
`event.df_hostname`	str
`event.dlpdicthitcount`	str
`event.dlpdict`	str
`event.dlpeng`	str
`event.dlpidentifier`	str
`event.eedone`	str
`event.epochtime`	str
`event.fileclass`	str
`event.flow_type`	str
`event.forward_gateway_ip`	str
`event.forward_gateway_name`	str
`event.forward_type`	str
`event.ft_rulename`	str
`event.hour`	str
`event.is_sslexpiredca`	str
`event.is_sslselfsigned`	str
`event.is_ssluntrustedca`	str
`event.is_src_cntry_risky`	str
`event.is_dst_cntry_risky`	str
`event.keyprotectiontype`	str
`event.location`	str
`event.malwarecategory`	str
`event.malwareclass`	str
`event.minute`	str
`event.mobappcategory`	str
`event.mobappname`	str
`event.mobdevtype`	str
`event.module`	str
`event.month`	str
`event.month_of_year`	str
`event.nssserviceip`	str
`event.oapprulelabel`	str
`event.obwclassname`	str
`event.ocip`	str
`event.ocpubip`	str
`event.odevicehostname`	str
`event.odevicename`	str
`event.odeviceowner`	str
`event.odlpdict`	str
`event.odlpeng`	str
`event.odlprulename`	str
`event.ofwd_gw_name`	str
`event.ologin`	str
`event.ordr_rulename`	str
`event.ourlcat`	str
`event.ourlfilterrulelabel`	str
`event.ozpa_app_seg_name`	str
`event.externalsslpolicyreason`	str
`event.productversion`	str
`event.prompt_req`	str
`event.rdr_rulename`	str
`event.refererhost`	str
`event.reqheadersize`	str
`event.reqdatasize`	str
`event.respheadersize`	str
`event.respdatasize`	str
`event.riskscore`	str
`event.ruletype`	str
`event.second`	str
`event.srcip_country`	str
`event.srvcertchainvalpass`	str
`event.srvcertvalidationtype`	str
`event.srvcertvalidityperiod`	str
`event.srvsslcipher`	str
`event.serversslsessreuse`	str
`event.server_tls_keyex_alg`	str
`event.server_tls_sig_alg`	str
`event.srvocspresult`	str
`event.srvtlsversion`	str
`event.srvwildcardcert`	str
`event.ssldecrypted`	str
`event.ssl_rulename`	str
`event.throttlereqsize`	str
`event.throttlerespsize`	str
`event.totalsize`	str
`event.trafficredirectmethod`	str
`event.unscannabletype`	str
`event.upload_doctypename`	str
`event.upload_fileclass`	str
`event.upload_filetype`	str
`event.urlcatmethod`	str
`event.urlsubcat`	str
`event.urlsupercat`	str
`event.urlclass`	str
`event.useragentclass`	str
`event.useragenttoken`	str
`event.userlocationname`	str
`event.year`	str
`event.ztunnelversion`	str
`event.zpa_app_seg_name`	str

Envelope: Priority, timestamp and hostname depend on the transport format.
Message payload: Use the exact vendor message type and version, not a generic whitespace split.

Investigation uses

Review URL, user, action and destination in the configured feed.
Compare device event time and collector time; monitor drops and preserve the original message.

Validation boundaries

NSS output templates are configurable; this example is not a universal Zscaler schema.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.