Package zscaler/private-access Release Notes

Package zscaler/private-access Release Notes Version 1.4.0 (2025-11-11)

  • Enhanced parser with comprehensive ECS field mappings for all ZPA log types

  • Added support for app connector metrics logs

  • Improved field normalization with proper source/destination/client/server mappings

  • Enhanced network traffic analysis with ingress/egress byte tracking

  • Added comprehensive event categorization and outcome determination

  • Improved timestamp handling across all log types

  • Enhanced user and authentication event processing

  • Added proper host infrastructure monitoring fields

  • Improved security inspection rule mapping

  • Enhanced geographic location tracking for all components

Package zscaler/private-access Release Notes Version 1.3.3 (2025-10-20)

  • Updated ECS version to 9.1.0

  • Removed timezone parameter from parseTimestamp function

Package zscaler/private-access Release Notes Version 1.3.2 (2025-06-02)

  • Added support for private cloud controller status logs

  • Improved log type detection for logs without sourcetype field

  • Enhanced log format detection for various ZPA log types

Package zscaler/private-access Release Notes Version 1.3.1 (2025-02-13)

  • Migrated from manual array element declaration (e.g. event.category[0] := "value") to use the array:append() function (e.g. array:append(array="event.category[]", values=["values"])). This ensures that manual array element declarations won't collide with each other.

  • Deprecation and removal of several legacy ZScaler Private Access parsers in favor of the unified zscaler-private-access parser, including:

    • zscaler-zpa-app-connector-status-json

    • zscaler-zpa-app-protection-json

    • zscaler-zpa-audit-json

    • zscaler-zpa-browser-access-json

    • zscaler-zpa-user-activity-json

    • zscaler-zpa-user-status-json

Package zscaler/private-access Release Notes Version 1.3.0 (2024-12-19)

  • Improves the field extraction and performance.

  • Moves all x509.* fields under the tls.client namespace to comply with ECS.

  • Bumps ecs.version to 8.16.0.

Package zscaler/private-access Release Notes Version 1.2.1 (2024-11-12)

  • Adds support for parsing and processing logs in the default ZPA format.

  • Drops the observer.type field.

Package zscaler/private-access Release Notes Version 1.2.0 (2024-10-11)
Parser renaming and Deprecation notice

As part of our continuous efforts to simplify and improve parser performance, we consolidated all existing parsers in this package into a single unified zscaler-privateaccess parser. This means the following parsers:

  • zscaler-zpa-app-connector-status-json

  • zscaler-zpa-app-protection-json

  • zscaler-zpa-audit-json

  • zscaler-zpa-browser-access-json

  • zscaler-zpa-user-activity-json

  • zscaler-zpa-user-status-json

    are deprecated and all future changes will only go into the new zscaler-privateaccess parser. The new parser requires a change on the Zscaler side in the log format for Zscaler Private Access sources.

    Follow the steps outlined below for the migration process:

  • Create new ingest token and associate it with the new zscaler-privateaccess parser

  • In the ZPA administration console:

    • create a new log receiver and configure it with your LogScale Collector's IP address, TCP port, and TLS encryption details (if required)

    • Under the Log Stream tab, set the new log format for a log type which you want to send into LogScale

    • Configure LogScale Collector to receive ZPA logs with new format

    • Confirm that data with new format is successfully ingested into LogScale

    • Delete the ingest tokens for old parsers

    • Delete the configuration for old parsers in the LogCollector

    • Remove the configuration for the old format in the ZPA console

Misc

  • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

  • Improves the field extraction and performance.

Package zscaler/private-access Release Notes Version 1.1.0 (2024-06-05)

  • Improves the field extraction and performance.

  • Sets the event.category, event.type and the event.outcome fields based on the source data.

  • Adds observer.type, package.version, server.bytes, event.action fields and more.

Package zscaler/private-access Release Notes Version 1.0.0 (2024-04-16)

  • Adds new event.module and Cps.version fields

  • Removes the Product, related.user, related.hosts and related.ip fields

  • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

Package zscaler/private-access Release Notes Version 0.2.0 (2023-11-21)

  • Changes the parsers to normalise event data to common schema.

  • Removes dashboards from the package. To keep those, stay on the old version of the package.

  • Bumps the minimum supported version of LogScale from 1.20 to 1.82.