Zscaler Digital Experience (ZDX)
Connect Zscaler Digital Experience to RAD Security and query ZDX devices, users and their locations, application experience scores and alerts.
RAD Security connects directly to the ZDX API with an API key and imports four objects into four data types: devices (with hardware, software and network detail), users (with where their devices were seen), application experience scores and alerts.
Read-only integration. RAD only reads ZDX data. It never changes ZDX configuration and never starts deep traces.
Early access. This integration is enabled on request. Ask your RAD Security contact to turn it on for your workspace.
Prerequisites
- A ZDX tenant on the classic ZDX Admin Portal. Tenants on ZIdentity / OneAPI are not yet supported.
- Permission to create API keys in the ZDX Admin Portal
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One row per | Refreshed |
|---|---|---|---|
| Devices | zscaler_zdx_devices | device active in the last 7 days | every 4 hours |
| Users | zscaler_zdx_users | user active in the last 7 days | every 4 hours |
| Application scores | zscaler_zdx_apps | monitored application | every 4 hours |
| Alerts | zscaler_zdx_alerts | alert | hourly |
- Devices: name, user and email,
host_nameas ZDX reports it and a normalizedhostnamethat joins Lansweeper and the other Zscaler integrations, NetBIOS name, OS, logged-in user, Client Connector and ZDX versions, hardware model, manufacturer and type, serial number, memory, disk, CPU, and the network adapters (type, status, IPv4, IPv6, MAC, gateway, SSID — index-aligned, entry i is adapter i).detail_fetched = 0marks a device stored with list fields only. - Users: name, email, their devices, and where each device was seen — country, state and city (
geo_*, one entry per device and location) and Zscaler location (zs_location_*) - Application scores: the ZDX score (0–100) over the 4 hours before the pass, total and active users and devices, poor / okay / good counts, most impacted city, region and country
- Alerts: rule, severity, type, status, start and end times, application, affected departments, locations and geolocations, and the number of devices
Step 1: Create an API key in ZDX
Open API Key Management
In the ZDX Admin Portal open Administration > API Key Management.
Create a key with a read-only role
Add a key for RAD and give it a read-only role that can read devices, users, applications and alerts.
Copy the key ID and secret
ZDX shows the secret only once, when the key is created. Copy it with the key ID.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Secure Access, add Zscaler Digital Experience and fill in the fields.
| Field | Value |
|---|---|
| Cloud | zdxcloud (api.zdxcloud.net) for production tenants, zdxbeta for beta |
| API key ID | The key ID |
| API key secret | The key's secret |
The secret never leaves RAD: each token request sends a SHA-256 hash of the secret and a timestamp, as ZDX requires.
Once the status shows Connected, the first inventory pass runs and alerts are read back 7 days.
Reading the data
Devices and users are the last 7 days
ZDX lists devices and users that were active in a time window. RAD asks for the last 7 days, so a laptop that was off for a weekend is still in the inventory. Every pass rewrites what it reads; a device inactive for longer stops being rewritten and drops out of windowed reads.
Alerts update in place
An alert is read while it is ongoing and again after it ends. Each read rewrites the same row, so an ongoing alert becomes ended in place with its ended_on time; started_on is the time the view filters on.
Sync cadence and API budget
| What | Cadence |
|---|---|
| Devices, users, application scores | full pass every 4 hours |
| Alerts | hourly: every ongoing alert, then historical alerts from where the last read stopped |
A pass reads one detail call per device, paced at two calls a second — roughly 9 minutes per 1,000 devices.