Zscaler Internet Access (ZIA)
Connect Zscaler Internet Access to RAD Security and query ZIA users, devices, locations and the admin audit log.
RAD Security connects directly to the ZIA API with a read-only admin and imports four objects into four data types: users, devices, locations and the admin audit log.
Read-only integration. RAD logs in as a ZIA admin, reads, and logs out at the end of every cycle. It never changes ZIA policy or configuration.
Early access. This integration is enabled on request. Ask your RAD Security contact to turn it on for your workspace.
Prerequisites
- A ZIA tenant that signs in to the classic admin portal (
admin.<cloud>.net). Tenants on ZIdentity / OneAPI are not yet supported. - Permission to create an admin and to view the Cloud Service API Key
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One row per | Refreshed |
|---|---|---|---|
| Users | zscaler_zia_users | user | every 4 hours |
| Devices | zscaler_zia_devices | device | every 4 hours |
| Locations | zscaler_zia_locations | location or sub-location | every 4 hours |
| Admin audit log | zscaler_zia_admin_audit_logs | audit entry | hourly |
- Users: name, email, department, groups, admin flag, type, authentication methods, deleted flag
- Devices: name,
host_nameas ZIA reports it and a normalizedhostname(short, lowercase) that joins Lansweeper and the other Zscaler integrations, device group type, model, OS type and version, owner - Locations: country, state, time zone, IP addresses, bandwidth, and the security settings — authentication, SSL inspection, firewall, IPS, AUP, caution, XFF, surrogate IP, IoT discovery, IPv6 — plus VPN credentials and location groups. Sub-locations carry their parent.
- Admin audit log: when (
event_time), which admin from which client IP, the action, category and sub-category, the resource, the interface, the result, and the before and after values
Step 1: Prepare credentials in ZIA
Find your cloud
Your cloud is the second part of your admin portal address: admin.zscalertwo.net is zscalertwo.
Create a read-only admin
In the ZIA admin portal open Administration > Administrator Management and add an admin for RAD, for example rad-security@yourcompany.com, with a read-only role that can view users, devices, locations and the admin audit log. Use a service mailbox, not a person's account.
Copy the API key
Open Administration > Cloud Service API Security > Cloud Service API Key and copy your organization's API key.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Secure Access, add Zscaler Internet Access and fill in the fields.
| Field | Value |
|---|---|
| Cloud | Your ZIA cloud: zscaler, zscalerone, zscalertwo, zscalerthree, zscloud, zscalerbeta, zscalergov, zscalerten or zspreview |
| API admin username | The admin from Step 1 |
| API admin password | That admin's password |
| API key | The Cloud Service API key |
RAD only calls the API host of the cloud you pick (zsapi.<cloud>.net); the host is never built from free text.
Once the status shows Connected, the first inventory pass runs and the audit log is read back 7 days.
Reading the data
The latest pass is the inventory
Users, devices and locations are re-read in full every 4 hours, every row stamped with the time the pass started. Something deleted in ZIA stops being rewritten and drops out of windowed reads; the default view shows the last 24 hours.
The audit log is windowed on when the change happened
event_time is when the admin made the change; timestamp is when RAD stored it. Filter and sort audit entries by event_time.
Sync cadence and API budget
| What | Cadence |
|---|---|
| Users, devices, locations | full pass every 4 hours |
| Admin audit log | hourly, 5 minutes behind real time; the first read reaches back 7 days |
ZIA allows 20 read calls per 10 seconds per admin; RAD paces itself below that.
ZIA runs one audit-log export per organization at a time, shared with admins exporting from the portal. RAD never cancels a running export: if one is in progress, it waits and collects its own report on a later cycle. Long manual exports can therefore delay the audit log in RAD by an hour or two.