Add OCSF normalization pipeline for Zscaler Private Access#24173
Add OCSF normalization pipeline for Zscaler Private Access#24173jbfeldman-dd wants to merge 4 commits into
Conversation
Map ZPA log types to OCSF classes: Authentication (3002) for audit-logs and user-status, Network Activity (4001) for user-activity and microsegmentation, HTTP Activity (4002) for app-protection and browser-access, Device Inventory Info (5001) for connector/PSE/PCC status, and API Activity (6003) for CRUD audit operations. Includes OCSF facets, pre-transformation pipeline for shared metadata, and validated test expectations. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Change schema-remapper to attribute-remapper in pre-transformations (schema-remapper is only valid inside schema-processor) - Add missing enabled attribute on the event_code remapper - Fix facet definitions to match existing cross-integration conventions (names, types) per validate-logs conflict resolution - Align test expected output with CI pipeline engine format Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Validation ReportAll 21 validations passed. Show details
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58ee1f7cc9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - type: schema-remapper | ||
| name: Map `Connector` to `ocsf.device.name` | ||
| sources: | ||
| - Connector |
There was a problem hiding this comment.
When this shared Device Inventory pipeline handles private-service-edge-status or private-cloud-controller-status (the filter includes both services), the configured log formats populate ServiceEdge/PrivateCloudController rather than Connector (see zscaler_private_access/README.md lines 123 and 143). Because this remapper only reads Connector, those OCSF events lose ocsf.device.name; include the service-specific name fields (and the matching group fields) or split the pipeline per service.
Useful? React with 👍 / 👎.
1 participant
What does this PR do?
Adds OCSF normalization to the Zscaler Private Access log pipeline, mapping all ZPA log types to their corresponding OCSF classes:
audit-logs(sign-in/sign-out events) anduser-statususer-activityandmicrosegmentationapp-protectionandbrowser-accessapp-connector-status,private-service-edge-status,private-cloud-controller-statusaudit-logsCRUD operations (Create, Update, Delete, Download)Also includes:
Motivation
Enable OCSF-normalized security telemetry for Zscaler Private Access logs, supporting standardized cross-vendor analysis in Datadog.
🤖 Generated with Claude Code, edited by humans