Outgoing feed - Zscaler Outgoing Feed#

Note

This article describes how to configure outgoing feeds for a particular feed source. To see how to configure outgoing feeds in general, see Create and configure outgoing feeds.

Specifications

Transport type

Zscaler Outgoing Feed

Content type

Zscaler JSON model

Published data

The Zscaler Outgoing Feed outgoing feed publishes supported observables to a URL category on Zscaler Internet Access (ZIA), which you can then apply URL Filtering rules to.

Requirements#

  • Zscaler user name

  • Zscaler password

  • Zscaler base URI

  • Zscaler API key

  • (Optional) URL category ID

Information about your Zscaler user name, password, base URI, and API key can be found at ZIA: Getting started.

Configure the outgoing feed#

  1. Create or edit an outgoing feed.

  2. Under Transport and content, fill out these fields:

    Note

    Required fields are marked with an asterisk (*).

    Field

    Description

    Transport type*

    Select Zscaler Outgoing Feed from the drop-down menu.

    Content type*

    Select Zscaler JSON model from the drop-down menu.

    Datasets*

    Select one or more existing datasets from the drop-down menu. The menu only displays datasets that contain observables supported by the Transport type you’ve selected.

    For more information, see Supported observable types.

    Update strategy*

    Select an update strategy.

    Supported update strategies:

    • APPEND

    API URL*

    Retrieve your base URI from the ZIA Admin Portal.

    For more information, see ZIA: Getting Started.

    Username*

    Enter your Zscaler user name.

    Password*

    Enter your Zscaler password.

    API key*

    Enter your Zscaler API key.

    Retrieve your API key from the ZIA Admin Portal. For more information, see ZIA: Getting Started.

    URL Category ID*

    Set to NON_CATEGORIZABLE by default.

    For more information, see URL category ID.

  3. Store your changes by selecting Save.

URL category ID#

By default, this outgoing feed sends supported observables to the “Non Categorizable” predefined URL category.

To change this, change the value of the URL Category ID field for this outgoing feed.

You can have the outgoing feed send observables to:

  • one of the predefined URL categories, or

  • an existing custom URL category.

You need to know the category ID of the URL category that you want to send observables to.

For a CSV list of predefined URL categories and their category IDs, go to ZIA: About URL Categories and look for a link to “Zscaler URL Categories.csv”.

The respective category IDs for predefined URL categories can be found in the “URL Category Enum Value (Cloud API)” column of the CSV file.

To find the category ID of a custom URL category, you may need to access the Zscaler Internet Access Cloud Service API or consult Zscaler customer support.

Supported observable types#

This outgoing feed supports the following observable types:

  • uri

  • domain

  • ipv4