We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.
Stay organized with collections
Save and categorize content based on your preferences.
Change log for ZSCALER_ZPA_AUDIT
Date
Changes
2026-01-07
- Updated the field mapping for the Zscaler ZPA Audit parser.
- Please refer to the parser documentation page for information regarding the updated UDM mappings - https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/zscaler-zpa-audit#udm_mapping_delta
2025-11-18
- `Session Time Out`: Added support for the event `Session Time Out` and relevant corresponding raw log fields.
2025-10-16
- Updated the grok pattern to handle the ModifiedBy, ObjectID, and CustomerID raw log fields.
2025-04-30
- Promoted ZSCALER_ZPA_AUDIT Premium parser to default. You can see full details in the parser configuration page - https://cloud.google.com/chronicle/docs/ingestion/default-parsers/ingest-zscaler-logs
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-07-26 UTC."],[],[]]
