Hello,
The ingest pipeline of the Zscaler integration produces the error message -For input string: "NA"-
when the reqmethod is not present, propably beacause respcode is also "NA" and not a number.
Please add conditionals to the pipelines logic.
example log:
{"sourcetype" : "zscalernss-web", "event" :{"time":"Thu Feb 16 10:17:13 2023","login":"deleted@deleted.com","proto":"SSL","eurl":"outlook.office365.com","dhost":"outlook.office365.com","action":"Allowed","reason":"Allowed","appname":"Outlook (Office 365)","appclass":"Webmail","reqsize":"50332","respsize":"2486375","stime":"81000","ctime":"81000","urlclass":"Business Use","urlsupercat":"Internet Communication","urlcat":"Webmail","malwarecat":"None","malwareclass":"None","threatname":"None","riskscore":"0","fileType":"None","location":"deleted","dept":"deleted","cip":"0.0.0.0","sip":"0.0.0.0","src":"0.0.0.0","reqmethod":"NA","respcode":"NA","ua" :"Unknown","ereferer":"None","ruletype":"None","rulelabel":"None","contenttype":"Other","unscannabletype":"None","deviceowner":"deleted","devicehostname":"deleted","md5hash":"None"}
Kind regards.
Hello,
The ingest pipeline of the Zscaler integration produces the error message -For input string: "NA"-
when the reqmethod is not present, propably beacause respcode is also "NA" and not a number.
Please add conditionals to the pipelines logic.
example log:
{"sourcetype" : "zscalernss-web", "event" :{"time":"Thu Feb 16 10:17:13 2023","login":"deleted@deleted.com","proto":"SSL","eurl":"outlook.office365.com","dhost":"outlook.office365.com","action":"Allowed","reason":"Allowed","appname":"Outlook (Office 365)","appclass":"Webmail","reqsize":"50332","respsize":"2486375","stime":"81000","ctime":"81000","urlclass":"Business Use","urlsupercat":"Internet Communication","urlcat":"Webmail","malwarecat":"None","malwareclass":"None","threatname":"None","riskscore":"0","fileType":"None","location":"deleted","dept":"deleted","cip":"0.0.0.0","sip":"0.0.0.0","src":"0.0.0.0","reqmethod":"NA","respcode":"NA","ua" :"Unknown","ereferer":"None","ruletype":"None","rulelabel":"None","contenttype":"Other","unscannabletype":"None","deviceowner":"deleted","devicehostname":"deleted","md5hash":"None"}
Kind regards.