Skip to main content

Integrating Right-Hand HRM platform with Zscaler

Written by Shailanchal Uniyal

Integrate Zscaler with Right-Hand's HRM

Prerequisites

Before you begin, make sure you have:

  • Admin access to your portal

  • Admin access to your Zscaler Internet Access (ZIA) Admin Portal

  • CloudNSS feeds enabled in Zscaler

  • About 10-15 minutes to complete the setup

Step 1: Generate Your Integration Token

First, you'll create a secure token that allows Zscaler to send data to Cyberready.

  1. Log in to your Right-Hand portal

  2. Go to Human Risk Management > Settings

  3. Find the Zscaler integration card

  4. Click Configure

  5. Click Generate Token

  6. Copy and save this token (This is your bearer token) - you'll need it in the next step

Pro tip: Store this token somewhere secure, like a password manager.

Bearer token format: Authorization tokens are issued as JWE (encrypted JWT) values in compact serialization - five base64url segments separated by periods: header.encrypted_key.iv.ciphertext.tag.

Example (truncated for illustration):
​eyJjdHkiOiJKc1QiLCJlblMiOiJBMpU5R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.*****************.********.****************.*********

Step 2: Enable Cloud NSS in Zscaler (If Needed)

⚠️ Important: Cloud NSS Feeds is disabled by default in ZIA. If you don't see the Cloud NSS Feeds tab in step 3, contact Zscaler support to enable it for your tenant first.

Step 3: Log in and navigate

  1. Log in to your ZIA Admin Portal.

  2. Go to Logs > Log Streaming > Internet Log Streaming - Nanolog Streaming Service.

    Note: In older versions of the ZIA Admin Portal, this page was located under Administration > Nanolog Streaming Service. If your portal still shows it there, use that path instead - the page contents are the same.

  3. Select the Cloud NSS Feeds tab under Nanolog Streaming Service.

  4. Click Add Cloud NSS Feed.

Step 4: Configuration in Cloud NSS Feed

Fill in the configuration

Basic Settings:

  • Feed Name: Enter a descriptive name (example: "Cyberready HRM Feed")

  • NSS Type: Select "NSS for Web"

  • Status: Select "Enabled"

  • SIEM Type: Select "Other"

Connection Settings:

  • API URL: https://hrm.api.right-hand.ai/api

  • HTTP Header:

    • Key: Authorization

    • Value: Paste the bearer token that you generated in step 1

Log Format Settings:

  • Log Type: Web Log

  • Feed Output Type: JSON

  • JSON Array Notation: Disabled

  • Feed Escape Character: Leave blank

  • Feed Output Format: Default JSON format

  • Timezone: GMT

  • Duplicate Logs: Disabled

Important note: Double-check that JSON Array Notation is set to Disabled - Cyberready's endpoint expects one JSON object per request, not a batched array.

Filtering Settings:

  • Web Log Filters:

    • Policy Action: Blocked

    • Policy Reason: Any

Step 5: Save and activate

  1. Click Save.

  2. Click Activate (top-right of the ZIA Admin Portal) to push the configuration live.

Important: Changes in ZIA stay in a draft/pending state until you activate them. Clicking Save alone does not make the feed active - you must also click Activate.

You're All Set!

Your Zscaler system will now stream blocked web activity logs to Cyberready. Look for these logs in your Human Risk Management dashboard within a few hours.

Troubleshooting

  • I don't see the Cloud NSS Feeds tab.

    Cloud NSS isn't enabled on your tenant yet - contact Zscaler Support to enable it (see Step 2).

  • Logs aren't appearing in Cyberready after a few hours.

    Confirm you clicked Activate, not just Save, after configuring the feed.

    Also verify the API URL is entered exactly as https://hrm.api.right-hand.ai/api and that the Authorization header contains a valid, unexpired token from Step 1.

  • You're seeing delivery/format errors on the Cyberready side.

    Double-check that JSON Array Notation is set to Disabled - Cyberready's endpoint expects one JSON object per request, not a batched array.

Related article:
​
​Configuring the mapping attributes for HRM

Did this answer your question?