reference·updated 2026-07-19·v1: web logs

ZIA NSS web log fields — the practical reference

The tokens you put in an NSS feed decide what your SIEM can answer at 2 a.m. — and the official field list tells you the names but not the gotchas. This page is the working reference: what each commonly used web-log token means, and the footnotes that matter when the logs land in Splunk or LogScale. Scope note: v1 covers ZIA web logs — firewall, DNS, and tunnel feeds are planned. Spot an error? Tell me — this page trades on being right.

feed syntax in 30 seconds

NSS format strings substitute tokens: %s{name} for strings, %d{name} for decimal numbers, %02d{name} zero-pads. Token names are case-sensitive. The single best decision you can make: emit key=value pairs (e.g. action=%s{action}) — Splunk and LogScale auto-extract them, field order stops mattering, and future feed edits stop breaking parsers. Positional CSV feeds break the first time anyone adds a field, and URLs containing commas will corrupt naive delimiters — use the feed escaping options and test with ugly URLs.

time

token	what it is	gotchas
%s{time}	full timestamp of the transaction	NSS emits in the timezone configured on the feed — set it to UTC and keep every SIEM in UTC, or enjoy DST-shaped incident timelines
%d{epochtime}	epoch seconds	prefer this for SIEM ingestion; strings are for humans
%s{mon} %d{dd} %02d{hh}…	timestamp components	only useful for legacy positional formats — use epochtime instead

who & where

token	what it is	gotchas
%s{login}	authenticated user	if feed obfuscation is enabled this is a pseudonym — decide your privacy posture per region before promising user-level searches
%s{dept}	user's department	only as good as your IdP/SCIM hygiene; blank often means provisioning lag, not "no department"
%s{location}	ZIA location name	road warriors show the special roaming value, not an office — filter accordingly before per-office reports
%s{cip}	client IP	for roaming users this is the pre-NAT client address seen by the service edge — pair with location before assuming geography
%s{deviceowner} / %s{devicehostname}	device identity (client-connector traffic)	empty for tunnel/GRE traffic without ZCC — don't build device dashboards on web feeds alone

the request

token	what it is	gotchas
%s{url}	requested URL	commas/quotes inside URLs are why positional feeds corrupt — if you must stay positional, use %s{eurl}
%s{eurl}	URL, encoded	URL-encoded variant safe for delimited feeds; remember to decode at search time
%s{ehost}	destination host	host only — use it for tstats-style acceleration instead of wildcarding into url
%s{reqmethod}	HTTP method	CONNECT entries are the TLS tunnels — a spike usually means inspection scope changed
%s{ua}	user agent	truncated at feed limits; also your best signal for "which non-browser app is doing this"
%s{ereferer}	referring URL (encoded)	frequently empty on https-to-https navigation — absence proves nothing
%s{proto}	protocol of the transaction	HTTP vs HTTPS vs tunnel-ssl values — know them before writing "all TLS" searches

the verdict

token	what it is	gotchas
%s{action}	what ZIA did (allowed / blocked / …)	action values differ per policy engine — inventory the distinct values in YOUR tenant before building block-rate dashboards
%s{reason}	why — the policy reason string	the single most useful triage field; pair every action search with reason
%s{ruletype} / %s{rulelabel}	which policy type + which named rule fired	rulelabel is your change-correlation field — "when did rule X start hitting" answers most 'since when' tickets
%d{respcode}	HTTP status returned to the client	a Zscaler block page is still a 200 to the browser in some flows — never use respcode alone to find blocks; that's what action/reason are for ⚠ verify current behavior in your tenant

categories & apps

token	what it is	gotchas
%s{urlsupercat}	URL super-category	the coarse bucket — good for exec reporting, useless for triage
%s{urlcat}	URL category	the field that changes when a vendor recategorization breaks something — alert on category transitions for business-critical hosts
%s{urlclass}	URL class (bandwidth/legal/etc. grouping)	rarely what you want in searches; know it exists so you don't confuse it with urlcat
%s{appname} / %s{appclass}	cloud app + app class	app identification catches what URL categories miss (API endpoints, CDNs) — use both in shadow-IT hunts

threats & DLP

token	what it is	gotchas
%s{malwareclass} / %s{malwarecat}	threat classification	empty ≠ clean — unscanned traffic (bypasses, size limits) never got a verdict; pair with unscannabletype
%s{threatname}	specific threat name	the field your IR team wants verbatim in tickets
%d{riskscore}	site risk score	useful as a hunt filter; don't alert on it alone
%s{dlpeng} / %s{dlpdict}	DLP engine + dictionary that matched	only populated when DLP evaluated the transaction — absence usually means "not scanned," not "no match"
%s{filetype} / %s{filename}	file type + name on up/downloads	filetype is detected type, not extension — that mismatch is itself a detection
%s{bamd5}	file MD5 (sandbox/behavioral analysis)	your pivot key to sandbox reports and threat intel ⚠ verify token name in your feed builder
%s{unscannabletype}	why content couldn't be scanned	the honest counterpart to every "we inspect everything" slide

sizes & performance

token	what it is	gotchas
%d{reqsize} / %d{respsize}	request / response bytes	exfil hunts want reqsize; capacity dashboards want respsize; don't sum them into one "traffic" number without saying so
%d{totalsize}	request + response total	convenient, but ambiguous in reports — label your units and direction
%s{contenttype}	response content type	pairs with filetype for download hunts; often generic (octet-stream) exactly when you care most
latency tokens	transaction timing fields	⚠ the web feed exposes timing tokens for transaction latency, but names and semantics vary by feed builder version — confirm them in your own builder before you rely on them for slow-site triage

building the feed: the five decisions

key=value, always. Auto-extraction beats positional parsing everywhere it's supported.
UTC, everywhere. Feed timezone, SIEM index time, dashboards — one zone or none.
Emit reason and rulelabel from day one. The two fields every "why was this blocked / since when" ticket needs, and the ones most default feeds omit.
Test with hostile URLs. Commas, quotes, non-ASCII — before production, not after the first corrupted day of logs.
Write the field names down where the SIEM team can see them. The feed format is config; treat it like the firewall policy it is — golden copy included.

Primary sources: Zscaler NSS web log format · NSS feed guidelines. Rows marked ⚠ await verification against the current feed builder — corrections welcome.

more references are coming

Firewall, DNS, and tunnel log fields are next, plus the log-fields chapter of the upcoming field guide goes deeper — subscribe and you'll know when they land.

One confirmation email, then you're in. Unsubscribe anytime.