---
title: "Zscaler Deception Logs"
slug: "zscaler-deception-logs"
tags: ["Self Service Ingestion"]
updated: 2026-04-29T05:45:42Z
published: 2026-04-29T05:45:42Z
canonical: "docs.hunters.ai/zscaler-deception-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Zscaler Deception Logs

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Data Types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Zscaler Deception Logs |  | ✅ | ✅ | ✅ | zscaler_deception_logs | nested-json-json | S3 |

---

## Overview

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/55be905-zscaler.png)Zscaler (NASDAQ: ZS) is a pioneering American cloud-based cybersecurity company, founded in 2007 and headquartered in San Jose, California, that provides specialized "zero trust" security services. It offers a cloud-native platform, the Zscaler Zero Trust Exchange, that acts as an intelligent, secure switchboard, routing user traffic through a global network of over 150 data centers to protect data and applications from modern cyber threats without relying on traditional, on-premises firewalls or VPNs. Key products include Zscaler Internet Access (ZIA) for secure browsing and Zscaler Private Access (ZPA) for secure application access, serving over 40% of the Forbes Global 2000 by securely connecting users, devices, and applications in any location

## Supported data types

### Zscaler Deception Logs

**Overview:**

Zscaler Deception logs integration seamlessly transmits high-fidelity threat data in real-time to SIEM, SOAR, and analytics platforms, enhancing visibility into post-compromise activity like lateral movement. By configuring Syslog or API-based connectors, organizations can enrich security workflows, enabling automatic isolation of attackers and accelerated incident response within a Zero Trust architecture. The integration allows filtering, log forwarding to specific consoles, and centralized monitoring of decoy interactions, turning reconnaissance attempts into actionable intelligences. **Table name:** `zscaler_deception_logs`

#### Send data to Hunters

Hunters supports the ingestion of Zscaler Deception Logs via an intermediary AWS S3 bucket.

**To connect Zscaler Deception Logs:**

1. Export your logs from Zscaler Deception Logs to an AWS S3 bucket.
2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](/v1/docs/connect-data-through-aws-s3).

**Expected format**

Logs are expected in **Nested-json-json:**

```json
{"time":1700000000000,"log_source":"event","event":{"attacker.id":"account-id-1","attacker.name":"service-account-1","credtheft.access_list":"%v84","credtheft.access_mask":"0x10","credtheft.event_id":"1234","credtheft.handle_id":"0x0","credtheft.object_name":"object-guid-1","credtheft.object_server":"DS","credtheft.object_type":"user","credtheft.operation_type":"Object Access","credtheft.properties":["line1","line2"],"credtheft.subject_domain_name":"domain1","credtheft.subject_logon_id":"0x14B1C1593","credtheft.subject_user_name":"service-account-1","credtheft.subject_user_sid":"S-1-5-21-0000000000-0000000000-0000000000-1001","credtheft.system_time":"2020-01-15T10:00:00.000Z","credtheft.trigger_properties":["Service-Principal-Name","Admin-Count"],"decoy.ad.asrep_roastable":true,"decoy.ad.can_password_expire":false,"decoy.ad.ou":"ou-value","decoy.ad.profile_path":"\\\\fileserver\\share","decoy.appliance.id":"appliance-id-1","decoy.appliance.name":"APPLIANCE-1","decoy.client.id":"client-id-1","decoy.client.name":"client-name-1","decoy.group":"Active Directory","decoy.id":"decoy-id-1","decoy.name":"decoy-name-1","decoy.type":"credtheft","kill_chain_phase":"Privilege Escalation","sub_type":"honeypot-buster","timestamp":"2020-01-15T10:00:37Z","type":"credtheft","attacker.threat_parse_ids":["credtheft_honeypotbuster"],"attacker.score":100,"mitre_ids":["T1087.002"],"severity":"high","score":100,"threat_parse_ids":["credtheft_honeypotbuster"],"is_itdr":false,"whitelisted":false,"id":"2020-01-15T10:00:37Z-v3-00000000-0000-0000-0000-000000000001"}}
```