Zscaler Private Access Parser: Enhanced Field Coverage Improves Network Session Visibility

What Changed

ZPAEvent ASIM parser updated from version 1.0.2 to 1.0.3, adding parsing support for SessionID, IPProtocol, ClientCountryCode, and additional network session metadata fields.

Parser Impact

The updated parser extracts additional fields that were previously unparsed from ZPA_CL logs. Queries referencing SessionID, IPProtocol, or ClientCountryCode against this parser previously returned null for all rows — this is a data fidelity improvement. The core filter logic and existing field mappings remain unchanged, making this safe for existing detections using this parser.

Affected Files

Solutions/Zscaler Private Access (ZPA)/Parsers/ZPAEvent.yaml
(packaging artefacts updated: mainTemplate.json, Package/*.zip)