What Changed

Fixed the devicemodel field parsing logic in the Zscaler ZIA ASIM WebSession parser. The parser now correctly extracts device model information from log fields instead of consuming all remaining text.

Parser Impact

  • Affects ASimWebSession normalization for Zscaler ZIA logs ingested via CommonSecurityLog
  • Data fidelity fix: Queries referencing device model fields against this parser previously returned incomplete or incorrect device categorization data
  • No change to core filter logic or primary field mappings — safe for existing detections using this parser
  • Sample data updated to reflect corrected parsing behavior with proper outcome=Blocked values

Affected Files

Parsers/ASimWebSession/Parsers/ASimWebSessionzScalerZIA.yaml
Parsers/ASimWebSession/Parsers/vimWebSessionzScalerZIA.yaml
(packaging artefacts: ASimWebSessionzScalerZIA.json, vimWebSessionzScalerZIA.json)
Sample Data/ASIM/Zscaler_ZIA Proxy_WebSession_IngestedLogs.csv