You can view and filter AppProtection data for past AppProtection events.

To view diagnostics for AppProtection data:

1. Go to Logs > Insights > Diagnostics.
2. Under Log Type, choose AppProtection.

By default, the detailed AppProtection profile and policy information for all AppProtection events are displayed for events that occurred in the last 24 hours. To change the time range, click the Calendar menu and select a preset range or specify a custom start and end date. If you use a Custom Range, the start date must be within the last 14 days. To change the time zone, click the current Time Zone button.

Zscaler retains logs for rolling periods of at least 14 days during your subscription term. You can also view your logs or stream logs in real time using the Log Streaming Service (LSS). The data in the dashboard might be more recent than the data presented within Diagnostics for the same time range.

Viewing Logs

Log activity is automatically displayed after selecting the AppProtection log type.

By default, the table displays the Total number of AppProtection transactions. You can change this by choosing one of the following filters:

• Total Transactions: The total number of transactions.
• Security Profile Violations: The number of transactions with security profile violations.
• No Violations: The number of transactions with no security profile violations.

Filtering AppProtection Diagnostics

On the AppProtection Diagnostics page, you can apply filters or drill down further into the log data using the Query Builder. By default, no filters are applied. If you want to view and filter User Status for real-time events, use Live Logs.

To configure filters using the Query Builder:

1. Click Add Filters and select a filter from the drop-down menu. To learn more, see AppProtection Filters below.
2. Select a Boolean operator from the drop-down menu (e.g., Contains, Ends With, Equals, Not Equals, Starts With). The operators available are determined by the filter you are configuring.
3. Select the fields from the drop-down menu or enter the values required for the filter. The field or value required is determined by the filter you are configuring.

Filters using the Contains operator allow a maximum of 7 entries. All filters using operators that require text input must use a semicolon (;) to separate multiple entries (e.g., 137; 138; 139). When configuring multiple text entries and using the Less Than operator, the results show transactions starting from the largest entry provided. When configuring multiple text entries and using the Greater Than operator, the results show transactions starting from the smallest entry provided.

4. Click Apply.

• To apply more filters, click Add Filters again or click the Apply Filter icon () within the table.
• To remove an added filter, click the Close icon and then click Apply.
• To remove all filters, click Clear All.

You can also click the Copy icon to save the filter query details. If you or another admin accesses Diagnostics, you can paste the query into the field by clicking the Clipboard icon.

AppProtection Filters

You can add the following filters:

• App Connector: Name: See logs by a specific App Connector you’ve configured.
• Application: Domain: See logs by an application that resolves to a specific domain.
• Application: Segment Name: See logs by a specific application segment you’ve configured.
• Connection: Connection ID: See requests by the ID associated with the application request.
• AppProtection Control: Action: See logs by the AppProtection control violation action (i.e., Allow, Block, or Redirect).
• AppProtection Control: Category: See logs by the list of categories in the WebSocket Custom Controls, HTTP Custom Controls, WebSocket Predefined Controls, ThreatLabZ Predefined Controls, and OWASP Predefined Controls.
• AppProtection Control: Name: See logs by the AppProtection control violation number and name (e.g., by ControlNumber:ControlName).
• AppProtection Control: Severity: See logs by the AppProtection control violation severity rating (i.e., Critical, High, Medium, & Low).
• AppProtection Profile: Name: See logs by the AppProtection profile violation name.
• Machine Tunnel: See requests from Machine Tunnel users.
• Policy: AppProtection Policy Name: See logs by the name of one or more specific AppProtection policies.
• Source IP: See logs by the source IP address.
• User Agent: See logs by the profile of the user machine, operating system version, and web browser.
• Username: See logs by the user.

If you are using the Log Streaming Service (LSS), be aware that the ZPA LSS Client user represents the LSS service, not an actual user. By default, Diagnostic information for the ZPA LSS Client is captured but not displayed. You must explicitly select this user from the User field in order to display its log information. Each log receiver is displayed as an application, to reflect the data coming in from the service. To learn more, including how to stop the LSS service from streaming ZPA LSS Client logs, see Configuring a Log Receiver.

The table displays the following data for transactions. You can expand each row to see more details or click the Expand/Collapse icon to expand or collapse all rows within the table. By default, the table displays 20 transactions. You can scroll to load more transactions.

Within the table, you can click the Apply Filter icon next to certain field names in order to drill down further into the data. The filter query section within the page updates automatically to include the proper filter for the field name you selected and the applicable Boolean operator configuration for that field.