Zscaler Beta

Network device integrations have been updated in WitnessAI v2.0. Devices configured for WitnessAI v1.5 will need a minor update to support v2.0. Some new features will not activate until your devices are updated.

Existing v1.5 network devices will continue to work without interruption in v2.0.

See the network integration guides in the Integrations menu for details.

Have questions? Our support team will be happy to assist.

💡

Zscaler integration Note: WitnessAI requires a service account for administering Zscaler. For example, svc_witnessai_zia. Instructions are in the Configure Service Account section below.

The service account and password must be provided to WitnessAI during onboarding.

This service account is used by WitnessAI to create and manage the URL category WitnessFwdUrls, which contains domains associated with AI websites.

Note: This Url category is managed exclusively by WitnessAI and should not be modified by administrators.

Configure Service account

Create a new Role

Navigate to Administration → Authentication → Administration Controls → Role Management

At the top, click “Add Administrator Role”

Enter the role name as Beta-API-Scope

Navigate to Policy & Components (1), click on URL Categories (2) followed by Custom (3).

Configure the Custom URL Category

Set Zscaler Defined URL Category Management to None.
Set Override Existing Categories to None.
Set Custom URL Management to full.
If there are any new categories, set them to either None or View Only.
Click Save.

Create a new Admin account

Navigate to Administration → Authentication → Administration Controls → Administrator Management

At the top, click “Add Administrator”

Enter the role name as Beta-API-Admin (1).
Assign the Beta-API-Scope role created above (2).
Assign a password.
Click Save (3).

Provide the name of the account and password to the WitnessAI account team.

Cloud Service API Key

Create a new API Key

Navigate to Administration → Authentication → Authentication Configuration → Cloud Service API Security

Click Add API Key, if you haven’t created one already. If there is an API Key created (1), copy the Key and the base URL (2) and provide it to your WitnessAI account team.

Proxy Setup

Install WitnessAI Provided Root Certificate

Click Administration → Root Certificates.

Click Add Root Certificate.

Name: [WitnessRootCA]
Type: [Proxy Chaining].

WitnessAI will provide the Root Certificate for the administrator to upload. Once uploaded, click Save.

Note: WitnessAI can support a customer provided Root Certificate. However, it is recommended that administrators create a unique Root Certificate specific for the WitnessAI platform and provide it to the account team.

Select Administration → Proxies & Gateways.

Select Add Proxy and update the Proxy Name to [WitnessAI_NetworkConnector].

For Proxy’s Root Certificate, select the Root Certificate created in Step 2.
FQDN → connect.[tenantID].[region].witness.ai
Port → 4128
Enable the Insert-X-Authenticated-User switch.
Enable the Base64 Encoding for X-Authenticated-User value switch.