A threat-hunting team is attempting to reduce redundant investigations across identity, endpoint, and cloud logs.

Centralized correlation reduces duplicate investigations without discarding detection evidence. ZIA’s Nanolog Streaming Service streams traffic logs to a SIEM, as described in Zscaler’s NSS-to-SIEM integration guide. For private-access data, ZPA’s Log Streaming Service forwards diagnostic and status logs to a SIEM and supports extended retention and analysis. Combining these streams with identity, endpoint, and cloud telemetry lets analysts correlate a user, device, destination, and policy outcome within one investigation while retaining the original signals. Narrowing ATT & CK coverage or deprioritizing command-and-control evidence reduces detection quality and can hide meaningful attack stages. Sending alerts only to ITSM creates work records but does not provide the analytical correlation needed for threat hunting. NSS or LSS plus a SIEM therefore provides unified context, consistent governance, and more efficient triage.