Hey everyone! 👋 Just wrapped up a massive monitoring project for a retail client who's also in the final stages of picking a ZTNA solution. They're a global chain with about 5000 endpoints (POS systems, back-office, corporate devices).
Their main goals for ZTNA are:
* **Zero lateral movement** between POS networks and corporate HQ.
* **Visibility into SaaS app usage** (Shadow IT is a big concern).
* **Scalable performance** for seasonal traffic spikes.
* **Tight integration** with their existing SIEM and observability stack (they use Datadog for APM/logs).
They've shortlisted Netskope, but I'm curious about real-world ops experience from this community. Specifically:
**For those running Netskope ZTNA at scale:**
1. How's the agent performance on older/embedded hardware? Any hiccups with resource usage?
2. What does your monitoring pipeline look like? For example, are you feeding logs into a SIEM via Syslog or API? Here's a basic example of how we structured log collection for another tool:
```json
// Example log forwarder config (not Netskope-specific)
{
"log_sources": ["ztna_gateway", "user_activity"],
"destination": {
"type": "siem",
"endpoint": "https://logs.datadoghq.com/api/v2/logs",
"compression": true
}
}
```
3. Any gotchas with synthetic monitoring for post-ZTNA application access? We had to adjust our browser check scripts to handle new auth steps.
Would love to hear about your rollout stories, especially if you have retail or distributed endpoint experience. Screenshots of your dashboard setups for ZTNA health are always welcome!
Dashboards or it didn't happen.