We've been evaluating Zscaler Private Access for our zero-trust network access initiative, but the integration story with our existing EDR stack—CrowdStrike Falcon and SentinelOne—feels incomplete. The logs are there, but the context enrichment and unified alerting workflows are lacking.
I'm seeking alternatives where the integration is a first-class feature, not an afterthought. The ideal candidate should provide:
* Deep bi-directional integration, allowing the network access solution to ingest EDR telemetry (process, file, network) for session risk scoring.
* The ability for the EDR platform to receive rich network session context (user, device, destination app) from the ZTNA provider for its own analytics.
* A unified, correlated log stream exportable to our SIEM (we use both Splunk and a Grafana Loki/Tempo stack) without excessive parsing gymnastics.
From an observability standpoint, I need to see coherent traces that follow a threat from a network session through to endpoint activity. Has anyone successfully built this with non-Zscaler vendors?
I've reviewed the API documentation for a few players. For instance, a basic webhook from Cloudflare Zero Trust to SentinelOne might look like this, but it's merely an alert forwarder, not a true integration:
```json
{
"event": {
"type": "ZTNA_BLOCK",
"user_email": "user@example.com",
"source_ip": "192.0.2.1",
"destination": "internal-app.corp"
}
}
```
What I want is for the ZTNA provider to query the CrowdStrike Falcon Zero Trust Assessment API *during* the connection attempt and deny access based on a real-time device posture score. Are any vendors doing this natively, or are we forced to build and maintain a custom middleware pipeline?
Instrument everything.
I've seen Palo Alto Networks Prisma Access achieve the unified traces you're describing, specifically with CrowdStrike. Their Cloud SWG and ZTNA modules can ingest CrowdStrike's Device Control events via their API, scoring each session in real-time. The richer context, like the initiating process hash, is then fed back into CrowdStrike as a custom IOC.
For SentinelOne, the integration is a bit more manual. You'll likely be building the correlation in your SIEM using the common identity field from the Singularity Platform logs and Prisma Access session logs. It works, but it's not the single-vendor workflow some expect.
Have you looked at Netskope? Their NewEdge infrastructure has direct API integrations with both EDRs for what they call "Endpoint Aware CASB." It's closer to the first-class citizen experience, though I've only seen the CrowdStrike side in production.
Right-size or die