The problem with this is that Zscaler needs a log aggregator. I haven't seen them go direct before

Customers would like the ability to ingest log data from ZScaler platform to help surface anomalous behaviour by users as well as to provide alerting on potential compromises of endpoints