Knowledge BaseRelease NotesRequest Demo

Cloudflare Logs

Connecting Cloudfare logs to your Panther Console

Overview

Panther supports ingesting Cloudflare logs via Cloudflare's Logpush service, which streams logs directly to an HTTP Source, or to Amazon Web Services (AWS) S3.

Note that Cloudflare's Logpush is available to Cloudflare Enterprise customers only. While some Cloudflare log types on this page (e.g., Audit logs) may be pulled without Logpush, Panther's supported schemas rely on the data structure when delivered by Logpush.

How to onboard Cloudflare logs to Panther

You can ingest Cloudflare logs into Panther by streaming them to either an HTTP source or a S3 source.

Step 1: Create an HTTP Source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for "Cloudflare," then click its tile.

    • In the slide-out panel, the Transport Mechanism dropdown in the upper right corner will be pre-populated with the HTTP option.

  4. Click Start Setup.

  5. Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.

    • You will be required to use shared secret authentication. This is the only method of authentication Cloudflare supports.

    • The Header Name associated with your Secret Key Value will be locked with a value of x-panther-cloudflare.

Step 2: Configure a Logpush job in Cloudflare

  1. Locate your Cloudflare account ID. by navigating to your Cloudflare dashboard and copying the ID from the URL. The Cloudflare dashboard is shown, including the URL of the page. The account number in the URL is circled.

  2. Create a Cloudflare API token by following Cloudflare's Create an API token documentation.

    • Ensure the token has the All accounts - Logs: Edit permission.

    • Save the API token for the following step.

  3. Create a Logpush job in Cloudflare by invoking the API, as is shown in the curl example below.

    curl -X POST "https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/logpush/jobs" \
    -H "Authorization: Bearer {YOUR_API_TOKEN}" \
    -H "Content-Type:application/json" \
    -d '{
     "enabled": true,
     "name": "my_cloudflare_audit_logs",
     "dataset": "audit_logs",
     "destination_conf": "{LOG_SOURCE_URL}?header_x-panther-cloudflare={SHARED_SECRET}"
     }'

  4. Navigate back to your Cloudflare dashboard to finish the Logpush job configuration.

    1. In the left-hand navigation bar, under Analytics & Logs, click Logs.

    2. In the Logpush job table, find the row for the Logpush job you created in the previous step, and click Edit. The Logs page of the Cloudflare dashboard is shown. There is a table under the header "Logpush - Account-scoped datasets," with one row. In the "Data set" column is "Audit logs," and on the right-hand side are "Edit" and "Delete" buttons.

    3. Select the fields you would like Cloudflare to include in the audit log events sent to your HTTP Source. (By default, Cloudflare only includes a subset of all available fields.) The top of the Cloudflare page reads "Edit logpush options," then "Select data fields." There is a list of fields, each with checkboxes next to their names, such as ActionResult, ActionType, ActorEmail, and so on.

    4. Click Save changes.

Panther-built Detections

See Panther's built in rules for Cloudflare in panther-analysis in Github.

Supported log types

Cloudflare.Audit

When selecting event fields on the Cloudflare UI, make sure you include the When, ID, and ResourceType fields, as they are required by Panther.

Cloudflare.Firewall

When selecting event fields on the Cloudflare UI, make sure you include the "Datetime" field, as it is required by Panther.

Reference: Cloudfare Documentation on Log Field Firewalls.

Cloudflare.HttpRequest

When selecting event fields on the Cloudflare UI, make sure you include the "EdgeStartTimestamp" field, as it is required by Panther.

Reference: Cloudfare Documentation on Log Field Requests.

Cloudflare.Spectrum

When selecting event fields on the Cloudflare UI, make sure you include the "Timestamp" field, as it is required by Panther.

Reference: Cloudfare Documentation on Log Field Spectrum Events.

Cloudflare.ZeroTrust.RData

The Cloudflare.ZeroTrust.RData schema is in open beta starting with Panther version 1.81, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Cloudflare Zero Trust RData logs are in a Base64-encoded binary format, and this schema transparently decodes them. This schema does not have an event time field, so the p_event_time value will be equivalent to the parsing time.

For more information, see the Cloudflare Zero Trust RData documentation.

PreviousCisco Umbrella LogsNextCrowdStrike Logs

Last updated

Was this helpful?