For support and questions, please e-mail analytics@cloudflare.com
| Log type | Sourcetype |
|---|---|
| Zero Trust Access requests logs | cloudflare:access |
| Zero Trust Audit logs | cloudflare:audit |
| Zero Trust CASB Findings logs | cloudflare:casb |
| Zero Trust Gateway DNS logs | cloudflare:dns |
| Zero Trust Gateway HTTP logs | cloudflare:http |
| Zero Trust Gateway Network logs | cloudflare:network |
| ZeroTrust Device Posture logs | cloudflare:deviceposture |
| ZeroTrust Network Session logs | cloudflare:networksessions |
| ZeroTrust Area1 logs | mailstream |
For documentation on the available methods for collecting Cloudflare logs please refer to the Cloudflare Logs developer documentation here.
For ease of onboarding and integration, it is recommended to use Cloudflare’s Logpush Service to push logs to Amazon S3, which can then be pulled into Splunk using the Splunk Add-on for AWS. Instructions on how to install the Splunk Add-on for AWS and configure inputs can be found here – this link also contains details on where to install the Splunk Add-on for AWS as it is dependent on the type of deployment you have.
Please note that if you are performing the data onboarding from a separate instance of Splunk and not where the Cloudflare App for Splunk is located, it is strongly advised to copy the proper section of the props.conf packaged with the Cloudflare App for Splunk to the instance which is collecting the Cloudflare JSON data.
By default within the application JSON key-value extraction is turned on at search time by setting KV_MODE in the props.conf packaged with the application to JSON. If you happen to set up INDEXED_EXTRACTIONS for the cloudflare:json, cloudflare:access, cloudflare:audit, cloudflare:casb, cloudflare:dns, cloudflare:http and cloudflare:network sourcetypes at the point of which you are onboarding data then you will need to set KV_MODE=none in the props.conf packaged with the application to ensure field values are not extracted twice and thus impacting the dashboards.
The Cloudflare App for Splunk is easy to install and configure. Please follow the steps below to install and configure the application within your Splunk environment.
Ensure the Application Requirements documented above are met.
Download the application from Splunkbase.
Install the application on your Search Head or Search Head Cluster using standard application deployment methods. Information on installing applications on Splunk can be found in the Splunk documentation here https://docs.splunk.com/Documentation/Splunk/latest/Admin/Deployappsandadd-ons.
Once installed the application needs to be configured. A Set Up page is bundled with the application. To configure the application following these steps:
Access the application on your Search Head by clicking on the “Cloudflare App for Splunk” from your Splunk launcher home page or from the Apps dropdown menu. You will be prompted with the application Set Up screen.
Go to the Settings dropdown > Advance search > Search macros within the Cloudflare App for Splunk.
Click on the macro named cloudflare_index and change the value to Index name where the Cloudflare JSON logs are stored. This value must be entered in the format index=index_name. By default the value is set to index=cloudflare.
For Cloudflare security events, Click on the macro named cloudflare_L7_security_events_index and change the value to Index name where the Cloudflare Security Events are stored. This value must be entered in the format index=index_name. By default the value is set to index=cloudflare.
For Cloudflare Zero Trust events, Click on the macro named cloudflare_zt_index and change the value to the Index Name where the Cloudflare ZeroTrust events are stored. This value must be entered in the format index=index_name. By default the value is set to index=cloudflare.
Choose whether to enable Data Model Acceleration. By default, acceleration is disabled.
The application is now installed and can be found on your Splunk launcher home page or through the Apps dropdown menu to the top left.
Notes:- If anyone is not using default index (which is Cloudflare) value in Splunk Add-on for AWS then you must follow the above step to change the index in macros definition as well.
Updated the security dashboards with new fields according to the deprecation notice. For reference: https://developers.cloudflare.com/logs/reference/change-notices/2023-02-01-security-fields-updates/#http-requests-dataset-changes
Updated sourcetype="cloudflare:area1" to sourcetype="mailstream" for Cloudflare - Area1 eventtype
Following bugs are fixed:
1. TRUNCATE value changed to 0 for all source types.
2. cloudflare_ prefixed with all eventtypes.
3. Time stamp extraction for Network Session logs updated with SessionStartTime.
4. Knowledge objects exported globally.
5. Bot related dashboards(Bots Summary and Bots Detailed) are fixed to use BotScore field.
Added Support for Cloudflare ZeroTrust.
Added FirewallMatchesRuleIDs in the cloudflare datamodel. FirewallMatchesRuleIDs field added in the Cloudflare - Security (WAF) dashboard.
update to use jQuery 3.5
Version 1.0.0 (May 10, 2019)
This is the initial release of the Cloudflare App for Splunk. Dashboards included within this release are broken up into
4 categories: Snapshot, Performance, Reliability and Security.
Snapshot:
- Cloudflare – Snapshot (Web Traffic Overview)
- Cloudflare – Snapshot (Web Traffic Types)
Performance:
- Cloudflare – Performance (Hostname, Content Type, Request Method, Connection Type)
- Cloudflare – Performance (Requests and Cache)
- Cloudflare – Performance (Bandwidth)
- Cloudflare – Performance (Static vs. Dynamic Content)
Reliability:
- Cloudflare – Reliability (Summary)
- Cloudflare – Reliability (Detailed)
Security:
- Cloudflare – Security (Overview)
- Cloudflare – Security (Bots Summary)
- Cloudflare – Security (Bots Detailed)
- Cloudflare – Security (Rate Limit)
- Cloudflare – Security (WAF)
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.