Update Sentinel and Splunk analytics integrations

[ngayerie]

Summary

What: Expand analytics/analytics-integrations/sentinel and analytics/analytics-integrations/splunk with the setup and operations details customers have been asking for.

Sentinel:

• Detailed prerequisites: ADLS Gen2, RBAC roles, Event Grid resource provider, DCR/DCE, network access rules, and required storage/Sentinel co-location.
• Refreshed Content hub and CCF connector-field walkthrough.
• Log Analytics KQL verification query and expected ingestion window.
• Troubleshooting entry for the InvalidTemplate: CreateDataFlowResources ARM error.
• Deprecation notice for the legacy Azure Function-based solution.

Splunk:

• HEC Global Settings guidance (enable All Tokens, Enable SSL).
• Dataset-to-sourcetype mapping (cloudflare:json, cloudflare:dns, cloudflare:audit, cloudflare:access).
• Confirmation-events note when validating a new Logpush job.

Why: Customers deploying these integrations were missing prerequisites, connector-field detail, and the troubleshooting path for the most common ARM template failure. No screenshots are added; steps link out to the relevant Microsoft and Splunk docs.

DEE-3779

Documentation checklist

• Is there a changelog entry — not applicable, this is a docs enhancement to existing pages.
• The change adheres to the documentation style guide.
• No file has been renamed or relocated, so no redirects are needed.

[cloudflare-docs-bot]

Review

✅ No issues found in commit 06d7f39.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[ngayerie]

[AI] Triage of the code-review bot findings on 0560d03 — all 6 look legitimate, none require clarification:

ID	File / line	Agree?	Plan
CR-e7252f2c3d02	sentinel.mdx L40, L109	✅ Agree	Reword to "Cloudflare CCF connector service principal / application" and drop the Microsoft-Sentinel ownership phrasing.
SG-2d8ad00db9da	sentinel.mdx L21	✅ Agree	Replace "documented below" with "documented in this guide".
SG-e13d4b76765b	splunk.mdx L60	✅ Agree	"turned on" instead of "set to Enabled".
SG-5a06a4ee4266	splunk.mdx L106	✅ Agree	"turn on" instead of "enable".
SG-6d5acda3ec8a	splunk.mdx L108	✅ Agree	Drop "below", keep the anchor link.
SG-c30ba167399b	splunk.mdx L52	✅ Agree	"Select" instead of "Click" for the line I touched. Other pre-existing "Click" usages left as-is to keep scope tight.

Applying fixes now.

[ngayerie]

[AI] Triage of the flue review on 9ee874c — both findings are legitimate:

ID	File / line	Agree?	Plan
SG-e900072a2c83	sentinel.mdx L20	✅ Agree	Drop the date from the admonition title; use "Legacy connector deprecation".
SG-e053572c78cc	sentinel.mdx L21	✅ Agree	Remove the hard date from the body text; the linked changelog entry is the canonical source for the end-of-support date.

Applying now.

[ngayerie]

[AI] Triage of the flue review on 5fcfa3d — all 5 findings agreed:

ID	File / line	Agree?	Plan
CR-3138e225a15c	splunk.mdx L221	✅ Agree	http_referer → http_referrer (matches CIM Web).
CR-1025419467c2	splunk.mdx L252	✅ Agree	Remove QuerySize — CIM DNS has no clean byte-size equivalent, and query_count is semantically wrong.
CR-15e6a491a88d	splunk.mdx L306	✅ Agree	ssid → session_id.
CR-a506e8058cfe	splunk.mdx L244	✅ Agree	Rename DNS logs to Zero Trust Gateway DNS; these fields apply to gateway_dns, not zone dns_logs.
SG-9389419bc184	sentinel.mdx L164	✅ Agree	Replace "the tables below" with "the following tables".

Applying in commit 5760952.

[ngayerie]

[AI] Triage of the flue review on 846efb3 — all three findings are legitimate:

ID	Agree?	Plan
SG-b99d376e2a6a	✅ Agree	Replace the directional phrase “The tables below” with “The following tables”.
SG-b4967f99fc94	✅ Agree	Rewrite the two deploying-user RBAC requirements as prose.
SG-1e6934c1cdd0	✅ Agree	Rewrite the two service-principal storage roles as prose.

Applying these fixes now.

[ngayerie]

[AI] Triage of the flue review on c5be653:

ID	Agree?	Plan
CR-5aaa49121544	✅ Agree	Clarify that Microsoft Sentinel Contributor or Contributor covers resource deployment but not RBAC assignments. Require Owner or User Access Administrator at the storage-account scope for the role assignments created by the template.

Applying this fix now.

[ngayerie]

[AI] Triage of the flue review on 2a0e09f — both findings are legitimate:

ID	Agree?	Plan
CR-c5b5cb5f3c69	✅ Agree	Add --subscription <subscription-id> to az provider show so it checks the same subscription used by the registration command.
SG-ef0098bcdd73	✅ Agree	Change the Task 2 heading to sentence case.

Applying these fixes now.

[ngayerie]

[AI] Triage of the flue review on 77b7c4c:

ID	Decision	Plan / rationale
CR-9177bfeaeb0a	Disagree	Keep the link. The entry exists at src/content/changelog/logs/2026-08-26-sentinel-functions-connector-deprecation.mdx; changelog routes omit the product directory.
CR-2e9ed8b321fd	Disagree	Keep the ADLS Gen2 requirement. The connector setup source explicitly requires an Azure Storage account with hierarchical namespace enabled; the generic Logpush-to-Azure page does not define this connector-specific prerequisite.
SG-f47e65d5d4e4	Agree	Rewrite the storage-account description in active voice.
SG-d7722a4c27eb	Agree	Replace “once the resources are aligned” with “after you align the resources.”
SG-b249e2e8abd8	Agree	Replace “Once the job is created” with “After you create the job.”
SG-ebf65e3327f8	Agree	Replace “as soon as the job is enabled” with “as soon as you enable the job.”

Applying the four style fixes now.

[ngayerie]

[AI] Triage of the flue review on f29ada9:

ID	Agree?	Plan
CR-a1fcde97b2ee	✅ Agree	Add CASB findings, Zero Trust Gateway HTTP, and Zero Trust Gateway Network to the Task 2 sourcetype list. These datasets use cloudflare:json — the app applies CIM field mappings via props.conf aliases based on the fields present in the JSON payload.

Applying this fix now.

[ngayerie]

[AI] Triage of the flue review on 6bdab9a — all 11 findings are legitimate:

Finding(s)	Decision	Plan
CR-1bc495fcf616	✅ Agree	Replace the remaining raw Workbook names ClientIP and EdgeResponseStatus with SrcIpAddr and HttpStatusCode, removing the duplicate status entry.
CR-c5fee7dd31aa	✅ Agree	Include Zero Trust Gateway DNS in the cloudflare:dns guidance.
CR-b78764760b5d	✅ Agree	Remove misleading step-specific link labels and refer to Task 1 as a section.
SG-6dbe42f2a0fd, SG-e1205c5dd59c, SG-8521ebea648f, SG-99ff7574c233, SG-5d2dcf9a77d8, SG-ece1f3738e0d, SG-64accf369f33	✅ Agree	Add a complete introductory sentence ending in a colon before each CIM table.
SG-3b3f6b3e27ec	✅ Agree	Rewrite the CIM introduction in active voice.

Applying the fixes now.