diff --git a/src/content/docs/analytics/analytics-integrations/sentinel.mdx b/src/content/docs/analytics/analytics-integrations/sentinel.mdx index afd60f203f9..dc254b52cf9 100644 --- a/src/content/docs/analytics/analytics-integrations/sentinel.mdx +++ b/src/content/docs/analytics/analytics-integrations/sentinel.mdx @@ -17,18 +17,62 @@ Cloudflare has integrations with Microsoft Sentinel to make analyzing your Cloud **[Sentinel Function Based Connector](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/cloudflare.cloudflare_sentinel?tab=Overview)**: The Cloudflare connector for Microsoft Sentinel uses [Azure Functions](https://azure.microsoft.com/en-us/products/functions) to process security logs from Cloudflare's Logpush service and ingest them directly into the SIEM platform. -This guide provides clear, step-by-step instructions for integrating Cloudflare logs with the new CCF connector for Microsoft Sentinel using Azure Blob Storage. By following these steps, you will be able to securely collect, store, and analyse your Cloudflare logs within Microsoft Sentinel, enhancing your organisation's security monitoring and incident response capabilities. +:::caution[Legacy connector deprecation] +Microsoft is deprecating the Azure Monitor HTTP Data Collector API. As a result, Cloudflare will no longer maintain the Azure Functions-based Microsoft Sentinel connector after the API end-of-support date. Cloudflare Enterprise customers using the Function-based connector must migrate to the CCF connector documented in this guide. Refer to the [deprecation changelog entry](/changelog/2026-08-26-sentinel-functions-connector-deprecation/) for the exact end-of-support date and migration details. +::: + +This guide provides clear, step-by-step instructions for integrating Cloudflare logs with the CCF connector for Microsoft Sentinel using Azure Blob Storage. By following these steps, you will be able to securely collect, store, and analyze your Cloudflare logs within Microsoft Sentinel, enhancing your organization's security monitoring and incident response capabilities. ## Step 1: Prerequisites -- Azure Subscription with permission to create and manage resources (Contributor/Owner role recommended). -- Microsoft Sentinel Workspace already set up in your Azure environment. -- Azure Storage Account with a Blob container for storing Cloudflare logs. -- Cloudflare Account with access to the domain whose logs you wish to export, and permission to configure Logpush jobs. -- The Azure Storage account needs to be set to public network access. -- The Azure Storage account needs to be in the same subscription as the Microsoft Sentinel Workspace. +Before you begin, make sure the following prerequisites are met. + +### Azure resources + +- **Azure subscription** with permission to create and manage resources (`Contributor` or `Owner` role recommended). +- **Azure Storage account** with [Azure Data Lake Storage Gen2 enabled](https://learn.microsoft.com/en-us/azure/storage/blobs/create-data-lake-storage-account) (hierarchical namespace on). Logpush writes the Cloudflare log files to this account. +- **Azure Blob container** inside the storage account, dedicated to receiving Cloudflare Logpush files. The CCF connector monitors this container for new files via Event Grid. +- **Microsoft Sentinel workspace** already deployed on top of a Log Analytics workspace. The connector's Data Collection Rule (DCR) and Data Collection Endpoint (DCE) are tied to this Log Analytics workspace, and all ingested Cloudflare log records land in tables within it. +- **Cloudflare account** with access to the domain or account whose logs you want to export, and permission to configure Logpush jobs. + +### RBAC roles + +The CCF connector authenticates to Azure using a service principal that belongs to the Cloudflare CCF connector application, registered as a multi-tenant Microsoft Entra application. The ARM template that deploys the connector assigns the required roles to this service principal automatically. + +The deploying user must have **Microsoft Sentinel Contributor**, `Contributor`, or `Owner` on the Microsoft Sentinel workspace to deploy the connector resources. Because the ARM template creates role assignments for the service principal, the user must also have `Owner` or `User Access Administrator` at the storage account scope. `Contributor` and **Microsoft Sentinel Contributor** alone cannot create role assignments. + +At deployment time, the Cloudflare CCF connector service principal receives `Storage Blob Data Reader` on the storage account to read log files from the Blob container and `Storage Queue Data Contributor` to read and delete pointer messages from the Storage Queue. + +Refer to the Microsoft documentation on [Azure roles for Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/roles) and [Azure roles for storage](https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access) for details. + +### Event Grid resource provider + +The `Microsoft.EventGrid` resource provider must be registered in the subscription that hosts the storage account. Verify the registration state in the Azure portal under **Subscriptions** > select the subscription > **Settings** > **Resource providers** > search for `Microsoft.EventGrid`. -## Step 2: Set up a logpush job +Alternatively, run the following Azure CLI commands: + +```sh +az provider register --namespace Microsoft.EventGrid --subscription +az provider show --namespace Microsoft.EventGrid --subscription --query "registrationState" +``` + +The registration state should report `Registered` before you continue. + +### Network access configuration + +By default, the storage account must allow public network access so that the connector's managed resources can reach both the Blob container endpoint and the Storage Queue endpoint. + +- If you are not restricting access with a Network Security Perimeter (NSP), open the storage account's **Networking** blade and set **Public network access** to **Enabled from all networks**. +- Restricting access using selected virtual networks or IPv4 CIDR ranges is not supported for this connector, because of Azure Storage firewall limitations around IP ranges and caller region affinity. +- If network restrictions are required for compliance, use an [Azure Network Security Perimeter (NSP)](https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-concepts) instead. Include the Sentinel service tag inbound ranges in the NSP rules and configure the Event Grid system topic subscription to use system-assigned managed identity delivery. + +Refer to Microsoft's guidance on [enabling storage network security for Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/enable-storage-network-security) for the full options. + +### Storage account and Sentinel co-location + +The Azure Blob Storage account and the Microsoft Sentinel workspace must live in the **same Azure subscription and the same resource group**. Deployments where these resources are split across subscriptions or resource groups fail during ARM template validation. Refer to [Troubleshooting](#troubleshooting) for details. + +## Step 2: Set up a Logpush job 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Analytics** > **Logs** and select **Logpush**. @@ -43,72 +87,81 @@ This guide provides clear, step-by-step instructions for integrating Cloudflare For complete details, refer to the [Cloudflare Logpush to Azure documentation](/logs/logpush/logpush-job/enable-destinations/azure/). -## Step 3: Configure Azure and deploy the Data Connector in Microsoft Sentinel +## Step 3: Install the Cloudflare CCF solution -1. Log in to the Azure Portal and go to your **Microsoft Sentinel** workspace. -2. Select **Content Hub** in the navigation bar and search for **Cloudflare**. -3. Select the **Cloudflare** solution from the results. -4. Select **Install** in the right pane. -5. In your **Sentinel workspace**, go to **Data connectors**. -6. Search for the **Cloudflare connector** (may appear as **Cloudflare (using Azure Blob Storage)**). -7. Select the connector to configure it. +1. Log in to the Azure portal and open your Microsoft Sentinel workspace. If you do not have one yet, follow Microsoft's [onboarding guide](https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard) to create a Log Analytics workspace and enable Microsoft Sentinel on it. +2. In the left navigation pane, under **Content management**, select **Content hub**. If the page appears empty, refresh and wait for the content list to load. +3. In the search bar, enter `Cloudflare` and press **Enter**. +4. Select the **Cloudflare CCF** solution and select **Install**. +5. Once the solution is installed, select **Manage**. +6. Select **Cloudflare (Using Blob Container) (via Codeless Connector Framework)** and select **Open connector page**. ![Azure portal](~/assets/images/analytics/azure-portal.png) -## Step 4: Fill out required fields +## Step 4: Configure the CCF connector -When configuring the Cloudflare data connector, you will need to provide the following information: +On the connector page, fill in the following fields: -- Blob container URL +- **Service Principal ID**: this field is prepopulated with the object ID of the Cloudflare CCF connector service principal in your tenant. If it is empty, ensure that admin consent has been granted for the Cloudflare CCF connector application in your Microsoft Entra tenant, then reload the page. Refer to Microsoft's [admin consent workflow](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow) for details. +- **Blob Container URL**: in the Azure portal, open the storage account that receives Cloudflare logs. Under **Data storage** > **Containers**, open the target container, go to **Properties**, and copy the URL. +- **Storage Account Resource Group Name**, **Storage Account Location**, and **Storage Account Subscription ID**: available on the storage account's **Overview** page. +- **Event Grid System Topic Name**: leave this field blank on the first deployment. The ARM template creates the topic automatically. If you are reconfiguring an existing deployment, open **Event Grid** > **System topics** in the Azure portal, filter by location, and copy the name of the topic whose **Source** matches your storage account. -To obtain the container URL within your Azure storage account, access the Azure Portal and navigate to your storage account. Under **Data Storage**, select **Containers**, then choose the relevant container receiving logs from Cloudflare. The container properties section will display the URL link. +Select **Connect** to start the deployment. When the deployment completes, the Azure portal shows a `Deployment succeeded` notification and the button changes to **Disconnect**. -- Resource group name for the storage account -- Storage account location -- Subscription ID -- Event grid topic name (only if reconfiguring; not needed for initial setup) +![Configuration fields](~/assets/images/analytics/configuration.png) -After entering all information, select **Connect**. +## Step 5: Verify log ingestion -Ensure all fields are correctly filled to enable seamless log ingestion. +1. In the Azure portal, open the Log Analytics workspace backing your Sentinel instance. +2. In the left navigation pane, select **Logs**. +3. Enter the following query in the editor and select **Run**: -![Configuration fields](~/assets/images/analytics/configuration.png) + ```kusto + CloudflareV2_CL + | take 10 + ``` -## Step 5: Complete deployment +4. Confirm that Cloudflare log records are returned. -1. Select **Apply changes** or **Connect** to finalise the connector setup. -2. Monitor the Data connectors page in Sentinel to confirm that the Cloudflare connector status is **Connected**. -3. Verify that Cloudflare logs are appearing in your Sentinel workspace under **Log Analytics** > **Logs**. -4. If logs are not appearing, review your Blob Storage permissions, Cloudflare Logpush configuration, and Sentinel connector settings. +:::note[Note] +Data usually starts appearing in the workspace within 20 to 30 minutes of the connector reporting a successful deployment. If logs do not appear after that window, review your storage account permissions, Cloudflare Logpush configuration, Event Grid subscription, and Sentinel connector settings. +::: ![Data connectors](~/assets/images/analytics/data-connectors.png) -By following these steps, you have successfully integrated Cloudflare logs with Microsoft Sentinel using Azure Blob Storage. This integration enables advanced security analytics and incident response capabilities for your Cloudflare-protected environments. If you encounter issues, review each configuration step, check permissions, and review Microsoft's official documentation. - ![Cloudflare traffic overview](~/assets/images/analytics/traffic-overview.png) +## Troubleshooting + +### `CreateDataFlowResources` deployment error + +The ARM template deployment fails with an error similar to: + +```txt +InvalidTemplate: Deployment template validation failed: +'The resource 'Microsoft.Resources/deployments/CreateDataFlowResources' is not defined in the template.' +``` + +The CCF connector's ARM template operates within a single resource group scope and cross-references the storage account, Blob container, Event Grid system topic, Storage Queue, Data Collection Rule (DCR), Data Collection Endpoint (DCE), and Microsoft Sentinel workspace as co-located resources. If any of those resources live outside the deployment scope, the template cannot resolve the references and validation fails before anything is created. + +To resolve the error: + +1. **Verify co-location**: in the Azure portal, open both the storage account and the Microsoft Sentinel workspace (or its underlying Log Analytics workspace) and confirm that **Resource group** and **Subscription** match on the **Overview** blade. If they differ, move the storage account into the resource group that hosts Sentinel, or create a new storage account in that resource group. +2. **Verify network access**: confirm that public network access is enabled on the storage account, or that a Network Security Perimeter is configured as described in [Prerequisites](#network-access-configuration). Selected network limits using IPv4 CIDR addresses are not supported. +3. **Retry the deployment**: after you align the resources, re-run the ARM template deployment. The `CreateDataFlowResources` error should not recur. + +For the full list of storage-related failure modes and mitigations, refer to Microsoft's [Azure Storage Blob connector troubleshooting guide](https://learn.microsoft.com/en-us/azure/sentinel/azure-storage-blob-connector-troubleshoot). + ## Supported Logs We support the following fields to be utilized within the Sentinel Connectors (CCF & Function based). You can push all log fields to Azure using our logpush function as described in [Enable Microsoft Azure](/logs/logpush/logpush-job/enable-destinations/azure/) documentation. +The CCF connector normalizes Cloudflare log fields to the [Microsoft Sentinel ASIM schema](https://learn.microsoft.com/en-us/azure/sentinel/normalization) where a canonical equivalent exists (for example, `ClientIP` becomes `SrcIpAddr`, `EdgeResponseStatus` becomes `HttpStatusCode`), and preserves Cloudflare-native names for fields that do not have a schema equivalent. Use the field names in the following tables in your KQL queries against the connector's output table. +
-ClientDeviceType
-Source
-ClientSSLCipher
-ClientTlsCipher
-ClientSSLProtocol
-ClientTlsProtocol
-FirewallMatchesActions
-Event
-FirewallMatchesRuleIDs
-RuleID
-ClientRequestBytes
-ClientBytes
-ClientSrcPort
-ClientPort
-EdgeResponseBytes
-OriginBytes
+Application
BotScore
BotScoreSrc
CacheCacheStatus
@@ -116,17 +169,31 @@ CacheResponseBytes
CacheResponseStatus
CacheTieredFill
ClientASN
-ClientCountry
-ClientIP
+ClientASNDescription
+ClientDeviceType
ClientIPClass
-ClientRequestHost
-ClientRequestMethod
+ClientMatchedIpFirewall
+ClientRefererHost
+ClientRefererPath
+ClientRefererQuery
+ClientRefererScheme
ClientRequestPath
ClientRequestProtocol
-ClientRequestReferer
+ClientRequestQuery
+ClientRequestScheme
ClientRequestURI
-ClientRequestUserAgent
+ClientTcpRtt
+ClientTlsClientHelloServerName
+ClientTlsStatus
ClientXRequestedWith
+ColoCode
+ConnectTimestamp
+Datetime
+DisconnectTimestamp
+DstBytes
+DstIpAddr
+DstPortNumber
+DvcAction
EdgeColoCode
EdgeColoID
EdgeEndTimestamp
@@ -137,21 +204,47 @@ EdgeRateLimitAction
EdgeRateLimitID
EdgeRequestHost
EdgeResponseCompressionRatio
-EdgeResponseContentType
EdgeResponseStatus
EdgeServerIP
EdgeStartTimestamp
+EventResult
+EventSubType
FirewallMatchesSources
-OriginIP
+HttpContentType
+HttpReferrerOriginal
+HttpRequestHeaderHost
+HttpRequestMethod
+HttpStatusCode
+HttpUserAgentOriginal
+IpFirewall
+MatchIndex
+NetworkProtocol
+NetworkRuleName
+OriginProto
OriginResponseBytes
OriginResponseHTTPExpires
OriginResponseHTTPLastModified
-OriginResponseStatus
OriginResponseTime
OriginSSLProtocol
+OriginTcpRtt
+OriginTlsCipher
+OriginTlsFingerprint
+OriginTlsMode
+OriginTlsProtocol
+OriginTlsStatus
+OriginatorRayID
ParentRayID
+ProxyProtocol
RayID
SecurityLevel
+SrcBytes
+SrcGeoCountry
+SrcIpAddr
+SrcPortNumber
+TimeGenerated
+Timestamp
+TlsCipher
+TlsVersion
WAFAction
WAFFlags
WAFMatchedVar
@@ -163,136 +256,60 @@ WorkerStatus
WorkerSubrequest
WorkerSubrequestCount
ZoneID
-Application
-ClientMatchedIpFirewall
-ClientProto
-ClientTcpRtt
-ClientTlsClientHelloServerName
-ClientTlsStatus
-ColoCode
-ConnectTimestamp
-DisconnectTimestamp
-IpFirewall
-OriginPort
-OriginProto
-OriginTcpRtt
-OriginTlsCipher
-OriginTlsFingerprint
-OriginTlsMode
-OriginTlsProtocol
-OriginTlsStatus
-ProxyProtocol
-Status
-Timestamp
-ClientASNDescription
-ClientRefererHost
-ClientRefererPath
-ClientRefererQuery
-ClientRefererScheme
-ClientRequestQuery
-ClientRequestScheme
-Datetime
-Kind
-MatchIndex
-OriginatorRayID
-TimeGenerated
-
- -ClientCountry_s
-ClientDeviceType_s
-ClientIP_s
-ClientIPClass_s
-ClientRequestMethod_s
-ClientRequestProtocol_s
-ClientRequestReferer_s
-ClientRequestURI_s
-ClientRequestUserAgent_s
-EdgePathingOp_s
-EdgePathingSrc_s
-EdgePathingStatus_s
-EdgeResponseContentType_s
-threat
-TimeGenerated
-EdgePathingSrc_s
-EdgePathingOp_s
-EdgePathingStatus_s
-EdgeResponseStatus_d
-OriginResponseStatus_d
+
+ +ClientDeviceType
+SrcIpAddr
+ClientIPClass
+ClientRequestProtocol
+ClientRequestReferer
+ClientRequestURI
+ClientRequestUserAgent
+EdgePathingOp
+EdgePathingSrc
+EdgePathingStatus
+EdgeResponseContentType
+HttpRequestMethod
+HttpStatusCode
TimeGenerated
+threat
ClientIPClass
-SrcIpAddr
-ClientRequestURI
-HttpUserAgentOriginal
-HttpRequestMethod
-TimeGenerated
-SrcGeoCountry
ClientRequestURI
+DstBytes
HttpRequestMethod
HttpStatusCode
-DstBytes
+HttpUserAgentOriginal
SrcBytes
+SrcGeoCountry
+SrcIpAddr
+TimeGenerated
+WAFAction
WAFRuleID
WAFRuleMessage
-WAFAction
-TimeGenerated
-HttpStatusCode
-SrcIpAddr
ClientRequestURI
ClientTlsStatus
+EdgeRequestHost
+EdgeResponseStatus
+HttpStatusCode
HttpUserAgentOriginal
-OriginTlsStatus
NetworkRuleName
-EdgeRequestHost
+OriginTlsStatus
SrcGeoCountry
-EdgeResponseStatus
-ClientCountry
-ClientDeviceType
-status
-OriginResponseStatus
-WorkerSubrequest
-http_method
-dest_ip
-dest_host
-uri_path
-http_user_agent
-status
-src_ip
-OriginResponseStatus
-RayID
-WorkerSubrequest
-http_method
-bytes_out
-bytes_cached_requests
-threat
-ClientRequestProtocol
-http_referrer
-ClientIPClass
-cf_http_status_codes
-http_content_type
-cf_http_status_codes
-cached_requests
-CacheCacheStatus
-ClientASN
-EdgePathingSrc
-EdgePathingOp
-EdgePathingStatus
-ClientRequestUserAgent
-SecurityAction
-SecurityRuleID
-SecurityRuleDescription
+SrcIpAddr
+TimeGenerated
diff --git a/src/content/docs/analytics/analytics-integrations/splunk.mdx b/src/content/docs/analytics/analytics-integrations/splunk.mdx index 8354c40ab4b..7980150f1f0 100644 --- a/src/content/docs/analytics/analytics-integrations/splunk.mdx +++ b/src/content/docs/analytics/analytics-integrations/splunk.mdx @@ -45,16 +45,21 @@ To install the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/450 1. Open the setup screen by clicking the **Settings** dropdown, then click **Indexes**. 2. Select **New Index**. Note that the **Indexes** page also gives you the status of all your existing indexes so that you can see whether you're about to use up your licensed amount of space. 3. Name the index **cloudflare**, which is the default index that the Cloudflare App will use. + 4. Set **Index Data Type** to **Events**, then select **Save**. 7. Set up the HTTP Event Collector (HEC) on Splunk. To create an HEC: 1. Click the **Settings** dropdown and select **Data inputs**. - 2. Click **+Add new** and follow the wizard. When prompted, submit the following responses: + 2. Select **+Add new** next to **HTTP Event Collector** and follow the wizard. When prompted, submit the following responses: - Name: Cloudflare - - Source Type: Select > "cloudflare:json" + - Source Type: Select > `cloudflare:json` - App Context: Cloudflare App for Splunk (cloudflare) - Index: cloudflare 3. At the end of the wizard you will see a **Token Value**. This token authorizes the Cloudflare Logpush job to send data to your Splunk instance. If you forget to copy it now, Splunk allows you to get the value at any time. + :::note[Enable HEC and SSL] + After creating the token, go to **Settings** > **Data inputs** > **HTTP Event Collector** > **Global Settings** and confirm that **All Tokens** is turned on and that **Enable SSL** is selected, then select **Save**. Verify that the status of your new HEC token is enabled in the token list. Refer to the [Splunk HEC documentation](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector) for details. + ::: + 8. Verify whether Splunk is using a self-signed certificate. You'll need this information when creating the Logpush job. 9. Determine the endpoint to use to send the data to. The endpoint should be: @@ -87,17 +92,29 @@ Enable or disable acceleration after the initial configuration by accessing the You can also manually configure Data Models by going to **Settings** > **Data models**. Learn more about data model acceleration in the [Splunk documentation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels). -## Task 2 - Make the API call to create the Logpush job +## Task 2 - create the Cloudflare Logpush job to Splunk + +Create the Logpush job by following [Enable Logpush to Splunk](/logs/logpush/logpush-job/enable-destinations/splunk/). When you fill in the Splunk destination: -Create the Logpush job by following the instructions on [Enable Logpush to Splunk](/logs/logpush/logpush-job/enable-destinations/splunk/). The API call creates a Logpush job but does not enable it. +- Use the endpoint you configured in [Task 1](#task-1---install-and-configure-the-cloudflare-app-for-splunk) for **Splunk HEC URL**, including the `/services/collector/raw` path. +- Use the HEC token you created in [Task 1](#task-1---install-and-configure-the-cloudflare-app-for-splunk) for **Auth Token**, prefixed with `Splunk` (for example, `Splunk 12345678-1234-1234-1234-1234567890ab`). +- Set **Source Type** to the value that matches the dataset you want to push, so the Cloudflare App for Splunk parses events correctly: + - HTTP requests, Firewall events, Spectrum events, and most zone-scoped datasets: `cloudflare:json` + - DNS logs, including Zero Trust Gateway DNS: `cloudflare:dns` + - Audit logs: `cloudflare:audit` + - Access requests: `cloudflare:access` + - CASB findings, Zero Trust Gateway HTTP, and Zero Trust Gateway Network: `cloudflare:json` +- Only turn on **Use insecure skip verify option** if your Splunk instance uses a self-signed certificate, as noted in [Task 1](#task-1---install-and-configure-the-cloudflare-app-for-splunk). -Enable the Logpush job through the Cloudflare dashboard or through the API by following the instructions on [Enable Logpush to Splunk](/logs/logpush/logpush-job/enable-destinations/splunk/). To enable through the dashboard: +Under **Send the following fields**, keep the defaults or refer to the [Dashboard section](#task-3---view-the-dashboards) to select the fields required to fully populate the Cloudflare App for Splunk dashboards. -1. Navigate to the Cloudflare dashboard and select **Analytics & Logs** > **Logs**. -2. Select **Edit** and select the fields referenced in the Dashboard section below to fully populate all tables and graphs. -3. Enable the Logpush job by toggling on the switch next to the Edit link. Data takes a few minutes to populate. +After you create the job, enable it to start sending logs. To confirm end-to-end delivery, run the following search in Splunk: -To validate that you are receiving data, search `index=cloudflare` in Splunk. +```txt +index="cloudflare" +``` + +Cloudflare sends two system confirmation events to verify connectivity and delivery setup as soon as you enable the job. Regular Cloudflare logs start streaming shortly afterward. Data can take a few minutes to appear. ## Task 3 - View the Dashboards @@ -189,6 +206,123 @@ Available Filters: - Client Request Method +## Splunk CIM field mappings + +The Cloudflare App for Splunk maps Cloudflare log fields to [Splunk Common Information Model (CIM)](https://docs.splunk.com/Documentation/CIM/latest/User/Overview) field names, so that you can search, correlate, and accelerate Cloudflare data alongside other CIM-compliant sources in your Splunk deployment. The following tables list the mappings the app applies per Cloudflare Logpush dataset. + +### HTTP requests + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| -------------------------- | ------------------- | +| `ClientIP` | `src_ip` | +| `ClientRequestBytes` | `bytes_in` | +| `ClientRequestHost` | `dest_host` | +| `ClientRequestMethod` | `http_method` | +| `ClientRequestPath` | `uri_path` | +| `ClientRequestReferer` | `http_referrer` | +| `ClientRequestURI` | `uri` | +| `ClientRequestUserAgent` | `http_user_agent` | +| `ClientSrcPort` | `src_port` | +| `ClientSSLProtocol` | `ssl_protocol` | +| `EdgeRateLimitAction` | `action` | +| `EdgeResponseBytes` | `bytes_out` | +| `EdgeResponseContentType` | `http_content_type` | +| `EdgeResponseStatus` | `status` | +| `OriginIP` | `dest_ip` | +| `OriginResponseTime` | `response_time` | + +### CASB findings + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| ------------------------ | ---------------- | +| `AssetDisplayName` | `dest` | +| `AssetLink` | `url` | +| `FindingTypeDisplayName` | `category` | +| `FindingTypeID` | `category_id` | +| `FindingTypeSeverity` | `severity` | +| `InstanceID` | `signature_id` | + +### Zero Trust Gateway DNS + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| ---------------- | ---------------- | +| `DstIP` | `dest` | +| `DstPort` | `dest_port` | +| `Protocol` | `transport` | +| `QueryName` | `query` | +| `QueryTypeName` | `query_type` | +| `RCode` | `reply_code` | +| `SrcIP` | `src` | +| `SrcPort` | `src_port` | + +### Audit logs + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| ---------------- | ---------------- | +| `ActionResult` | `status` | +| `ActionType` | `action` | +| `ActorID` | `user` | +| `ActorIP` | `src` | +| `ActorType` | `user_category` | +| `OwnerID` | `src_user` | + +### Access requests + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| ------------------------------ | ------------------------ | +| `Action` | `action` | +| `AppDomain` | `app` | +| `Connection` | `authentication_service` | +| `IPAddress` | `src` | +| `PurposeJustificationResponse` | `reason` | +| `RayID` | `signature_id` | +| `UserUID` | `user_id` | + +### Zero Trust Gateway HTTP + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| ---------------- | ----------------- | +| `Action` | `action` | +| `DestinationIP` | `dest` | +| `DestinationPort` | `dest_port` | +| `HTTPMethod` | `http_method` | +| `Referer` | `http_referrer` | +| `SourceIP` | `src` | +| `URL` | `url` | +| `UserAgent` | `http_user_agent` | +| `UserID` | `user` | + +### Zero Trust Gateway Network + +The app applies the following mappings: + +| Cloudflare field | Splunk CIM field | +| ----------------- | ---------------------- | +| `Action` | `action` | +| `DestinationIP` | `dest_ip` | +| `DestinationPort` | `dest_port` | +| `DeviceName` | `dvc` | +| `OverrideIP` | `dest_translated_ip` | +| `OverridePort` | `dest_translated_port` | +| `PolicyID` | `rule` | +| `SessionID` | `session_id` | +| `SourceIP` | `src_ip` | +| `SourcePort` | `src_port` | +| `Transport` | `transport` | +| `UserID` | `user` | + ## Debugging tips ### Incomplete dashboards