JA EN
shiichan

Cloudflare Logs Can Now Flow Straight into Azure Sentinel!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#devops

Hi everyone, it's me! I've got great news today for anyone monitoring Cloudflare logs through a SIEM!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, a new Azure Sentinel Connector is now available for integrating Logpush with Microsoft Sentinel. This new connector is built on Microsoft's Codeless Connector Framework (CCF), and it replaces the previous Azure Functions-based connector.

The flow works like this: Cloudflare's Logpush sends logs to Azure Blob Storage, and the new Sentinel Connector ingests those logs directly into Microsoft Sentinel.

The story so far

Previously, Cloudflare logs were ingested into Sentinel through an Azure Functions-based connector. That approach left room for improvement when it came to security, data control, and how easy it was to build and maintain.

What changes

With this move to a CCF-based connector, here's what's improved:

  • Simplified implementation: easier for engineering teams to set up and maintain
  • Cost control: new support for Data Collection Rules (DCRs) lets you filter and transform logs at ingestion time, which can bring cost savings
  • Enhanced security: CCF provides a higher level of security compared to the older Azure Functions connector
  • Data Lake integration: native integration with Data Lake is included

For security operations teams, this means what's happening at Cloudflare's edge can now flow into Sentinel more securely, and with more flexibility over cost.

Dive Deep

The new connector is available through the Microsoft Marketplace (cloudflare.azure-sentinel-solution-cloudflare-ccf). To set it up, you'll need an Azure subscription with Contributor or Owner role permissions, an existing Microsoft Sentinel workspace, and an Azure Storage account with a blob container. The storage account needs to live in the same subscription as Sentinel, and it's worth noting that public network access to the storage account needs to be enabled.

Here's the rough setup flow:

  • In the Cloudflare dashboard, create a Logpush job with Azure Blob Storage as the destination (using a SAS token with write and create permissions)
  • In the Azure portal, open Microsoft Sentinel's Content Hub, search for "Cloudflare," and install the CCF-based solution
  • Configure the connector with the blob container URL, resource group name, storage account location, and subscription ID

The connector supports HTTP request logs, with more than 80 fields available for parsing and workbook visualizations, including ClientIP, ClientCountry, EdgeResponseStatus, WAFAction, RayID, and WorkerStatus. For the full setup steps and the complete list of supported logs, Cloudflare's developer documentation has all the details, so it's worth checking that before you roll this out.

Wrap-up

  • A new Azure Sentinel Connector now links Logpush with Microsoft Sentinel
  • It's built on Microsoft's Codeless Connector Framework (CCF), replacing the old Azure Functions-based connector
  • Data Collection Rules support lets you filter and transform logs at ingestion time, helping optimize cost
  • It brings enhanced security and native Data Lake integration
  • Available through the Microsoft Marketplace, with setup steps and supported logs documented on Cloudflare's developer site

This is a solid upgrade worth checking out for any security operations team running Cloudflare logs through Microsoft Sentinel, or anyone evaluating SIEM integrations right now!

Related posts