Cloudflare

Cloudflare logs provide visibility into your edge security and network traffic. DNS logs reveal DNS query patterns and potential malicious domains, while HTTP logs capture detailed request metadata including headers, status codes, and security events. These logs are useful for detecting threats, investigating security incidents, and understanding your organization's internet activity.

Cloudflare Logpush allows you to push your Cloudflare logs directly to Amazon S3. This guide walks through how to set up Cloudflare as a log source in Scanner Collect, so that logs can be ingested from S3, normalized, and indexed for search and detection.

Scanner Collect focuses on two Cloudflare zone-scoped datasets: DNS and HTTP. For all other Cloudflare log types, including account-scoped datasets, teams are welcome to index them from S3 themselves by creating an Index Rule.

Collect logs in S3

1

Have a Cloudflare Enterprise subscription

Logpush is only available for Cloudflare Enterprise customers. Confirm that your account has an Enterprise subscription before proceeding.

2

Set up S3 bucket and Logpush

Follow the Cloudflare Logpush setup guide to configure your S3 bucket and enable Logpush to a bucket that Scanner is linked to.

3

Configure Logpush format

When setting up Logpush, ensure that files are written as newline delimited JSON and gzipped.

Create an Index Rule

Once Cloudflare logs are landing in your S3 bucket, Create an Index Rule to ingest the logs via Scanner Collect for fast search and detections.

Cloudflare Defaults

During setup, select Cloudflare: DNS or Cloudflare: HTTP (depending on which logs you want to ingest) as the source type to have the following defaults pre-populated:

• File Type: Json
• Compression: Gzip
• Transformations: Add Metadata, Parse JSON Columns
• Timestamp Field:

  • .Timestamp for Cloudflare: DNS
  • .EdgeStartTimestamp for Cloudflare: HTTP