Cloudflare Zero Trust

Details

ID	`Cloudflare Zero Trust`
Provider	Cloudflare
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Cloudflare provides network and security products for consumers and businesses, utilizing reverse proxies for web traffic, edge computing, and a content distribution network to provide content across its network of servers.
This integration was integrated and tested with version 1 of Cloudflare Zero Trust.

Authorization

Two authorization types are supported:

API Token - Requires generating an account or a user API token.
Global API Key (Legacy) - Requires retrieving the global API key and finding the associated Email address.

Refer to the integration help section for detailed instructions on how to attain the required credentials.

Token Permissions

The API Token authorization method requires an access token with the following permissions:

Account - Account Settings - Read
Account - Access: Audit Logs - Read

Note: It is recommended to use an account token (instead of a user token) to set up this integration.

Configure Cloudflare Zero Trust in Cortex

Parameter	Required	Additional Info
Server URL	True	The base URL for the Cloudflare API (e.g., https://api.cloudflare.com).
Account ID	True	Obtain from the Account Overview page.
Trust any certificate (not secure)	False
Use system proxy settings	False
Authorization Type	True	Possible values are: API Token, Global API Key (Legacy). Default value is Global API Key (Legacy).
API Token	False	Obtain from the Cloudflare API Tokens page.
API Email	False	Obtain from the Cloudflare Profile page.
Global API Key	False	Obtain from the Cloudflare API Tokens page.
Event types to fetch	True	Specify the types of events to fetch. Possible values are: Account Audit Logs, User Audit Logs, and Access Authentication Logs.
Maximum number of account audit logs per fetch	False
Maximum number of user audit logs per fetch	False
Maximum number of access authentication logs per fetch	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cloudflare-zero-trust-get-events

Gets events from Cloudflare Zero Trust.

Base Command

cloudflare-zero-trust-get-events

Input

Argument Name	Description	Required
limit	The number of events to return per type. Default is 10.	Optional
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Optional
start_date	The start date from which to filter events.	Optional
event_types_to_fetch	Comma-separated list of event types to fetch. Possible values are: Account Audit Logs, User Audit Logs, Access Authentication Logs. Default is Account Audit Logs,User Audit Logs.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
account_id — Account ID (required)
auth_type — Authorization Type (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
event_types_to_fetch — Event types to fetch (required)
max_fetch_account_audit_logs — Maximum number of account audit logs per fetch
max_fetch_user_audit_logs — Maximum number of user audit logs per fetch
max_fetch_access_authentication_logs — Maximum number of access authentication logs per fetch
credentials — API Email
token_credentials —

Commands (1)

cloudflare-zero-trust-get-events
Gets events from Cloudflare Zero Trust.

Source

CloudflareZeroTrustEventCollector.py CloudflareZeroTrustEventCollector_test.py CloudflareZeroTrustEventCollector.yml CloudflareZeroTrustEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Cloudflare
sectionorder:
- Connect
- Collect
commonfields:
  id: Cloudflare Zero Trust
  version: -1
configuration:
- name: url
  defaultvalue: https://api.cloudflare.com/
  display: Server URL
  required: true
  type: 0
  section: Connect
- display: Account ID
  name: account_id
  type: 0
  required: true
  section: Connect
- display: Authorization Type
  name: auth_type
  defaultvalue: Global API Key (Legacy)
  options:
  - API Token
  - Global API Key (Legacy)
  required: true
  type: 15
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Event types to fetch
  name: event_types_to_fetch
  type: 16
  defaultvalue: Account Audit Logs, User Audit Logs, Access Authentication Logs
  section: Collect
  advanced: true
  options:
  - Account Audit Logs
  - User Audit Logs
  - Access Authentication Logs
  required: true
- name: max_fetch_account_audit_logs
  defaultvalue: 5000
  section: Collect
  display: Maximum number of account audit logs per fetch
  advanced: true
  required: false
  type: 0
- name: max_fetch_user_audit_logs
  defaultvalue: 5000
  section: Collect
  display: Maximum number of user audit logs per fetch
  advanced: true
  required: false
  type: 0
- name: max_fetch_access_authentication_logs
  defaultvalue: 5000
  section: Collect
  display: Maximum number of access authentication logs per fetch
  advanced: true
  required: false
  type: 0
- display: API Email
  section: Connect
  displaypassword: Global API Key
  name: credentials
  type: 9
  required: false  # Only needed if using "Global API key" auth type
  additionalinfo: To use the Global API Key authorization type, provide an API Email and Global Key. These fields should be left blank if the API Token authorization type is selected.
- displaypassword: API Token
  hiddenusername: true
  name: token_credentials
  type: 9
  section: Connect
  required: false  # Only needed if using "API token" auth type
  additionalinfo: To use the API Token authorization type, provide an API Token. This field should be left blank if the Global API Key authorization type is selected.
description: Cloudflare provides network and security products for consumers and businesses, utilizing reverse proxies for web traffic, edge computing, and a content distribution network to provide content across its network of servers.
display: Cloudflare Zero Trust
name: Cloudflare Zero Trust
script:
  commands:
  - arguments:
    - description: The number of events to return per type.
      name: limit
      defaultValue: 10  
    - name: should_push_events
      description: If true, the command will create events, otherwise it will only display them.
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: The start date from which to filter events.
      name: start_date
    - description: A comma-separated list of event types to fetch.
      name: event_types_to_fetch
      defaultValue: Account Audit Logs,User Audit Logs
      auto: PREDEFINED
      predefined:
      - Account Audit Logs
      - User Audit Logs
      - Access Authentication Logs
      required: false
      isArray: true
    description: Gets events from Cloudflare Zero Trust.
    name: cloudflare-zero-trust-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam