Cloudflare Zero Trust

Cloudflare provides network and security products for consumers and businesses, utilizing reverse proxies for web traffic, edge computing, and a content distribution network to provide content across its network of servers.

Analytics & SIEM · Cloudflare Zero Trust

Details

IDCloudflare Zero Trust
ProviderCloudflare
CategoryAnalytics & SIEM
From Version8.4.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM

README

Cloudflare provides network and security products for consumers and businesses, utilizing reverse proxies for web traffic, edge computing, and a content distribution network to provide content across its network of servers.
This integration was integrated and tested with version 1 of Cloudflare Zero Trust.

Authorization

Two authorization types are supported:

  • API Token - Requires generating an account or a user API token.
  • Global API Key (Legacy) - Requires retrieving the global API key and finding the associated Email address.

Refer to the integration help section for detailed instructions on how to attain the required credentials.

Token Permissions

The API Token authorization method requires an access token with the following permissions:

  • Account - Account Settings - Read
  • Account - Access: Audit Logs - Read

Note: It is recommended to use an account token (instead of a user token) to set up this integration.

Configure Cloudflare Zero Trust in Cortex

Parameter Required Additional Info
Server URL True The base URL for the Cloudflare API (e.g., https://api.cloudflare.com).
Account ID True Obtain from the Account Overview page.
Trust any certificate (not secure) False  
Use system proxy settings False  
Authorization Type True Possible values are: API Token, Global API Key (Legacy). Default value is Global API Key (Legacy).
API Token False Obtain from the Cloudflare API Tokens page.
API Email False Obtain from the Cloudflare Profile page.
Global API Key False Obtain from the Cloudflare API Tokens page.
Event types to fetch True Specify the types of events to fetch. Possible values are: Account Audit Logs, User Audit Logs, and Access Authentication Logs.
Maximum number of account audit logs per fetch False  
Maximum number of user audit logs per fetch False  
Maximum number of access authentication logs per fetch False  

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cloudflare-zero-trust-get-events

Gets events from Cloudflare Zero Trust.

Base Command

cloudflare-zero-trust-get-events

Input

Argument Name Description Required
limit The number of events to return per type. Default is 10. Optional
should_push_events If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false. Optional
start_date The start date from which to filter events. Optional
event_types_to_fetch Comma-separated list of event types to fetch. Possible values are: Account Audit Logs, User Audit Logs, Access Authentication Logs. Default is Account Audit Logs,User Audit Logs. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (required)
  • account_id — Account ID (required)
  • auth_type — Authorization Type (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • event_types_to_fetch — Event types to fetch (required)
  • max_fetch_account_audit_logs — Maximum number of account audit logs per fetch
  • max_fetch_user_audit_logs — Maximum number of user audit logs per fetch
  • max_fetch_access_authentication_logs — Maximum number of access authentication logs per fetch
  • credentials — API Email
  • token_credentials —

Commands (1)

  • cloudflare-zero-trust-get-events

    Gets events from Cloudflare Zero Trust.

Source

CloudflareZeroTrustEventCollector.py CloudflareZeroTrustEventCollector_test.py CloudflareZeroTrustEventCollector.yml CloudflareZeroTrustEventCollector_description.md command_examples.txt
Download History Raw 
## Cloudflare Zero Trust

Use this integration to fetch account audit logs, user audit logs, and access authentication logs from Cloudflare Zero Trust as events in Cortex XSIAM.

Two authorization types are supported:

- **API Token** - Requires generating an account or a user API token.
- **Global API Key (Legacy)** - Requires retrieving the global API key and finding the associated Email address.

---

### **API Token (Recommended)**

Two API token types are supported:

- **Account token** - Allows you to set up durable integrations that can act as service principals with their own specific set of permissions.
- **User token** - Acts on behalf of a particular user and inherits a subset of that user's permissions.

User tokens are better for ad hoc tasks like scripting, where acting as the user is ideal and durability is less of a concern.

It is recommended to use an **account token** to set up this integration.

#### Generate API Token

1. Go to the [Cloudflare dashboard](https://dash.cloudflare.com).
   - For account tokens (recommended), navigate to **Manage Account** > **API Tokens**.
   - For user tokens, navigate to **My Profile** > **API Tokens**
2. Click **Create Token**.
3. Scroll to the **Custom token** section and click **Get started**.
4. Give the token a descriptive name.
5. Set the token's permissions, as follows:
    - **Account** - **Account Settings** - **Read**
    - **Account** - **Access: Audit Logs** - **Read**
6. For user tokens, choose which account resources the token is authorized to access, as follows:
    - **Include** - **All accounts**
7. [Optional] Restrict how the token is used in the Client IP Address Filtering and TTL (time to live) fields.
8. Click **Continue to summary** at the bottom of the screen.
9. Click **Create Token** to generate a new API access token.
10. Store the token in a secure location and use it to configure a new instance of this integration.

To learn more about API tokens, visit the [Cloudflare API Tokens Documentation](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)

---

### **Global API Key (Legacy)**

Global API key is the previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

#### Retrieve Global API Key

1. Go to the [Cloudflare API Tokens page](https://dash.cloudflare.com/profile/api-tokens).
2. Scroll to the **API Keys** section.
3. Click **View** to reveal the Global API Key.  (You may need to enter your password).
4. Store the global key in a secure location and use it to configure a new instance of this integration.

To learn more about the Global API Key, visit the [Cloudflare API Key Documentation.](https://developers.cloudflare.com/fundamentals/api/get-started/keys/).

#### Find Associated Email

The associated API email can be found on the [Cloudflare My Profile page](https://dash.cloudflare.com/profile).

For more details on verifying your associated email, refer to [Verify Cloudflare Email Address](https://developers.cloudflare.com/fundamentals/setup/account/verify-email-address/).