Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Cloudflare Cloud Connector

Prerequisites to Configure the Cloudflare Cloud Connector

Before you configure the Cloudflare Cloud Connector you must complete the following prerequisites:

Obtain a Global API Key

To use the Cloudflare API, an API token or an API key to authenticate the source of the API request is required. For more information, see the Cloudflare API documentation. To obtain the Global API Key, refer to the Cloudflare User Profile section in the API Tokens page. The Global API Key is required for configuring the cloud connector via basic authentication method, and for obtaining the organization name. For more information, see Get Global API Key in the Cloudflare documentation.

Global_API_Key_cloudflare.png

Obtain the Organization Name

To find your organization name, run the following curl command using a curl tool. Enter the Global API Key in the curl command as the X-Auth-Key and the email associated with the Cloudflare account as the X-Auth-Email.

curl --request GET --url https://api.cloudflare.com/client/v4/accounts --header 'Content-Type: application/json' --header 'X-Auth-Key: <global_auth_key> --header 'X-Auth-Email: <email_address>'
curl_command_cloudflare.png

The organization name is the value of the name field in the returned JSON object. After you obtain the organization name by running the curl command, proceed to:

Obtain an API Token

To create an API token with the following required permissions, see the Cloudflare Documentation. Cloudflare limits the API calls for an account. To add Cloudflare to the Exabeam platform, create a new Cloudflare account with the following required permissions. For more information about permissions, see API token permissions.

  • All Accounts

    • Access: Audit Logs: Read

    • Account Filter List: Read

    • Account Settings: Read

  • All Zones

    • Zone: Read

    • Logs: Read

    • Firewall Services: Read

    • Zone WAF: Read

    • Zone Analytics: Read

  • All Users

    • Memberships: Read

    Token_permissions.png

    Add the new account that you created to your organization’s account in Cloudflare. If you have the Cloudflare enterprise plan, set up a multi-user account. For more information, see the Cloudflare Documentation.

Enable the Retention Policy

For Cloudflare to retrieve events from the CDN logs endpoint, enable the retention policy for each of the zones. For the procedure to enable the retention policy, see the Cloudflare Documentation.

Configure the Cloudflare Cloud Connector

Cloudflare, a web infrastructure and website security company, provides content delivery network services to protect against cyber threats such as SQL injection and identity theft. Cloudflare secures websites, APIs, applications, and internal resources. Cloudflare security solutions offer a suite of products that offers firewall, IOT security, bot management, DDoS protection, and internet security. For more information visit their website.

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module and Events

Account audit logs

Provides audit logs for the account events such as sign-ins, account members and role changes, account setting changes, API token creation, revoke and view, MFA enablement and disablement.

Provides audit logs for zones in the account such as zone add, zone remove, firewall rule add, firewall rule remove, route add, and route remove.

CDN logs

Provides logs that contain data related to the connecting client, the request path through the Cloudflare network, and the response from the origin web server, for each zone.

Firewall events

Provides comprehensive firewall events per requests including detailed information.

Table 8. Audit source API and security events supported by the connector


To configure the Cloudflare Cloud Connector to import data into the Exabeam Cloud Connector platform:

  1. Complete the Prerequisites to Configure the Cloudflare Cloud Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, then select Cloudflare from the list.

  5. In the Accounts section, enter the required information. Required fields are indicated with a red bar.

    1. Tenant – Select a tenant to attach to the connector if you are using a multi-tenant edition of Exabeam. Otherwise, select default.

    2. Account Name – Specify a name for the Cloudflare connector. For example, Cloudflare_ web_security.

    3. Description – Describe the Cloudflare connector (optional). For example, Cloudflare content delivery network services to protect against cyber threats.

    4. Authentication Method – Select basic or token.

      Authentication_method.png

      If you select the basic authentication method, enter the required information for the following fields.

      1. Email Address – Enter the email address that you obtained while completing prerequisites.

      2. API Global Token – Enter the API Global Key that you obtained while completing prerequisites.

      3. Organization Name – Enter the name of your organization that you obtained while completing prerequisites.

      If you select the token authentication method, enter the required information for the following fields.

      1. API Token – Enter the API token that you obtained while completing prerequisites.

      2. Organization Name – Enter the name of your organization that you obtained while completing prerequisites.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.