Skip to main content

CollectorsCloud Collectors Administration Guide

Configure the Cloudflare Cloud Collector

Set up the Cloudflare Cloud Collector to continuously ingest events from the account based and zone based data sources that include Audit logs, HTTP requests, and Gateway DNS events.

Use the following steps to set up the Cloudflare Cloud Collector.

  1. Before you configure the Cloudflare Cloud Collector, ensure that you complete the prerequisites.

  2. Log in to the New-Scale Security Operations Platform with your registered credentials as an administrator.

  3. Navigate to Collectors > Cloud Collectors.

  4. Click New Collector.

  5. Click Cloudflare.

  6. Enter the following information for the cloud collector.

    • NAME – Specify a name for the Cloud Collector instance.

    • Format – The format for receiving data is set to JSON format by default.

  7. (Optional) SITE – Select an existing site or to create a new site with a unique ID, click manage your sites. Adding a site name helps you to ensure efficient management of environments with overlapping IP addresses.

    By entering a site name, you associate the logs with a specific independent site. A sitename metadata field is automatically added to all the events that are going to be ingested via this collector. For more information about Site Management, see Define a Unique Site Name.

  8. (Optional) TIMEZONE – Select a time zone applicable to you for accurate detections and event monitoring.

    By entering a time zone, you override the default log time zone. A timezone metadata field is automatically added to all events ingested through this collector.

    Timezone_sitename_site_management_1.png

  9. Click Install.

    The message box displays the URL to which logs are sent.

  10. Copy the URL containing authentication token by clicking the copy icon.

    Record the URL for later use when you configure Cloudflare instance on the Cloudflare platform to forward logs to Exabeam.

    Cloudflare_last_screen.png

  11. Proceed to Configure Cloudflare to forward logs to Exabeam.

Configure Cloudflare instance to Forward Logs to Exabeam

Use the following steps to configure the Cloudflare Cloud Collector to receive data into the New-Scale Security Operations Platform.

  1. Log in to the Cloudflare platform with your registered credentials as an administrator.

  2. Navigate to Account > Analytics & Logs > Logpush.

  3. To push the logs to the Cloudflare cloud collector, click Create a Logpush job.

    Cloudflare_portal_3.png

  4. Select the destination HTTP destination where you want to push the logs.

    Cloudflare_portal_4.png

  5. In the HTTP endpoint box, paste the URL containing authorization token that you obtained by configuring the Cloudflare cloud collector.

  6. Click Continue.

  7. Select the dataset that include account level logs: Gateway network, Access requests, Audit logs, Gateway HTTP, and Gateway DNS, and Zone level logs: HTTP request, Firewall events.

  8. Configure a logpush job for the selected dataset.

    Cloudflare_portal_5.png

  9. Select the fields to be included in the log.

  10. Click Submit.

    The Logpush job that you created is listed on the Logpush page. The events that are generated for the selected dataset are pushed to the Cloudflare cloud collector. You can view the logs and volume on the Cloud Collectors Overview page.

    If you want to monitor data separately for individual datasets or data sources, create multiple Cloudflare Cloud collector instances.