Cloudflare WAF

1 About The Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About The Device

Cloudflare’s Web Application Firewall (WAF) protects your website from SQL injection, cross-site scripting (XSS) and zero-day attacks, including OWASP-identified vulnerabilities and threats targeting the application layer.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Cloudflare
Product Name	WAF
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method

Log Type

Ingestion label

Preferred Logging Protocol - Format

Log Collection Method

Cloudflare WAF

CLOUDFLARE_WAF

CLOUDFLARE_AUDIT

CLOUDFLARE

Cloud Storage - JSON

C2C-Push

Device Configuration

Cloudflare WAF integration with AWS S3 and SQS:

Pre-Requisite:

Amazon S3 bucket is created. Please refer the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html
AWS Simple Queue Service (SQS) with S3 Storage configured. Please refer the following document to configure SQS with S3 storage. Accenture MDR Quick Start Guide in Configuring AWS Simple Queue Service (SQS) with S3 Storage
A user in Cloudflare with Log Share role.
AWS IAM user with name cloudflare-logpush

Create Logpush Job:

Log in to the Cloudflare dashboard.
Select the Enterprise account or domain you want to use with Logpush.
Navigate to Analytics & Logs > Logpush.
Select Create a Logpush job.
In Select a destination, choose Amazon S3.
Enter or select the following destination information:
- Bucket - S3 bucket name
- Path - bucket location within the storage container
- Organize logs into daily subfolders (recommended)
- Bucket region - provide the region of bucket
- Encryption constraint in bucket policy
- For Grant Cloudflare access to upload files to your bucket, make sure your bucket has a policy (if you did not add it already):
  - Copy the JSON policy, then go to your bucket in the Amazon S3 console and paste the policy in Permissions > Bucket Policy and select Save.

{
  "Id": "<POLICY_ID>",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1506627150918",
      "Action": ["s3:PutObject"],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::burritobot/logs/*",
      "Principal": {
        "AWS": ["arn:aws:iam::391854517948:user/cloudflare-logpush"]
      }
    }
  ]
}

Replace the Resource value with your own bucket path. The AWS Principal is owned by Cloudflare and should not be changed.

a. Cloudflare uses Amazon Identity and Access Management (IAM) to gain access to your S3 bucket. The Cloudflare IAM user needs PutObject permission for the bucket.

b. Logs are written into that bucket as gzipped objects using the S3 Access Control List (ACL) Bucket-owner-full-control permission.

c. For illustrative purposes, imagine that you want to store logs in the bucket burritobot, in the logs directory. The S3 URL would then be s3://burritobot/logs.

d. Ensure Log Share permissions are enabled, before attempting to read or configure a Logpush job. For more information refer to the Roles section.

e. When you are done entering the destination details, select Continue.

To prove ownership, Cloudflare will send a file to your designated destination. To find the token, select the Open button in the Overview tab of the ownership challenge file, then paste it into the Cloudflare dashboard to verify your access to the bucket. Enter the Ownership Token and select Continue.
Select the Firewall Events dataset to push to the storage service.
In the next step, you need to configure your logpush job:
- Enter the Job Name
- Under If logs match, you can select the events to include and/or remove from your logs.
- In Send the following fields, you can choose to either push all logs to your storage destination or selectively choose which logs you want to push.

Do not selectively choose to push only limited fields, please ensure that all log fields are selected.

In Advanced Options,
- Choose default time format

11. Select Submit once you are done configuring your logpush job.

Repeat Steps 4 to 12 and create log push jobs for HTTP Requests from Zone Scope dataset and again repeat Steps 4 to 10 one more time for Audit Log from Account Scope dataset.

Please refer below page to check required IAM user policies.

https://mdrkb.atlassian.net/wiki/x/hoCdEQ

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

S3: For S3 or SQS logging source, S3 URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/s3.html

SQS: For SQS logging source, SQS URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/sqs-service.html

Integration Parameters

Integration via AWS SQS:

Property	Default Value	Description

Property	Default Value	Description
REGION	Yes	Select the region of your S3 bucket
QUEUE NAME	Yes	The SQS queue name.
ACCOUNT NUMBER	Yes	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	Yes	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	Yes	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	Yes	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
S3 BUCKET ACCESS KEY ID	No	This is the 20 character ID associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
S3 BUCKET SECRET ACCESS KEY	No	This is the 40 character access key associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
ASSET NAMESPACE	No	To assign an asset namespace to all events that are ingested from a particular feed, set the `"namespace"` field within `details`. The `namespace` field is a string.