NOTE: The Cloudflare (Using Blob Container) (via Codeless Connector Framework) data connector available in the solution requires the Azure Blob Storage account and the Microsoft Sentinel workspace to be in the same Azure subscription and the same Resource Group. Deploying across different subscriptions or resource groups may result in errors such as CreateDataFlowResources not defined during connector configuration.
", + "descriptionMarkdown": "The Cloudflare data connector ingests Cloudflare Logpush data from Azure Blob Storage into Microsoft Sentinel. It supports multiple Cloudflare accounts, storage accounts, and containers in one workspace while retaining the Cloudflare account identity on every ingested record. Refer to the [Cloudflare Logs documentation](https://developers.cloudflare.com/logs/about/) for more information.", "graphQueriesTableName": "CloudflareV2_CL", "graphQueries": [ { @@ -27,7 +27,7 @@ "dataTypes": [ { "name": "{{graphQueriesTableName}}", - "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max(TimeGenerated)\n|where isnotempty(Time)" + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ @@ -56,94 +56,200 @@ ], "customs": [ { - "name": "Create a storage account and a container", - "description": "Before setting up logpush in Cloudflare, first create a storage account and a container in Microsoft Azure. Use [this guide](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) to know more about Container and Blob. Follow the steps in the [documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal) to create an Azure Storage account." + "name": "Deployment permissions", + "description": "The identity adding a collector must be able to deploy resources in the Microsoft Sentinel workspace resource group and in the target storage account resource group. To create the required role assignments, use **Owner** or **Contributor** plus **User Access Administrator** at the applicable scopes." }, { - "name": "Generate a Blob SAS URL", - "description": "Create and Write permissions are required. Refer the [documentation](https://learn.microsoft.com/en-us/azure/ai-services/translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers) to know more about Blob SAS token and url." + "name": "Microsoft Sentinel service principal access", + "description": "The template grants the Microsoft Sentinel service principal **Storage Blob Data Contributor** on the selected container and **Storage Queue Data Contributor** on the two per-instance queues. These are data-plane roles only; the template does not grant Storage Account Contributor or account-key access." }, { - "name": "Collecting logs from Cloudflare to your Blob container", - "description": "Follow the steps in the [documentation](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/) for collecting logs from Cloudflare to your Blob container." + "name": "Cloudflare Logpush", + "description": "Configure Cloudflare Logpush to write JSON or compressed JSON logs to the selected blob container. Ensure the Cloudflare identity has the required Logpush permissions. See [Cloudflare Logpush permissions](https://developers.cloudflare.com/logs/logpush/permissions/) and [Azure destination setup](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/)." + }, + { + "name": "Role-assignment propagation", + "description": "The deployment includes a bounded 90-second propagation buffer before creating the connector. The buffer uses an Azure deployment script, which can create short-lived supporting resources, incur small transient cost, and be blocked by restrictive Azure Policy. Azure role propagation can take longer; if access initially fails, wait and submit the same collector again. Deterministic naming makes that retry idempotent." + }, + { + "name": "Cleanup semantics", + "description": "Removing only the Microsoft Sentinel data connector does not remove its DCR, DCE, diagnostic setting, Event Grid subscription, queues, or role assignments. One-click deletion is intentionally not offered. Remove resources sharing the connector's deterministic instance key, but do not delete the shared `CloudflareV2_CL` table or a system topic still used by another collector." } ] }, "instructionSteps": [ { - "title": "Connect Cloudflare Logs to Microsoft Sentinel", - "description": "To enable Cloudflare logs for Microsoft Sentinel, provide the required information below and click on Connect.\n>", + "title": "1. Prepare Azure Storage and Cloudflare Logpush", + "description": "Create an Azure Storage account and blob container, then configure Cloudflare Logpush to write to that container. Follow [Create a storage account](https://learn.microsoft.com/azure/storage/common/storage-account-create), [Create a container](https://learn.microsoft.com/azure/storage/blobs/blob-containers-portal), and [Configure the Cloudflare Azure destination](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/)." + }, + { + "title": "2. Add and review Cloudflare collectors", + "description": "Select **Add new collector** for each immutable Cloudflare account and storage container combination. Redeploying the same values updates the same isolated resources instead of creating a duplicate.", "instructions": [ { + "type": "DataConnectorsGrid", "parameters": { - "tenantId": "[subscription().tenantId]", - "name": "principalId", - "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f" - }, - "type": "ServicePrincipalIDTextBox_test" - }, - { - "parameters": { - "label": "The Blob container's URL you want to collect data from", - "type": "text", - "name": "blobContainerUri", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account resource group name", - "type": "text", - "name": "StorageAccountResourceGroupName", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account location", - "type": "text", - "name": "StorageAccountLocation", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account subscription id", - "type": "text", - "name": "StorageAccountSubscription", - "validations": { - "required": true - } - }, - "type": "Textbox" + "mapping": [ + { + "columnName": "Connector", + "columnValue": "name" + }, + { + "columnName": "Cloudflare account", + "columnValue": "properties.addOnAttributes.CloudflareAccountName" + }, + { + "columnName": "Cloudflare account ID", + "columnValue": "properties.addOnAttributes.CloudflareAccountId" + }, + { + "columnName": "Queue URI", + "columnValue": "properties.request.QueueUri" + }, + { + "columnName": "Stream", + "columnValue": "properties.dcrConfig.streamName" + }, + { + "columnName": "DCR immutable ID", + "columnValue": "properties.dcrConfig.dataCollectionRuleImmutableId" + } + ] + } }, { + "type": "InfoMessage", "parameters": { - "label": "The event grid topic name of the blob container's storage account if exist. else keep empty.", - "description": "The data flow using event grid to send 'blob-created event' notifications. There could be only one event grid topic for each storage account.\nGo to your blob container's storage account and look in the 'Events' section. If you already have a topic, please provide it's name. Else, keep the text box empty.", - "type": "text", - "name": "EGSystemTopicName", - "validations": { - "required": false - } - }, - "type": "Textbox" + "text": "Cleanup is a deliberate manual operation in this phase. Use the 13-character instance key at the end of the connector name to identify its DCR, DCE, diagnostic setting, Event Grid subscription, queues, and role assignments. Preserve the shared CloudflareV2_CL table and any Event Grid system topic used by another collector.", + "visible": true, + "inline": true + } }, { + "type": "ContextPane", "parameters": { - "label": "toggle", - "name": "toggle" - }, - "type": "ConnectionToggleButton" + "contextPaneType": "DataConnectorsContextPane", + "title": "Add a Cloudflare collector", + "subtitle": "Cloudflare Logpush through Azure Blob Storage", + "label": "Add new collector", + "isPrimary": true, + "instructionSteps": [ + { + "instructions": [ + { + "type": "ServicePrincipalIDTextBox_test", + "parameters": { + "tenantId": "[subscription().tenantId]", + "name": "principalId", + "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Cloudflare account ID", + "placeholder": "Enter the immutable Cloudflare account ID", + "description": "Used with the storage and workspace identity to derive deterministic Azure resource names. Do not enter an API token or other secret.", + "type": "text", + "name": "CloudflareAccountId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Cloudflare account display name", + "placeholder": "For example, Contoso Production", + "description": "A friendly label shown in the connections grid and retained on ingested records. It is not used directly in Azure resource names.", + "type": "text", + "name": "CloudflareAccountName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account name", + "placeholder": "Enter the Azure Storage account name", + "type": "text", + "name": "StorageAccountName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Blob container name", + "placeholder": "Enter the blob container name", + "type": "text", + "name": "ContainerName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account resource group", + "placeholder": "Enter the resource group name", + "type": "text", + "name": "StorageAccountResourceGroupName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account subscription ID", + "placeholder": "Enter the subscription GUID", + "type": "text", + "name": "StorageAccountSubscription", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Existing Event Grid system topic name (optional)", + "placeholder": "Leave blank for the first collector on this storage account", + "description": "Azure Event Grid supports one system topic for a storage account. Leave blank to create or reuse this connector's deterministic topic. If another integration already owns the storage account's system topic, enter that topic name so only a new per-instance event subscription is added.", + "type": "text", + "name": "EGSystemTopicName", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Custom log table name (optional)", + "placeholder": "Leave blank to use CloudflareV2_CL", + "description": "Name of the Log Analytics custom table this collector writes to. Must end in _CL. Leave blank to use the solution default CloudflareV2_CL. Each collector instance may target its own table; instances that share a table name share that table.", + "type": "text", + "name": "TableName", + "validations": { + "required": false, + "regex": "^$|^[A-Za-z][A-Za-z0-9_]{0,42}_CL$", + "message": "Table name must start with a letter, contain only letters, digits and underscores, and end with _CL." + } + } + } + ] + } + ] + } } ] } @@ -152,4 +258,4 @@ } }, "dependsOn": null -} \ No newline at end of file +} diff --git a/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_DCR.json b/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_DCR.json index 0b36c447b0d..91faf0f6f1f 100644 --- a/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_DCR.json +++ b/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_DCR.json @@ -2008,7 +2008,7 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = now(), NELType = Type | project-away Type | project TimeGenerated, NELType, AccountID, BytesReceived, BytesSent, ClientTCPHandshakeDurationMs, ClientTLSCipher, ClientTLSHandshakeDurationMs, ClientTLSVersion, ConnectionCloseReason, ConnectionReuse, DestinationTunnelID, DetectedProtocol, DeviceID, DeviceName, EgressColoName, EgressIP, EgressPort, EgressRuleID, EgressRuleName, Email, IngressColoName, Offramp, OriginIP, OriginPort, OriginTLSCertificateIssuer, OriginTLSCertificateValidationResult, OriginTLSCipher, OriginTLSVersion, Protocol, RegistrationID, RuleEvaluationDurationMs, SessionEndTime, SessionID, SessionStartTime, SourceIP, SourceInternalIP, SourcePort, UserID, CPUTimeMs, DispatchNamespace, Entrypoint, Event, EventTimestampMs, EventType, Exceptions, Logs, Outcome, ScriptName, ScriptTags, ScriptVersion, WallTimeMs, ClientAddress, Error, PTY, Payload, ProgramFinishDatetime, ProgramID, ProgramStartDatetime, ProgramType, ServerAddress, SessionFinishDatetime, SessionStartDatetime, TargetID, UserEmail, Username, Body, BodyLength, DestAddr, Headers, Host, Method, Password, R2Path, Referrer, SinkholeID, SrcAddr, Timestamp, URI, URL, UserAgent, AttackCampaignID, AttackID, AttackVector, ColoCity, ColoCode, ColoCountry, ColoGeoHash, ColoName, Datetime, DestinationASN, DestinationASNName, DestinationCountry, DestinationGeoHash, DestinationPort, Direction, GREChecksum, GREEtherType, GREHeaderLength, GREKey, GRESequenceNumber, GREVersion, ICMPChecksum, ICMPCode, ICMPType, IPDestinationAddress, IPDestinationSubnet, IPFragmentOffset, IPHeaderLength, IPMoreFragments, IPProtocol, IPProtocolName, IPSourceAddress, IPSourceSubnet, IPTTL, IPTTLBuckets, IPTotalLength, IPTotalLengthBuckets, IPv4Checksum, IPv4DSCP, IPv4DontFragment, IPv4ECN, IPv4Identification, IPv4Options, IPv6DSCP, IPv6ECN, IPv6ExtensionHeaders, IPv6FlowLabel, IPv6Identification, MitigationReason, MitigationScope, MitigationSystem, ProtocolState, RuleID, RuleName, RulesetID, RulesetOverrideID, SampleInterval, SourceASN, SourceASNName, SourceCountry, SourceGeoHash, TCPAcknowledgementNumber, TCPChecksum, TCPDataOffset, TCPFlags, TCPFlagsString, TCPMSS, TCPOptions, TCPSACKBlocks, TCPSACKPermitted, TCPSequenceNumber, TCPTimestampECR, TCPTimestampValue, TCPUrgentPointer, TCPWindowScale, TCPWindowSize, UDPChecksum, UDPPayloadLength, Verdict, Action, DestinationIP, SignatureID, SignatureMessage, SignatureRevision, ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, OverrideIP, OverridePort, PolicyID, PolicyName, ProxyEndpoint, SNI, SourceIPContinentCode, SourceIPCountryCode, TransportProtocol, VirtualNetworkID, VirtualNetworkName, BlockedFileHash, BlockedFileName, BlockedFileReason, BlockedFileSize, BlockedFileType, DownloadMatchedDlpProfileEntries, DownloadMatchedDlpProfiles, DownloadedFileNames, FileInfo, ForensicCopyStatus, HTTPHost, HTTPMethod, HTTPStatusCode, HTTPVersion, IsIsolated, PrivateAppAUD, Quarantined, RedirectTargetURI, Referer, RequestID, UntrustedCertificateAction, UploadMatchedDlpProfileEntries, UploadMatchedDlpProfiles, UploadedFileNames, AuthoritativeNameServerIPs, CNAMECategoryIDs, CNAMECategoryNames, CNAMEs, CNAMEsReversed, ColoID, CustomResolveDurationMs, CustomResolverAddress, CustomResolverPolicyID, CustomResolverPolicyName, CustomResolverResponse, DoHSubdomain, DoTSubdomain, DstIP, DstPort, EDEErrors, InitialCategoryIDs, InitialCategoryNames, InitialResolvedIPs, InternalDNSFallbackStrategy, InternalDNSRCode, InternalDNSViewID, InternalDNSZoneID, IsResponseCached, Location, LocationID, MatchedCategoryIDs, MatchedCategoryNames, MatchedIndicatorFeedIDs, MatchedIndicatorFeedNames, QueryCategoryIDs, QueryCategoryNames, QueryID, QueryIndicatorFeedIDs, QueryIndicatorFeedNames, QueryName, QueryNameReversed, QuerySize, QueryType, QueryTypeName, RCode, RData, RequestContextCategoryIDs, RequestContextCategoryNames, ResolvedIPCategoryIDs, ResolvedIPCategoryNames, ResolvedIPContinentCodes, ResolvedIPCountryCodes, ResolverDecision, ResourceRecords, ResourceRecordsJSON, SrcIP, SrcIPContinentCode, SrcIPCountryCode, SrcPort, TimeZone, TimeZoneInferredMethod, AlertID, AlertReasons, Attachments, CC, CCName, FinalDisposition, From, FromName, Links, MessageDeliveryMode, MessageID, Origin, OriginalSender, ReplyTo, ReplyToName, SMTPEnvelopeFrom, SMTPEnvelopeTo, SMTPHeloServerIP, SMTPHeloServerIPAsName, SMTPHeloServerIPAsNumber, SMTPHeloServerIPGeo, SMTPHeloServerName, Subject, ThreatCategories, To, ToName, ClientResponseCode, ClusterID, EDNSSubnet, EDNSSubnetLength, QueryDO, QueryRD, QueryTCP, ResponseCached, ResponseCachedStale, ResponseReason, UpstreamIP, UpstreamResponseCode, UpstreamResponseTimeMs, ForensicCopyID, GatewayRequestID, Phase, TriggeredRuleID, ClientVersion, DeviceManufacturer, DeviceModel, DeviceSerialNumber, DeviceType, OSVersion, PostureCheckName, PostureCheckType, PostureEvaluatedResult, PostureExpectedJSON, PostureReceivedJSON, UserUID, AssetDisplayName, AssetExternalID, AssetLink, AssetMetadata, DetectedTimestamp, FindingTypeDisplayName, FindingTypeID, FindingTypeSeverity, InstanceID, IntegrationDisplayName, IntegrationID, IntegrationPolicyVendor, Decision, DomainName, ActionResult, ActionType, ActorEmail, ActorID, ActorIP, ActorType, ID, Interface, Metadata, NewValue, OldValue, OwnerID, ResourceID, ResourceType, When, Allowed, AppDomain, AppUUID, Connection, Country, CreatedAt, IPAddress, PurposeJustificationPrompt, PurposeJustificationResponse, RayID, TemporaryAccessApprovers, TemporaryAccessDuration, ClientASN, ClientASNDescription, ClientCountry, ClientIP, ClientIPClass, ClientRefererHost, ClientRefererPath, ClientRefererQuery, ClientRefererScheme, ClientRequestHost, ClientRequestMethod, ClientRequestPath, ClientRequestProtocol, ClientRequestQuery, ClientRequestScheme, ClientRequestUserAgent, ContentScanObjResults, ContentScanObjSizes, ContentScanObjTypes, Description, EdgeColoCode, EdgeResponseStatus, Kind, LeakedCredentialCheckResult, MatchIndex, OriginResponseStatus, OriginatorRayID, Ref, BotDetectionIDs, BotDetectionTags, BotScore, BotScoreSrc, BotTags, CacheCacheStatus, CacheReserveUsed, CacheResponseBytes, CacheResponseStatus, CacheTieredFill, ClientCity, ClientDeviceType, ClientLatitude, ClientLongitude, ClientMTLSAuthCertFingerprint, ClientMTLSAuthStatus, ClientRegionCode, ClientRequestBytes, ClientRequestReferer, ClientRequestSource, ClientRequestURI, ClientSSLCipher, ClientSSLProtocol, ClientSrcPort, ClientTCPRTTMs, ClientXRequestedWith, Cookies, EdgeCFConnectingO2O, EdgeColoID, EdgeEndTimestamp, EdgePathingOp, EdgePathingSrc, EdgePathingStatus, EdgeRequestHost, EdgeResponseBodyBytes, EdgeResponseBytes, EdgeResponseCompressionRatio, EdgeResponseContentType, EdgeServerIP, EdgeStartTimestamp, EdgeTimeToFirstByteMs, JA3Hash, JA4, JA4Signals, OriginDNSResponseTimeMs, OriginRequestHeaderSendDurationMs, OriginResponseBytes, OriginResponseDurationMs, OriginResponseHTTPExpires, OriginResponseHTTPLastModified, OriginResponseHeaderReceiveDurationMs, OriginSSLProtocol, OriginTCPHandshakeDurationMs, OriginTLSHandshakeDurationMs, ParentRayID, RequestHeaders, ResponseHeaders, SecurityAction, SecurityRuleDescription, SecurityRuleID, SecuritySources, SmartRouteColoID, UpperTierColoID, WAFAttackScore, WAFRCEAttackScore, WAFSQLiAttackScore, WAFXSSAttackScore, WorkerCPUTime, WorkerScriptName, WorkerStatus, WorkerSubrequest, WorkerSubrequestCount, WorkerWallTimeUs, ZoneName, ClientIPASN, ClientIPASNDescription, ClientIPCountry, LastKnownGoodColoCode, CSPDirective, PageURL, URLContainsCDNCGIPath, URLHost, Application, ClientBytes, ClientMatchedIpFirewall, ClientPort, ClientProto, ClientTcpRtt, ClientTlsClientHelloServerName, ClientTlsProtocol, ClientTlsStatus, ConnectTimestamp, DisconnectTimestamp, IpFirewall, OriginBytes, OriginProto, OriginTcpRtt, OriginTlsFingerprint, OriginTlsMode, OriginTlsProtocol, OriginTlsStatus, ProxyProtocol, Status, EventDetails, IP, Source, SecurityActions, SecurityRuleIDs, Transport", + "transformKql": "source | extend TimeGenerated = now(), NELType = Type, CloudflareAccountId = '', CloudflareAccountName = '' | project-away Type | project TimeGenerated, CloudflareAccountId, CloudflareAccountName, NELType, AccountID, BytesReceived, BytesSent, ClientTCPHandshakeDurationMs, ClientTLSCipher, ClientTLSHandshakeDurationMs, ClientTLSVersion, ConnectionCloseReason, ConnectionReuse, DestinationTunnelID, DetectedProtocol, DeviceID, DeviceName, EgressColoName, EgressIP, EgressPort, EgressRuleID, EgressRuleName, Email, IngressColoName, Offramp, OriginIP, OriginPort, OriginTLSCertificateIssuer, OriginTLSCertificateValidationResult, OriginTLSCipher, OriginTLSVersion, Protocol, RegistrationID, RuleEvaluationDurationMs, SessionEndTime, SessionID, SessionStartTime, SourceIP, SourceInternalIP, SourcePort, UserID, CPUTimeMs, DispatchNamespace, Entrypoint, Event, EventTimestampMs, EventType, Exceptions, Logs, Outcome, ScriptName, ScriptTags, ScriptVersion, WallTimeMs, ClientAddress, Error, PTY, Payload, ProgramFinishDatetime, ProgramID, ProgramStartDatetime, ProgramType, ServerAddress, SessionFinishDatetime, SessionStartDatetime, TargetID, UserEmail, Username, Body, BodyLength, DestAddr, Headers, Host, Method, Password, R2Path, Referrer, SinkholeID, SrcAddr, Timestamp, URI, URL, UserAgent, AttackCampaignID, AttackID, AttackVector, ColoCity, ColoCode, ColoCountry, ColoGeoHash, ColoName, Datetime, DestinationASN, DestinationASNName, DestinationCountry, DestinationGeoHash, DestinationPort, Direction, GREChecksum, GREEtherType, GREHeaderLength, GREKey, GRESequenceNumber, GREVersion, ICMPChecksum, ICMPCode, ICMPType, IPDestinationAddress, IPDestinationSubnet, IPFragmentOffset, IPHeaderLength, IPMoreFragments, IPProtocol, IPProtocolName, IPSourceAddress, IPSourceSubnet, IPTTL, IPTTLBuckets, IPTotalLength, IPTotalLengthBuckets, IPv4Checksum, IPv4DSCP, IPv4DontFragment, IPv4ECN, IPv4Identification, IPv4Options, IPv6DSCP, IPv6ECN, IPv6ExtensionHeaders, IPv6FlowLabel, IPv6Identification, MitigationReason, MitigationScope, MitigationSystem, ProtocolState, RuleID, RuleName, RulesetID, RulesetOverrideID, SampleInterval, SourceASN, SourceASNName, SourceCountry, SourceGeoHash, TCPAcknowledgementNumber, TCPChecksum, TCPDataOffset, TCPFlags, TCPFlagsString, TCPMSS, TCPOptions, TCPSACKBlocks, TCPSACKPermitted, TCPSequenceNumber, TCPTimestampECR, TCPTimestampValue, TCPUrgentPointer, TCPWindowScale, TCPWindowSize, UDPChecksum, UDPPayloadLength, Verdict, Action, DestinationIP, SignatureID, SignatureMessage, SignatureRevision, ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, OverrideIP, OverridePort, PolicyID, PolicyName, ProxyEndpoint, SNI, SourceIPContinentCode, SourceIPCountryCode, TransportProtocol, VirtualNetworkID, VirtualNetworkName, BlockedFileHash, BlockedFileName, BlockedFileReason, BlockedFileSize, BlockedFileType, DownloadMatchedDlpProfileEntries, DownloadMatchedDlpProfiles, DownloadedFileNames, FileInfo, ForensicCopyStatus, HTTPHost, HTTPMethod, HTTPStatusCode, HTTPVersion, IsIsolated, PrivateAppAUD, Quarantined, RedirectTargetURI, Referer, RequestID, UntrustedCertificateAction, UploadMatchedDlpProfileEntries, UploadMatchedDlpProfiles, UploadedFileNames, AuthoritativeNameServerIPs, CNAMECategoryIDs, CNAMECategoryNames, CNAMEs, CNAMEsReversed, ColoID, CustomResolveDurationMs, CustomResolverAddress, CustomResolverPolicyID, CustomResolverPolicyName, CustomResolverResponse, DoHSubdomain, DoTSubdomain, DstIP, DstPort, EDEErrors, InitialCategoryIDs, InitialCategoryNames, InitialResolvedIPs, InternalDNSFallbackStrategy, InternalDNSRCode, InternalDNSViewID, InternalDNSZoneID, IsResponseCached, Location, LocationID, MatchedCategoryIDs, MatchedCategoryNames, MatchedIndicatorFeedIDs, MatchedIndicatorFeedNames, QueryCategoryIDs, QueryCategoryNames, QueryID, QueryIndicatorFeedIDs, QueryIndicatorFeedNames, QueryName, QueryNameReversed, QuerySize, QueryType, QueryTypeName, RCode, RData, RequestContextCategoryIDs, RequestContextCategoryNames, ResolvedIPCategoryIDs, ResolvedIPCategoryNames, ResolvedIPContinentCodes, ResolvedIPCountryCodes, ResolverDecision, ResourceRecords, ResourceRecordsJSON, SrcIP, SrcIPContinentCode, SrcIPCountryCode, SrcPort, TimeZone, TimeZoneInferredMethod, AlertID, AlertReasons, Attachments, CC, CCName, FinalDisposition, From, FromName, Links, MessageDeliveryMode, MessageID, Origin, OriginalSender, ReplyTo, ReplyToName, SMTPEnvelopeFrom, SMTPEnvelopeTo, SMTPHeloServerIP, SMTPHeloServerIPAsName, SMTPHeloServerIPAsNumber, SMTPHeloServerIPGeo, SMTPHeloServerName, Subject, ThreatCategories, To, ToName, ClientResponseCode, ClusterID, EDNSSubnet, EDNSSubnetLength, QueryDO, QueryRD, QueryTCP, ResponseCached, ResponseCachedStale, ResponseReason, UpstreamIP, UpstreamResponseCode, UpstreamResponseTimeMs, ForensicCopyID, GatewayRequestID, Phase, TriggeredRuleID, ClientVersion, DeviceManufacturer, DeviceModel, DeviceSerialNumber, DeviceType, OSVersion, PostureCheckName, PostureCheckType, PostureEvaluatedResult, PostureExpectedJSON, PostureReceivedJSON, UserUID, AssetDisplayName, AssetExternalID, AssetLink, AssetMetadata, DetectedTimestamp, FindingTypeDisplayName, FindingTypeID, FindingTypeSeverity, InstanceID, IntegrationDisplayName, IntegrationID, IntegrationPolicyVendor, Decision, DomainName, ActionResult, ActionType, ActorEmail, ActorID, ActorIP, ActorType, ID, Interface, Metadata, NewValue, OldValue, OwnerID, ResourceID, ResourceType, When, Allowed, AppDomain, AppUUID, Connection, Country, CreatedAt, IPAddress, PurposeJustificationPrompt, PurposeJustificationResponse, RayID, TemporaryAccessApprovers, TemporaryAccessDuration, ClientASN, ClientASNDescription, ClientCountry, ClientIP, ClientIPClass, ClientRefererHost, ClientRefererPath, ClientRefererQuery, ClientRefererScheme, ClientRequestHost, ClientRequestMethod, ClientRequestPath, ClientRequestProtocol, ClientRequestQuery, ClientRequestScheme, ClientRequestUserAgent, ContentScanObjResults, ContentScanObjSizes, ContentScanObjTypes, Description, EdgeColoCode, EdgeResponseStatus, Kind, LeakedCredentialCheckResult, MatchIndex, OriginResponseStatus, OriginatorRayID, Ref, BotDetectionIDs, BotDetectionTags, BotScore, BotScoreSrc, BotTags, CacheCacheStatus, CacheReserveUsed, CacheResponseBytes, CacheResponseStatus, CacheTieredFill, ClientCity, ClientDeviceType, ClientLatitude, ClientLongitude, ClientMTLSAuthCertFingerprint, ClientMTLSAuthStatus, ClientRegionCode, ClientRequestBytes, ClientRequestReferer, ClientRequestSource, ClientRequestURI, ClientSSLCipher, ClientSSLProtocol, ClientSrcPort, ClientTCPRTTMs, ClientXRequestedWith, Cookies, EdgeCFConnectingO2O, EdgeColoID, EdgeEndTimestamp, EdgePathingOp, EdgePathingSrc, EdgePathingStatus, EdgeRequestHost, EdgeResponseBodyBytes, EdgeResponseBytes, EdgeResponseCompressionRatio, EdgeResponseContentType, EdgeServerIP, EdgeStartTimestamp, EdgeTimeToFirstByteMs, JA3Hash, JA4, JA4Signals, OriginDNSResponseTimeMs, OriginRequestHeaderSendDurationMs, OriginResponseBytes, OriginResponseDurationMs, OriginResponseHTTPExpires, OriginResponseHTTPLastModified, OriginResponseHeaderReceiveDurationMs, OriginSSLProtocol, OriginTCPHandshakeDurationMs, OriginTLSHandshakeDurationMs, ParentRayID, RequestHeaders, ResponseHeaders, SecurityAction, SecurityRuleDescription, SecurityRuleID, SecuritySources, SmartRouteColoID, UpperTierColoID, WAFAttackScore, WAFRCEAttackScore, WAFSQLiAttackScore, WAFXSSAttackScore, WorkerCPUTime, WorkerScriptName, WorkerStatus, WorkerSubrequest, WorkerSubrequestCount, WorkerWallTimeUs, ZoneName, ClientIPASN, ClientIPASNDescription, ClientIPCountry, LastKnownGoodColoCode, CSPDirective, PageURL, URLContainsCDNCGIPath, URLHost, Application, ClientBytes, ClientMatchedIpFirewall, ClientPort, ClientProto, ClientTcpRtt, ClientTlsClientHelloServerName, ClientTlsProtocol, ClientTlsStatus, ConnectTimestamp, DisconnectTimestamp, IpFirewall, OriginBytes, OriginProto, OriginTcpRtt, OriginTlsFingerprint, OriginTlsMode, OriginTlsProtocol, OriginTlsStatus, ProxyProtocol, Status, EventDetails, IP, Source, SecurityActions, SecurityRuleIDs, Transport", "outputStream": "Custom-CloudflareV2_CL" } ] diff --git a/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_PollerConfig.json b/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_PollerConfig.json index a28601d51ea..ff82d1a0911 100644 --- a/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_PollerConfig.json +++ b/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_PollerConfig.json @@ -1,16 +1,40 @@ [ { - "name": "CloudflareUsingBlob", + "name": "[[concat(parameters('innerWorkspace'), '/Microsoft.SecurityInsights/', variables('connectorName'))]", + "UseRandomGuid": false, + "connectionDeployment": { + "mode": "PerInstance", + "resourcePrefix": "cloudflare", + "queuePrefix": "cf", + "tableName": "CloudflareV2_CL", + "identityParameters": [ + "CloudflareAccountId", + "StorageAccountSubscription", + "StorageAccountResourceGroupName", + "StorageAccountName", + "ContainerName" + ], + "enableDcrLogErrors": true, + "attributionColumns": { + "CloudflareAccountId": "CloudflareAccountId", + "CloudflareAccountName": "CloudflareAccountName" + }, + "rolePropagationDelaySeconds": 90 + }, "apiVersion": "2022-12-01-preview", "type": "Microsoft.SecurityInsights/dataConnectors", "location": "{{location}}", "kind": "StorageAccountBlobContainer", "properties": { "connectorDefinitionName": "CloudflareDefinition", - "dataType": "CloudflareV2_CL", + "dataType": "[[variables('tableName')]", + "addOnAttributes": { + "CloudflareAccountId": "[[parameters('CloudflareAccountId')]", + "CloudflareAccountName": "[[parameters('CloudflareAccountName')]" + }, "dcrConfig": { - "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", - "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}", + "dataCollectionEndpoint": "[[reference(variables('dceResourceId'), '2022-06-01').logsIngestion.endpoint]", + "dataCollectionRuleImmutableId": "[[reference(variables('dcrResourceId'), '2022-06-01').immutableId]", "streamName": "Custom-Cloudflare" }, "auth": { diff --git a/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json b/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json index 886c99840a5..af4f8f38aee 100644 --- a/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json +++ b/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json @@ -11,6 +11,14 @@ "name": "TimeGenerated", "type": "datetime" }, + { + "name": "CloudflareAccountId", + "type": "string" + }, + { + "name": "CloudflareAccountName", + "type": "string" + }, { "name": "AccountID", "type": "string" diff --git a/Solutions/Cloudflare CCF/Data/Solution_Cloudflare.json b/Solutions/Cloudflare CCF/Data/Solution_Cloudflare.json index c2b02beee1b..8ef65ff6799 100644 --- a/Solutions/Cloudflare CCF/Data/Solution_Cloudflare.json +++ b/Solutions/Cloudflare CCF/Data/Solution_Cloudflare.json @@ -2,7 +2,7 @@ "Name": "Cloudflare CCF", "Author": "Cloudflare - support@cloudflare.com", "Logo": "![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\")
",
- "Description": "The [Cloudflare](https://www.cloudflare.com/) solution provides the capability to ingest [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel using the Codeless Connector Framework (CCF) and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/) for more information.\n\n**Underlying Microsoft Technologies used:**\r\n\n a. [Codeless Connector Framework](https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector)\n\n b. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) (for reference, legacy support)",
+ "Description": "The [Cloudflare](https://www.cloudflare.com/) solution ingests [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel from Azure Blob Storage. It supports multiple account and container instances with deterministic ingestion resources and account provenance.\n\n**Underlying Microsoft Technologies used:**\n\n a. [Codeless Connector Framework](https://learn.microsoft.com/azure/sentinel/create-codeless-connector)\n\n b. [Azure Monitor data collection rules](https://learn.microsoft.com/azure/azure-monitor/data-collection/data-collection-rule-overview)\n\n c. [Azure Event Grid](https://learn.microsoft.com/azure/event-grid/overview) and [Azure Queue Storage](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)\n\n d. [Azure deployment scripts](https://learn.microsoft.com/azure/azure-resource-manager/templates/deployment-script-template), which can create transient supporting resources and operational cost",
"Data Connectors": [
"Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_ConnectorDefinition.json"
],
@@ -38,7 +38,7 @@
],
"Metadata": "SolutionMetadata.json",
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Cloudflare CCF",
- "Version": "3.0.3",
+ "Version": "3.1.3",
"TemplateSpec": true,
"Is1PConnector": false
-}
\ No newline at end of file
+}
diff --git a/Solutions/Cloudflare CCF/Package/3.1.0.zip b/Solutions/Cloudflare CCF/Package/3.1.0.zip
new file mode 100644
index 00000000000..d8d9bda1133
Binary files /dev/null and b/Solutions/Cloudflare CCF/Package/3.1.0.zip differ
diff --git a/Solutions/Cloudflare CCF/Package/3.1.1.zip b/Solutions/Cloudflare CCF/Package/3.1.1.zip
new file mode 100644
index 00000000000..88c24d03503
Binary files /dev/null and b/Solutions/Cloudflare CCF/Package/3.1.1.zip differ
diff --git a/Solutions/Cloudflare CCF/Package/3.1.2.zip b/Solutions/Cloudflare CCF/Package/3.1.2.zip
new file mode 100644
index 00000000000..d0f1d84e889
Binary files /dev/null and b/Solutions/Cloudflare CCF/Package/3.1.2.zip differ
diff --git a/Solutions/Cloudflare CCF/Package/3.1.3.zip b/Solutions/Cloudflare CCF/Package/3.1.3.zip
new file mode 100644
index 00000000000..fde3175ceda
Binary files /dev/null and b/Solutions/Cloudflare CCF/Package/3.1.3.zip differ
diff --git a/Solutions/Cloudflare CCF/Package/createUiDefinition.json b/Solutions/Cloudflare CCF/Package/createUiDefinition.json
index 927a9f8e532..fceeb21c389 100644
--- a/Solutions/Cloudflare CCF/Package/createUiDefinition.json
+++ b/Solutions/Cloudflare CCF/Package/createUiDefinition.json
@@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
- "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cloudflare](https://www.cloudflare.com/) solution provides the capability to ingest [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel using the Codeless Connector Framework (CCF) and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/) for more information.\n\n**Underlying Microsoft Technologies used:**\r\n\n a. [Codeless Connector Framework](https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector)\n\n b. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) (for reference, legacy support)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cloudflare](https://www.cloudflare.com/) solution ingests [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel from Azure Blob Storage. It supports multiple account and container instances with deterministic ingestion resources and account provenance.\n\n**Underlying Microsoft Technologies used:**\n\n a. [Codeless Connector Framework](https://learn.microsoft.com/azure/sentinel/create-codeless-connector)\n\n b. [Azure Monitor data collection rules](https://learn.microsoft.com/azure/azure-monitor/data-collection/data-collection-rule-overview)\n\n c. [Azure Event Grid](https://learn.microsoft.com/azure/event-grid/overview) and [Azure Queue Storage](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)\n\n d. [Azure deployment scripts](https://learn.microsoft.com/azure/azure-resource-manager/templates/deployment-script-template), which can create transient supporting resources and operational cost\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
@@ -452,7 +452,7 @@
],
"outputs": {
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
- "location": "[location()]",
+ "location": "[if(empty(location()), first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location)), location())]",
"workspace": "[basics('workspace')]"
}
}
diff --git a/Solutions/Cloudflare CCF/Package/mainTemplate.json b/Solutions/Cloudflare CCF/Package/mainTemplate.json
index 9eb4fd436d6..886f37564c6 100644
--- a/Solutions/Cloudflare CCF/Package/mainTemplate.json
+++ b/Solutions/Cloudflare CCF/Package/mainTemplate.json
@@ -8,7 +8,6 @@
"parameters": {
"location": {
"type": "string",
- "minLength": 1,
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
@@ -28,20 +27,6 @@
"description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
}
},
- "resourceGroupName": {
- "type": "string",
- "defaultValue": "[resourceGroup().name]",
- "metadata": {
- "description": "resource group name where Microsoft Sentinel is setup"
- }
- },
- "subscription": {
- "type": "string",
- "defaultValue": "[last(split(subscription().id, '/'))]",
- "metadata": {
- "description": "subscription id where Microsoft Sentinel is setup"
- }
- },
"workbook1-name": {
"type": "string",
"defaultValue": "Cloudflare CCF",
@@ -52,20 +37,19 @@
}
},
"variables": {
+ "workspaceLocationEffective": "[if(empty(trim(parameters('workspace-location'))), resourceGroup().location, trim(parameters('workspace-location')))]",
"email": "support@cloudflare.com",
"_email": "[variables('email')]",
"_solutionName": "Cloudflare CCF",
- "_solutionVersion": "3.0.3",
+ "_solutionVersion": "3.1.2",
"solutionId": "cloudflare.azure-sentinel-solution-cloudflare-ccf",
"_solutionId": "[variables('solutionId')]",
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
- "dataConnectorCCPVersion": "3.0.3",
+ "dataConnectorCCPVersion": "3.1.2",
"_dataConnectorContentIdConnectorDefinition1": "CloudflareDefinition",
"dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
"_dataConnectorContentIdConnections1": "CloudflareDefinitionConnections",
"dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]",
- "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
- "blanks": "[replace('b', 'b', '')]",
"parserObject1": {
"_parserName1": "[concat(parameters('workspace'),'/','Cloudflare')]",
"_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Cloudflare')]",
@@ -206,7 +190,7 @@
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
"apiVersion": "2023-04-01-preview",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]",
- "location": "[parameters('workspace-location')]",
+ "location": "[variables('workspaceLocationEffective')]",
"dependsOn": [
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
@@ -224,14 +208,14 @@
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
"apiVersion": "2022-09-01-preview",
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
- "location": "[parameters('workspace-location')]",
+ "location": "[variables('workspaceLocationEffective')]",
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "CloudflareDefinition",
"title": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)",
"publisher": "Microsoft",
- "descriptionMarkdown": " The Cloudflare data connector provides the capability to ingest Cloudflare logs into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/)for more information.\n\nNOTE: The Cloudflare (Using Blob Container) (via Codeless Connector Framework) data connector available in the solution requires the Azure Blob Storage account and the Microsoft Sentinel workspace to be in the same Azure subscription and the same Resource Group. Deploying across different subscriptions or resource groups may result in errors such as CreateDataFlowResources not defined during connector configuration.
", + "descriptionMarkdown": "The Cloudflare data connector ingests Cloudflare Logpush data from Azure Blob Storage into Microsoft Sentinel. It supports multiple Cloudflare accounts, storage accounts, and containers in one workspace while retaining the Cloudflare account identity on every ingested record. Refer to the [Cloudflare Logs documentation](https://developers.cloudflare.com/logs/about/) for more information.", "graphQueriesTableName": "CloudflareV2_CL", "graphQueries": [ { @@ -249,7 +233,7 @@ "dataTypes": [ { "name": "{{graphQueriesTableName}}", - "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max(TimeGenerated)\n|where isnotempty(Time)" + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ @@ -278,94 +262,200 @@ ], "customs": [ { - "name": "Create a storage account and a container", - "description": "Before setting up logpush in Cloudflare, first create a storage account and a container in Microsoft Azure. Use [this guide](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) to know more about Container and Blob. Follow the steps in the [documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal) to create an Azure Storage account." + "name": "Deployment permissions", + "description": "The identity adding a collector must be able to deploy resources in the Microsoft Sentinel workspace resource group and in the target storage account resource group. To create the required role assignments, use **Owner** or **Contributor** plus **User Access Administrator** at the applicable scopes." + }, + { + "name": "Microsoft Sentinel service principal access", + "description": "The template grants the Microsoft Sentinel service principal **Storage Blob Data Contributor** on the selected container and **Storage Queue Data Contributor** on the two per-instance queues. These are data-plane roles only; the template does not grant Storage Account Contributor or account-key access." + }, + { + "name": "Cloudflare Logpush", + "description": "Configure Cloudflare Logpush to write JSON or compressed JSON logs to the selected blob container. Ensure the Cloudflare identity has the required Logpush permissions. See [Cloudflare Logpush permissions](https://developers.cloudflare.com/logs/logpush/permissions/) and [Azure destination setup](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/)." }, { - "name": "Generate a Blob SAS URL", - "description": "Create and Write permissions are required. Refer the [documentation](https://learn.microsoft.com/en-us/azure/ai-services/translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers) to know more about Blob SAS token and url." + "name": "Role-assignment propagation", + "description": "The deployment includes a bounded 90-second propagation buffer before creating the connector. The buffer uses an Azure deployment script, which can create short-lived supporting resources, incur small transient cost, and be blocked by restrictive Azure Policy. Azure role propagation can take longer; if access initially fails, wait and submit the same collector again. Deterministic naming makes that retry idempotent." }, { - "name": "Collecting logs from Cloudflare to your Blob container", - "description": "Follow the steps in the [documentation](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/) for collecting logs from Cloudflare to your Blob container." + "name": "Cleanup semantics", + "description": "Removing only the Microsoft Sentinel data connector does not remove its DCR, DCE, diagnostic setting, Event Grid subscription, queues, or role assignments. One-click deletion is intentionally not offered. Remove resources sharing the connector's deterministic instance key, but do not delete the shared `CloudflareV2_CL` table or a system topic still used by another collector." } ] }, "instructionSteps": [ { - "title": "Connect Cloudflare Logs to Microsoft Sentinel", - "description": "To enable Cloudflare logs for Microsoft Sentinel, provide the required information below and click on Connect.\n>", + "title": "1. Prepare Azure Storage and Cloudflare Logpush", + "description": "Create an Azure Storage account and blob container, then configure Cloudflare Logpush to write to that container. Follow [Create a storage account](https://learn.microsoft.com/azure/storage/common/storage-account-create), [Create a container](https://learn.microsoft.com/azure/storage/blobs/blob-containers-portal), and [Configure the Cloudflare Azure destination](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/)." + }, + { + "title": "2. Add and review Cloudflare collectors", + "description": "Select **Add new collector** for each immutable Cloudflare account and storage container combination. Redeploying the same values updates the same isolated resources instead of creating a duplicate.", "instructions": [ { + "type": "DataConnectorsGrid", "parameters": { - "tenantId": "[subscription().tenantId]", - "name": "principalId", - "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f" - }, - "type": "ServicePrincipalIDTextBox_test" - }, - { - "parameters": { - "label": "The Blob container's URL you want to collect data from", - "type": "text", - "name": "blobContainerUri", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account resource group name", - "type": "text", - "name": "StorageAccountResourceGroupName", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account location", - "type": "text", - "name": "StorageAccountLocation", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account subscription id", - "type": "text", - "name": "StorageAccountSubscription", - "validations": { - "required": true - } - }, - "type": "Textbox" + "mapping": [ + { + "columnName": "Connector", + "columnValue": "name" + }, + { + "columnName": "Cloudflare account", + "columnValue": "properties.addOnAttributes.CloudflareAccountName" + }, + { + "columnName": "Cloudflare account ID", + "columnValue": "properties.addOnAttributes.CloudflareAccountId" + }, + { + "columnName": "Queue URI", + "columnValue": "properties.request.QueueUri" + }, + { + "columnName": "Stream", + "columnValue": "properties.dcrConfig.streamName" + }, + { + "columnName": "DCR immutable ID", + "columnValue": "properties.dcrConfig.dataCollectionRuleImmutableId" + } + ] + } }, { + "type": "InfoMessage", "parameters": { - "label": "The event grid topic name of the blob container's storage account if exist. else keep empty.", - "description": "The data flow using event grid to send 'blob-created event' notifications. There could be only one event grid topic for each storage account.\nGo to your blob container's storage account and look in the 'Events' section. If you already have a topic, please provide it's name. Else, keep the text box empty.", - "type": "text", - "name": "EGSystemTopicName", - "validations": { - "required": false - } - }, - "type": "Textbox" + "text": "Cleanup is a deliberate manual operation in this phase. Use the 13-character instance key at the end of the connector name to identify its DCR, DCE, diagnostic setting, Event Grid subscription, queues, and role assignments. Preserve the shared CloudflareV2_CL table and any Event Grid system topic used by another collector.", + "visible": true, + "inline": true + } }, { + "type": "ContextPane", "parameters": { - "label": "toggle", - "name": "toggle" - }, - "type": "ConnectionToggleButton" + "contextPaneType": "DataConnectorsContextPane", + "title": "Add a Cloudflare collector", + "subtitle": "Cloudflare Logpush through Azure Blob Storage", + "label": "Add new collector", + "isPrimary": true, + "instructionSteps": [ + { + "instructions": [ + { + "type": "ServicePrincipalIDTextBox_test", + "parameters": { + "tenantId": "[subscription().tenantId]", + "name": "principalId", + "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Cloudflare account ID", + "placeholder": "Enter the immutable Cloudflare account ID", + "description": "Used with the storage and workspace identity to derive deterministic Azure resource names. Do not enter an API token or other secret.", + "type": "text", + "name": "CloudflareAccountId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Cloudflare account display name", + "placeholder": "For example, Contoso Production", + "description": "A friendly label shown in the connections grid and retained on ingested records. It is not used directly in Azure resource names.", + "type": "text", + "name": "CloudflareAccountName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account name", + "placeholder": "Enter the Azure Storage account name", + "type": "text", + "name": "StorageAccountName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Blob container name", + "placeholder": "Enter the blob container name", + "type": "text", + "name": "ContainerName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account resource group", + "placeholder": "Enter the resource group name", + "type": "text", + "name": "StorageAccountResourceGroupName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account subscription ID", + "placeholder": "Enter the subscription GUID", + "type": "text", + "name": "StorageAccountSubscription", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Existing Event Grid system topic name (optional)", + "placeholder": "Leave blank for the first collector on this storage account", + "description": "Azure Event Grid supports one system topic for a storage account. Leave blank to create or reuse this connector's deterministic topic. If another integration already owns the storage account's system topic, enter that topic name so only a new per-instance event subscription is added.", + "type": "text", + "name": "EGSystemTopicName", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Custom log table name (optional)", + "placeholder": "Leave blank to use CloudflareV2_CL", + "description": "Name of the Log Analytics custom table this collector writes to. Must end in _CL. Leave blank to use the solution default CloudflareV2_CL. Each collector instance may target its own table; instances that share a table name share that table.", + "type": "text", + "name": "TableName", + "validations": { + "required": false, + "regex": "^$|^[A-Za-z][A-Za-z0-9_]{0,42}_CL$", + "message": "Table name must start with a letter, contain only letters, digits and underscores, and end with _CL." + } + } + } + ] + } + ] + } } ] } @@ -410,2035 +500,2483 @@ } }, { - "name": "CloudflareDCR", - "apiVersion": "2022-06-01", - "type": "Microsoft.Insights/dataCollectionRules", - "location": "[parameters('workspace-location')]", - "kind": "[variables('blanks')]", + "name": "CloudflareV2_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[variables('workspaceLocationEffective')]", + "kind": null, "properties": { - "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]", - "streamDeclarations": { - "Custom-Cloudflare": { - "columns": [ - { - "name": "AccountID", - "type": "string" - }, - { - "name": "Action", - "type": "string" - }, - { - "name": "ActionResult", - "type": "boolean" - }, - { - "name": "ActionType", - "type": "string" - }, - { - "name": "ActorEmail", - "type": "string" - }, - { - "name": "ActorID", - "type": "string" - }, - { - "name": "ActorIP", - "type": "string" - }, - { - "name": "ActorType", - "type": "string" - }, - { - "name": "AlertID", - "type": "string" - }, - { - "name": "AlertReasons", - "type": "string" - }, - { - "name": "Allowed", - "type": "boolean" - }, - { - "name": "AppDomain", - "type": "string" - }, - { - "name": "Application", - "type": "string" - }, - { - "name": "ApplicationIDs", - "type": "dynamic" - }, - { - "name": "ApplicationNames", - "type": "dynamic" - }, - { - "name": "AppUUID", - "type": "string" - }, - { - "name": "AssetDisplayName", - "type": "string" - }, - { - "name": "AssetExternalID", - "type": "string" - }, - { - "name": "AssetLink", - "type": "string" - }, - { - "name": "AssetMetadata", - "type": "dynamic" - }, - { - "name": "Attachments", - "type": "string" - }, - { - "name": "AttackCampaignID", - "type": "string" - }, - { - "name": "AttackID", - "type": "string" - }, - { - "name": "AttackVector", - "type": "string" - }, - { - "name": "AuthoritativeNameServerIPs", - "type": "dynamic" - }, - { - "name": "BlockedFileHash", - "type": "string" - }, - { - "name": "BlockedFileName", - "type": "string" - }, - { - "name": "BlockedFileReason", - "type": "string" - }, - { - "name": "BlockedFileSize", - "type": "int" - }, - { - "name": "BlockedFileType", - "type": "string" - }, - { - "name": "Body", - "type": "dynamic" - }, - { - "name": "BodyLength", - "type": "int" - }, - { - "name": "BotDetectionIDs", - "type": "dynamic" - }, - { - "name": "BotDetectionTags", - "type": "dynamic" - }, - { - "name": "BotScore", - "type": "int" - }, - { - "name": "BotScoreSrc", - "type": "string" - }, - { - "name": "BotTags", - "type": "dynamic" - }, - { - "name": "BytesReceived", - "type": "int" - }, - { - "name": "BytesSent", - "type": "int" - }, - { - "name": "CacheCacheStatus", - "type": "string" - }, - { - "name": "CacheReserveUsed", - "type": "boolean" - }, - { - "name": "CacheResponseBytes", - "type": "int" - }, - { - "name": "CacheResponseStatus", - "type": "int" - }, - { - "name": "CacheTieredFill", - "type": "boolean" - }, - { - "name": "CategoryIDs", - "type": "dynamic" - }, - { - "name": "CategoryNames", - "type": "dynamic" - }, - { - "name": "CC", - "type": "string" - }, - { - "name": "CCName", - "type": "string" - }, - { - "name": "ClientAddress", - "type": "string" - }, - { - "name": "ClientASN", - "type": "int" - }, - { - "name": "ClientASNDescription", - "type": "string" - }, - { - "name": "ClientBytes", - "type": "int" - }, - { - "name": "ClientCity", - "type": "string" - }, - { - "name": "ClientCountry", - "type": "string" - }, - { - "name": "ClientDeviceType", - "type": "string" - }, - { - "name": "ClientIP", - "type": "string" - }, - { - "name": "ClientIPASN", - "type": "int" - }, - { - "name": "ClientIPASNDescription", - "type": "string" - }, - { - "name": "ClientIPClass", - "type": "string" - }, - { - "name": "ClientIPCountry", - "type": "string" - }, - { - "name": "ClientLatitude", - "type": "string" - }, - { - "name": "ClientLongitude", - "type": "string" - }, - { - "name": "ClientMatchedIpFirewall", - "type": "string" - }, - { - "name": "ClientMTLSAuthCertFingerprint", - "type": "string" - }, - { - "name": "ClientMTLSAuthStatus", - "type": "string" - }, - { - "name": "ClientPort", - "type": "int" - }, - { - "name": "ClientProto", - "type": "string" - }, - { - "name": "ClientRefererHost", - "type": "string" - }, - { - "name": "ClientRefererPath", - "type": "string" - }, - { - "name": "ClientRefererQuery", - "type": "string" - }, - { - "name": "ClientRefererScheme", - "type": "string" - }, - { - "name": "ClientRegionCode", - "type": "string" - }, - { - "name": "ClientRequestBytes", - "type": "int" - }, - { - "name": "ClientRequestHost", - "type": "string" - }, - { - "name": "ClientRequestMethod", - "type": "string" - }, - { - "name": "ClientRequestPath", - "type": "string" - }, - { - "name": "ClientRequestProtocol", - "type": "string" - }, - { - "name": "ClientRequestQuery", - "type": "string" - }, - { - "name": "ClientRequestReferer", - "type": "string" - }, - { - "name": "ClientRequestScheme", - "type": "string" - }, - { - "name": "ClientRequestSource", - "type": "string" - }, - { - "name": "ClientRequestURI", - "type": "string" - }, - { - "name": "ClientRequestUserAgent", - "type": "string" - }, - { - "name": "ClientResponseCode", - "type": "int" - }, - { - "name": "ClientSrcPort", - "type": "int" - }, - { - "name": "ClientSSLCipher", - "type": "string" - }, - { - "name": "ClientSSLProtocol", - "type": "string" - }, - { - "name": "ClientTCPHandshakeDurationMs", - "type": "int" - }, - { - "name": "ClientTcpRtt", - "type": "int" - }, - { - "name": "ClientTCPRTTMs", - "type": "int" - }, - { - "name": "ClientTLSCipher", - "type": "string" - }, - { - "name": "ClientTlsClientHelloServerName", - "type": "string" - }, - { - "name": "ClientTLSHandshakeDurationMs", - "type": "int" - }, - { - "name": "ClientTlsProtocol", - "type": "string" - }, - { - "name": "ClientTlsStatus", - "type": "string" - }, - { - "name": "ClientTLSVersion", - "type": "string" - }, - { - "name": "ClientVersion", - "type": "string" - }, - { - "name": "ClientXRequestedWith", - "type": "string" - }, - { - "name": "ClusterID", - "type": "string" - }, - { - "name": "CNAMECategoryIDs", - "type": "dynamic" - }, - { - "name": "CNAMECategoryNames", - "type": "dynamic" - }, - { - "name": "CNAMEs", - "type": "dynamic" - }, - { - "name": "CNAMEsReversed", - "type": "dynamic" - }, - { - "name": "ColoCity", - "type": "string" - }, - { - "name": "ColoCode", - "type": "string" - }, - { - "name": "ColoCountry", - "type": "string" - }, - { - "name": "ColoGeoHash", - "type": "string" - }, - { - "name": "ColoID", - "type": "int" - }, - { - "name": "ColoName", - "type": "string" - }, - { - "name": "Connection", - "type": "string" - }, - { - "name": "ConnectionCloseReason", - "type": "string" - }, - { - "name": "ConnectionReuse", - "type": "boolean" - }, - { - "name": "ConnectTimestamp", - "type": "string" - }, - { - "name": "ContentScanObjResults", - "type": "dynamic" - }, - { - "name": "ContentScanObjSizes", - "type": "dynamic" - }, - { - "name": "ContentScanObjTypes", - "type": "dynamic" - }, - { - "name": "Cookies", - "type": "dynamic" - }, - { - "name": "Country", - "type": "string" - }, - { - "name": "CPUTimeMs", - "type": "int" - }, - { - "name": "CreatedAt", - "type": "string" - }, - { - "name": "CSPDirective", - "type": "string" - }, - { - "name": "CustomResolveDurationMs", - "type": "int" - }, - { - "name": "CustomResolverAddress", - "type": "string" - }, - { - "name": "CustomResolverPolicyID", - "type": "string" - }, - { - "name": "CustomResolverPolicyName", - "type": "string" - }, - { - "name": "CustomResolverResponse", - "type": "string" - }, - { - "name": "Datetime", - "type": "string" - }, - { - "name": "Decision", - "type": "string" - }, - { - "name": "Description", - "type": "string" - }, - { - "name": "DestAddr", - "type": "string" - }, - { - "name": "DestinationASN", - "type": "int" - }, - { - "name": "DestinationASNName", - "type": "string" - }, - { - "name": "DestinationCountry", - "type": "string" - }, - { - "name": "DestinationGeoHash", - "type": "string" - }, - { - "name": "DestinationIP", - "type": "string" - }, - { - "name": "DestinationIPContinentCode", - "type": "string" - }, - { - "name": "DestinationIPCountryCode", - "type": "string" - }, - { - "name": "DestinationPort", - "type": "int" - }, - { - "name": "DestinationTunnelID", - "type": "string" - }, - { - "name": "DetectedProtocol", - "type": "string" - }, - { - "name": "DetectedTimestamp", - "type": "string" - }, - { - "name": "DeviceID", - "type": "string" - }, - { - "name": "DeviceManufacturer", - "type": "string" - }, - { - "name": "DeviceModel", - "type": "string" - }, - { - "name": "DeviceName", - "type": "string" - }, - { - "name": "DeviceSerialNumber", - "type": "string" - }, - { - "name": "DeviceType", - "type": "string" - }, - { - "name": "Direction", - "type": "string" - }, - { - "name": "DisconnectTimestamp", - "type": "string" - }, - { - "name": "DispatchNamespace", - "type": "string" - }, - { - "name": "DoHSubdomain", - "type": "string" - }, - { - "name": "DomainName", - "type": "string" - }, - { - "name": "DoTSubdomain", - "type": "string" - }, - { - "name": "DownloadedFileNames", - "type": "dynamic" - }, - { - "name": "DownloadMatchedDlpProfileEntries", - "type": "dynamic" - }, - { - "name": "DownloadMatchedDlpProfiles", - "type": "dynamic" - }, - { - "name": "DstIP", - "type": "string" - }, - { - "name": "DstPort", - "type": "int" - }, - { - "name": "EDEErrors", - "type": "dynamic" - }, - { - "name": "EdgeCFConnectingO2O", - "type": "boolean" - }, - { - "name": "EdgeColoCode", - "type": "string" - }, - { - "name": "EdgeColoID", - "type": "int" - }, - { - "name": "EdgeEndTimestamp", - "type": "string" - }, - { - "name": "EdgePathingOp", - "type": "string" - }, - { - "name": "EdgePathingSrc", - "type": "string" - }, - { - "name": "EdgePathingStatus", - "type": "string" - }, - { - "name": "EdgeRequestHost", - "type": "string" - }, - { - "name": "EdgeResponseBodyBytes", - "type": "int" - }, - { - "name": "EdgeResponseBytes", - "type": "int" - }, - { - "name": "EdgeResponseCompressionRatio", - "type": "real" - }, - { - "name": "EdgeResponseContentType", - "type": "string" - }, - { - "name": "EdgeResponseStatus", - "type": "int" - }, - { - "name": "EdgeServerIP", - "type": "string" - }, - { - "name": "EdgeStartTimestamp", - "type": "string" - }, - { - "name": "EdgeTimeToFirstByteMs", - "type": "int" - }, - { - "name": "EDNSSubnet", - "type": "string" - }, - { - "name": "EDNSSubnetLength", - "type": "int" - }, - { - "name": "EgressColoName", - "type": "string" - }, - { - "name": "EgressIP", - "type": "string" - }, - { - "name": "EgressPort", - "type": "int" - }, - { - "name": "EgressRuleID", - "type": "string" - }, - { - "name": "EgressRuleName", - "type": "string" - }, - { - "name": "Email", - "type": "string" - }, - { - "name": "Entrypoint", - "type": "string" - }, - { - "name": "Error", - "type": "string" - }, - { - "name": "Event", - "type": "string" - }, - { - "name": "EventDetails", - "type": "dynamic" - }, - { - "name": "EventTimestampMs", - "type": "int" - }, - { - "name": "EventType", - "type": "string" - }, - { - "name": "Exceptions", - "type": "string" - }, - { - "name": "FileInfo", - "type": "dynamic" - }, - { - "name": "FinalDisposition", - "type": "string" - }, - { - "name": "FindingTypeDisplayName", - "type": "string" - }, - { - "name": "FindingTypeID", - "type": "string" - }, - { - "name": "FindingTypeSeverity", - "type": "string" - }, - { - "name": "ForensicCopyID", - "type": "string" - }, - { - "name": "ForensicCopyStatus", - "type": "string" - }, - { - "name": "From", - "type": "string" - }, - { - "name": "FromName", - "type": "string" - }, - { - "name": "GatewayRequestID", - "type": "string" - }, - { - "name": "GREChecksum", - "type": "int" - }, - { - "name": "GREEtherType", - "type": "int" - }, - { - "name": "GREHeaderLength", - "type": "int" - }, - { - "name": "GREKey", - "type": "int" - }, - { - "name": "GRESequenceNumber", - "type": "int" - }, - { - "name": "GREVersion", - "type": "int" - }, - { - "name": "Headers", - "type": "dynamic" - }, - { - "name": "Host", - "type": "string" - }, - { - "name": "HTTPHost", - "type": "string" - }, - { - "name": "HTTPMethod", - "type": "string" - }, - { - "name": "HTTPStatusCode", - "type": "int" - }, - { - "name": "HTTPVersion", - "type": "string" - }, - { - "name": "ICMPChecksum", - "type": "int" - }, - { - "name": "ICMPCode", - "type": "int" - }, - { - "name": "ICMPType", - "type": "int" - }, - { - "name": "ID", - "type": "string" - }, - { - "name": "IngressColoName", - "type": "string" - }, - { - "name": "InitialCategoryIDs", - "type": "dynamic" - }, - { - "name": "InitialCategoryNames", - "type": "dynamic" - }, - { - "name": "InitialResolvedIPs", - "type": "dynamic" - }, - { - "name": "InstanceID", - "type": "string" - }, - { - "name": "IntegrationDisplayName", - "type": "string" - }, - { - "name": "IntegrationID", - "type": "string" - }, - { - "name": "IntegrationPolicyVendor", - "type": "string" - }, - { - "name": "Interface", - "type": "string" - }, - { - "name": "InternalDNSFallbackStrategy", - "type": "string" - }, - { - "name": "InternalDNSRCode", - "type": "int" - }, - { - "name": "InternalDNSViewID", - "type": "string" - }, - { - "name": "InternalDNSZoneID", - "type": "string" - }, - { - "name": "IP", - "type": "string" - }, - { - "name": "IPAddress", - "type": "string" - }, - { - "name": "IPDestinationAddress", - "type": "string" - }, - { - "name": "IPDestinationSubnet", - "type": "string" - }, - { - "name": "IpFirewall", - "type": "boolean" - }, - { - "name": "IPFragmentOffset", - "type": "int" - }, - { - "name": "IPHeaderLength", - "type": "int" - }, - { - "name": "IPMoreFragments", - "type": "int" - }, - { - "name": "IPProtocol", - "type": "int" - }, - { - "name": "IPProtocolName", - "type": "string" - }, - { - "name": "IPSourceAddress", - "type": "string" - }, - { - "name": "IPSourceSubnet", - "type": "string" - }, - { - "name": "IPTotalLength", - "type": "int" - }, - { - "name": "IPTotalLengthBuckets", - "type": "int" - }, - { - "name": "IPTTL", - "type": "int" - }, - { - "name": "IPTTLBuckets", - "type": "int" - }, - { - "name": "IPv4Checksum", - "type": "int" - }, - { - "name": "IPv4DontFragment", - "type": "int" - }, - { - "name": "IPv4DSCP", - "type": "int" - }, - { - "name": "IPv4ECN", - "type": "int" - }, - { - "name": "IPv4Identification", - "type": "int" - }, - { - "name": "IPv4Options", - "type": "string" - }, - { - "name": "IPv6DSCP", - "type": "int" - }, - { - "name": "IPv6ECN", - "type": "int" - }, - { - "name": "IPv6ExtensionHeaders", - "type": "string" - }, - { - "name": "IPv6FlowLabel", - "type": "int" - }, - { - "name": "IPv6Identification", - "type": "int" - }, - { - "name": "IsIsolated", - "type": "boolean" - }, - { - "name": "IsResponseCached", - "type": "boolean" - }, - { - "name": "JA3Hash", - "type": "string" - }, - { - "name": "JA4", - "type": "string" - }, - { - "name": "JA4Signals", - "type": "dynamic" - }, - { - "name": "Kind", - "type": "string" - }, - { - "name": "LastKnownGoodColoCode", - "type": "string" - }, - { - "name": "LeakedCredentialCheckResult", - "type": "string" - }, - { - "name": "Links", - "type": "string" - }, - { - "name": "Location", - "type": "string" - }, - { - "name": "LocationID", - "type": "string" - }, - { - "name": "Logs", - "type": "string" - }, - { - "name": "MatchedCategoryIDs", - "type": "dynamic" - }, - { - "name": "MatchedCategoryNames", - "type": "dynamic" - }, - { - "name": "MatchedIndicatorFeedIDs", - "type": "dynamic" - }, - { - "name": "MatchedIndicatorFeedNames", - "type": "dynamic" - }, - { - "name": "MatchIndex", - "type": "int" - }, - { - "name": "MessageDeliveryMode", - "type": "string" - }, - { - "name": "MessageID", - "type": "string" - }, - { - "name": "Metadata", - "type": "dynamic" - }, - { - "name": "Method", - "type": "string" - }, - { - "name": "MitigationReason", - "type": "string" - }, - { - "name": "MitigationScope", - "type": "string" - }, - { - "name": "MitigationSystem", - "type": "string" - }, - { - "name": "NewValue", - "type": "dynamic" - }, - { - "name": "Offramp", - "type": "string" - }, - { - "name": "OldValue", - "type": "dynamic" - }, - { - "name": "Origin", - "type": "string" - }, - { - "name": "OriginalSender", - "type": "string" - }, - { - "name": "OriginatorRayID", - "type": "string" - }, - { - "name": "OriginBytes", - "type": "int" - }, - { - "name": "OriginDNSResponseTimeMs", - "type": "int" - }, - { - "name": "OriginIP", - "type": "string" - }, - { - "name": "OriginPort", - "type": "int" - }, - { - "name": "OriginProto", - "type": "string" - }, - { - "name": "OriginRequestHeaderSendDurationMs", - "type": "int" - }, - { - "name": "OriginResponseBytes", - "type": "int" - }, - { - "name": "OriginResponseDurationMs", - "type": "int" - }, - { - "name": "OriginResponseHeaderReceiveDurationMs", - "type": "int" - }, - { - "name": "OriginResponseHTTPExpires", - "type": "string" - }, - { - "name": "OriginResponseHTTPLastModified", - "type": "string" - }, - { - "name": "OriginResponseStatus", - "type": "int" - }, - { - "name": "OriginSSLProtocol", - "type": "string" - }, - { - "name": "OriginTCPHandshakeDurationMs", - "type": "int" - }, - { - "name": "OriginTcpRtt", - "type": "int" - }, - { - "name": "OriginTLSCertificateIssuer", - "type": "string" - }, - { - "name": "OriginTLSCertificateValidationResult", - "type": "string" - }, - { - "name": "OriginTLSCipher", - "type": "string" - }, - { - "name": "OriginTlsFingerprint", - "type": "string" - }, - { - "name": "OriginTLSHandshakeDurationMs", - "type": "int" - }, - { - "name": "OriginTlsMode", - "type": "string" - }, - { - "name": "OriginTlsProtocol", - "type": "string" - }, - { - "name": "OriginTlsStatus", - "type": "string" - }, - { - "name": "OriginTLSVersion", - "type": "string" - }, - { - "name": "OSVersion", - "type": "string" - }, - { - "name": "Outcome", - "type": "string" - }, - { - "name": "OverrideIP", - "type": "string" - }, - { - "name": "OverridePort", - "type": "int" - }, - { - "name": "OwnerID", - "type": "string" - }, - { - "name": "PageURL", - "type": "string" - }, - { - "name": "ParentRayID", - "type": "string" - }, - { - "name": "Password", - "type": "string" - }, - { - "name": "Payload", - "type": "string" - }, - { - "name": "Phase", - "type": "string" - }, - { - "name": "PolicyID", - "type": "string" - }, - { - "name": "PolicyName", - "type": "string" - }, - { - "name": "PostureCheckName", - "type": "string" - }, - { - "name": "PostureCheckType", - "type": "string" - }, - { - "name": "PostureEvaluatedResult", - "type": "boolean" - }, - { - "name": "PostureExpectedJSON", - "type": "dynamic" - }, - { - "name": "PostureReceivedJSON", - "type": "dynamic" - }, - { - "name": "PrivateAppAUD", - "type": "string" - }, - { - "name": "ProgramFinishDatetime", - "type": "string" - }, - { - "name": "ProgramID", - "type": "string" - }, - { - "name": "ProgramStartDatetime", - "type": "string" - }, - { - "name": "ProgramType", - "type": "string" - }, - { - "name": "Protocol", - "type": "string" - }, - { - "name": "ProtocolState", - "type": "string" - }, - { - "name": "ProxyEndpoint", - "type": "string" - }, - { - "name": "ProxyProtocol", - "type": "string" - }, - { - "name": "PTY", - "type": "string" - }, - { - "name": "PurposeJustificationPrompt", - "type": "string" - }, - { - "name": "PurposeJustificationResponse", - "type": "string" - }, - { - "name": "Quarantined", - "type": "boolean" - }, - { - "name": "QueryCategoryIDs", - "type": "dynamic" - }, - { - "name": "QueryCategoryNames", - "type": "dynamic" - }, - { - "name": "QueryDO", - "type": "boolean" - }, - { - "name": "QueryID", - "type": "string" - }, - { - "name": "QueryIndicatorFeedIDs", - "type": "dynamic" - }, - { - "name": "QueryIndicatorFeedNames", - "type": "dynamic" - }, - { - "name": "QueryName", - "type": "string" - }, - { - "name": "QueryNameReversed", - "type": "string" - }, - { - "name": "QueryRD", - "type": "boolean" - }, - { - "name": "QuerySize", - "type": "int" - }, - { - "name": "QueryTCP", - "type": "boolean" - }, - { - "name": "QueryType", - "type": "int" - }, - { - "name": "QueryTypeName", - "type": "string" - }, - { - "name": "R2Path", - "type": "string" - }, - { - "name": "RayID", - "type": "string" - }, - { - "name": "RCode", - "type": "int" - }, - { - "name": "RData", - "type": "dynamic" - }, - { - "name": "RedirectTargetURI", - "type": "string" - }, - { - "name": "Ref", - "type": "string" - }, - { - "name": "Referer", - "type": "string" - }, - { - "name": "Referrer", - "type": "string" - }, - { - "name": "RegistrationID", - "type": "string" - }, - { - "name": "ReplyTo", - "type": "string" - }, - { - "name": "ReplyToName", - "type": "string" - }, - { - "name": "RequestContextCategoryIDs", - "type": "dynamic" - }, - { - "name": "RequestContextCategoryNames", - "type": "dynamic" - }, - { - "name": "RequestHeaders", - "type": "dynamic" - }, - { - "name": "RequestID", - "type": "string" - }, - { - "name": "ResolvedIPCategoryIDs", - "type": "dynamic" - }, - { - "name": "ResolvedIPCategoryNames", - "type": "dynamic" - }, - { - "name": "ResolvedIPContinentCodes", - "type": "dynamic" - }, - { - "name": "ResolvedIPCountryCodes", - "type": "dynamic" - }, - { - "name": "ResolverDecision", - "type": "string" - }, - { - "name": "ResourceID", - "type": "string" - }, - { - "name": "ResourceRecords", - "type": "dynamic" - }, - { - "name": "ResourceRecordsJSON", - "type": "string" - }, - { - "name": "ResourceType", - "type": "string" - }, - { - "name": "ResponseCached", - "type": "boolean" - }, - { - "name": "ResponseCachedStale", - "type": "boolean" - }, - { - "name": "ResponseHeaders", - "type": "dynamic" - }, - { - "name": "ResponseReason", - "type": "string" - }, - { - "name": "RuleEvaluationDurationMs", - "type": "int" - }, - { - "name": "RuleID", - "type": "string" - }, - { - "name": "RuleName", - "type": "string" - }, - { - "name": "RulesetID", - "type": "string" - }, - { - "name": "RulesetOverrideID", - "type": "string" - }, - { - "name": "SampleInterval", - "type": "int" - }, - { - "name": "ScriptName", - "type": "string" - }, - { - "name": "ScriptTags", - "type": "string" - }, - { - "name": "ScriptVersion", - "type": "string" - }, - { - "name": "SecurityAction", - "type": "string" - }, - { - "name": "SecurityActions", - "type": "dynamic" - }, - { - "name": "SecurityRuleDescription", - "type": "string" - }, - { - "name": "SecurityRuleID", - "type": "string" - }, - { - "name": "SecurityRuleIDs", - "type": "dynamic" - }, - { - "name": "SecuritySources", - "type": "dynamic" - }, - { - "name": "ServerAddress", - "type": "string" - }, - { - "name": "SessionEndTime", - "type": "string" - }, - { - "name": "SessionFinishDatetime", - "type": "string" - }, - { - "name": "SessionID", - "type": "string" - }, - { - "name": "SessionStartDatetime", - "type": "string" - }, - { - "name": "SessionStartTime", - "type": "string" - }, - { - "name": "SignatureID", - "type": "int" - }, - { - "name": "SignatureMessage", - "type": "string" - }, - { - "name": "SignatureRevision", - "type": "int" - }, - { - "name": "SinkholeID", - "type": "string" - }, - { - "name": "SmartRouteColoID", - "type": "int" - }, - { - "name": "SMTPEnvelopeFrom", - "type": "string" - }, - { - "name": "SMTPEnvelopeTo", - "type": "string" - }, - { - "name": "SMTPHeloServerIP", - "type": "string" - }, - { - "name": "SMTPHeloServerIPAsName", - "type": "string" - }, - { - "name": "SMTPHeloServerIPAsNumber", - "type": "string" - }, - { - "name": "SMTPHeloServerIPGeo", - "type": "string" - }, - { - "name": "SMTPHeloServerName", - "type": "string" - }, - { - "name": "SNI", - "type": "string" - }, - { - "name": "Source", - "type": "string" - }, - { - "name": "SourceASN", - "type": "int" - }, - { - "name": "SourceASNName", - "type": "string" - }, - { - "name": "SourceCountry", - "type": "string" - }, - { - "name": "SourceGeoHash", - "type": "string" - }, - { - "name": "SourceInternalIP", - "type": "string" - }, - { - "name": "SourceIP", - "type": "string" - }, - { - "name": "SourceIPContinentCode", - "type": "string" - }, - { - "name": "SourceIPCountryCode", - "type": "string" - }, - { - "name": "SourcePort", - "type": "int" - }, - { - "name": "SrcAddr", - "type": "string" - }, - { - "name": "SrcIP", - "type": "string" - }, - { - "name": "SrcIPContinentCode", - "type": "string" - }, - { - "name": "SrcIPCountryCode", - "type": "string" - }, - { - "name": "SrcPort", - "type": "int" - }, - { - "name": "Status", - "type": "int" - }, - { - "name": "Subject", - "type": "string" - }, - { - "name": "TargetID", - "type": "string" - }, - { - "name": "TCPAcknowledgementNumber", - "type": "int" - }, - { - "name": "TCPChecksum", - "type": "int" - }, - { - "name": "TCPDataOffset", - "type": "int" - }, - { - "name": "TCPFlags", - "type": "int" - }, - { - "name": "TCPFlagsString", - "type": "string" - }, - { - "name": "TCPMSS", - "type": "int" - }, - { - "name": "TCPOptions", - "type": "string" - }, - { - "name": "TCPSACKBlocks", - "type": "string" - }, - { - "name": "TCPSACKPermitted", - "type": "int" - }, - { - "name": "TCPSequenceNumber", - "type": "int" - }, - { - "name": "TCPTimestampECR", - "type": "int" - }, - { - "name": "TCPTimestampValue", - "type": "int" - }, - { - "name": "TCPUrgentPointer", - "type": "int" - }, - { - "name": "TCPWindowScale", - "type": "int" - }, - { - "name": "TCPWindowSize", - "type": "int" - }, - { - "name": "TemporaryAccessApprovers", - "type": "dynamic" - }, - { - "name": "TemporaryAccessDuration", - "type": "int" - }, - { - "name": "ThreatCategories", - "type": "string" - }, - { - "name": "Timestamp", - "type": "string" - }, - { - "name": "TimeZone", - "type": "string" - }, - { - "name": "TimeZoneInferredMethod", - "type": "string" - }, - { - "name": "To", - "type": "string" - }, - { - "name": "ToName", - "type": "string" - }, - { - "name": "Transport", - "type": "string" - }, - { - "name": "TransportProtocol", - "type": "string" - }, - { - "name": "TriggeredRuleID", - "type": "string" - }, - { - "name": "Type", - "type": "string" - }, - { - "name": "UDPChecksum", - "type": "int" - }, - { - "name": "UDPPayloadLength", - "type": "int" - }, - { - "name": "UntrustedCertificateAction", - "type": "string" - }, - { - "name": "UploadedFileNames", - "type": "dynamic" - }, - { - "name": "UploadMatchedDlpProfileEntries", - "type": "dynamic" - }, - { - "name": "UploadMatchedDlpProfiles", - "type": "dynamic" - }, - { - "name": "UpperTierColoID", - "type": "int" - }, - { - "name": "UpstreamIP", - "type": "string" - }, - { - "name": "UpstreamResponseCode", - "type": "int" - }, - { - "name": "UpstreamResponseTimeMs", - "type": "int" - }, - { - "name": "URI", - "type": "string" - }, - { - "name": "URL", - "type": "string" - }, - { - "name": "URLContainsCDNCGIPath", - "type": "boolean" - }, - { - "name": "URLHost", - "type": "string" - }, - { - "name": "UserAgent", - "type": "string" - }, - { - "name": "UserEmail", - "type": "string" - }, - { - "name": "UserID", - "type": "string" - }, - { - "name": "Username", - "type": "string" - }, - { - "name": "UserUID", - "type": "string" - }, - { - "name": "Verdict", - "type": "string" - }, - { - "name": "VirtualNetworkID", - "type": "string" - }, - { - "name": "VirtualNetworkName", - "type": "string" - }, - { - "name": "WAFAttackScore", - "type": "int" - }, - { - "name": "WAFRCEAttackScore", - "type": "int" - }, - { - "name": "WAFSQLiAttackScore", - "type": "int" - }, - { - "name": "WAFXSSAttackScore", - "type": "int" - }, - { - "name": "WallTimeMs", - "type": "int" - }, - { - "name": "When", - "type": "string" - }, - { - "name": "WorkerCPUTime", - "type": "int" - }, + "schema": { + "name": "CloudflareV2_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "CloudflareAccountId", + "type": "string" + }, + { + "name": "CloudflareAccountName", + "type": "string" + }, + { + "name": "AccountID", + "type": "string" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ActionResult", + "type": "boolean" + }, + { + "name": "ActionType", + "type": "string" + }, + { + "name": "ActorEmail", + "type": "string" + }, + { + "name": "ActorID", + "type": "string" + }, + { + "name": "ActorIP", + "type": "string" + }, + { + "name": "ActorType", + "type": "string" + }, + { + "name": "AlertID", + "type": "string" + }, + { + "name": "AlertReasons", + "type": "string" + }, + { + "name": "Allowed", + "type": "boolean" + }, + { + "name": "AppDomain", + "type": "string" + }, + { + "name": "Application", + "type": "string" + }, + { + "name": "ApplicationIDs", + "type": "dynamic" + }, + { + "name": "ApplicationNames", + "type": "dynamic" + }, + { + "name": "AppUUID", + "type": "string" + }, + { + "name": "AssetDisplayName", + "type": "string" + }, + { + "name": "AssetExternalID", + "type": "string" + }, + { + "name": "AssetLink", + "type": "string" + }, + { + "name": "AssetMetadata", + "type": "dynamic" + }, + { + "name": "Attachments", + "type": "string" + }, + { + "name": "AttackCampaignID", + "type": "string" + }, + { + "name": "AttackID", + "type": "string" + }, + { + "name": "AttackVector", + "type": "string" + }, + { + "name": "AuthoritativeNameServerIPs", + "type": "dynamic" + }, + { + "name": "BlockedFileHash", + "type": "string" + }, + { + "name": "BlockedFileName", + "type": "string" + }, + { + "name": "BlockedFileReason", + "type": "string" + }, + { + "name": "BlockedFileSize", + "type": "int" + }, + { + "name": "BlockedFileType", + "type": "string" + }, + { + "name": "Body", + "type": "dynamic" + }, + { + "name": "BodyLength", + "type": "int" + }, + { + "name": "BotDetectionIDs", + "type": "dynamic" + }, + { + "name": "BotDetectionTags", + "type": "dynamic" + }, + { + "name": "BotScore", + "type": "int" + }, + { + "name": "BotScoreSrc", + "type": "string" + }, + { + "name": "BotTags", + "type": "dynamic" + }, + { + "name": "BytesReceived", + "type": "int" + }, + { + "name": "BytesSent", + "type": "int" + }, + { + "name": "CacheCacheStatus", + "type": "string" + }, + { + "name": "CacheReserveUsed", + "type": "boolean" + }, + { + "name": "CacheResponseBytes", + "type": "int" + }, + { + "name": "CacheResponseStatus", + "type": "int" + }, + { + "name": "CacheTieredFill", + "type": "boolean" + }, + { + "name": "CategoryIDs", + "type": "dynamic" + }, + { + "name": "CategoryNames", + "type": "dynamic" + }, + { + "name": "CC", + "type": "string" + }, + { + "name": "CCName", + "type": "string" + }, + { + "name": "ClientAddress", + "type": "string" + }, + { + "name": "ClientASN", + "type": "int" + }, + { + "name": "ClientASNDescription", + "type": "string" + }, + { + "name": "ClientBytes", + "type": "int" + }, + { + "name": "ClientCity", + "type": "string" + }, + { + "name": "ClientCountry", + "type": "string" + }, + { + "name": "ClientDeviceType", + "type": "string" + }, + { + "name": "ClientIP", + "type": "string" + }, + { + "name": "ClientIPASN", + "type": "int" + }, + { + "name": "ClientIPASNDescription", + "type": "string" + }, + { + "name": "ClientIPClass", + "type": "string" + }, + { + "name": "ClientIPCountry", + "type": "string" + }, + { + "name": "ClientLatitude", + "type": "string" + }, + { + "name": "ClientLongitude", + "type": "string" + }, + { + "name": "ClientMatchedIpFirewall", + "type": "string" + }, + { + "name": "ClientMTLSAuthCertFingerprint", + "type": "string" + }, + { + "name": "ClientMTLSAuthStatus", + "type": "string" + }, + { + "name": "ClientPort", + "type": "int" + }, + { + "name": "ClientProto", + "type": "string" + }, + { + "name": "ClientRefererHost", + "type": "string" + }, + { + "name": "ClientRefererPath", + "type": "string" + }, + { + "name": "ClientRefererQuery", + "type": "string" + }, + { + "name": "ClientRefererScheme", + "type": "string" + }, + { + "name": "ClientRegionCode", + "type": "string" + }, + { + "name": "ClientRequestBytes", + "type": "int" + }, + { + "name": "ClientRequestHost", + "type": "string" + }, + { + "name": "ClientRequestMethod", + "type": "string" + }, + { + "name": "ClientRequestPath", + "type": "string" + }, + { + "name": "ClientRequestProtocol", + "type": "string" + }, + { + "name": "ClientRequestQuery", + "type": "string" + }, + { + "name": "ClientRequestReferer", + "type": "string" + }, + { + "name": "ClientRequestScheme", + "type": "string" + }, + { + "name": "ClientRequestSource", + "type": "string" + }, + { + "name": "ClientRequestURI", + "type": "string" + }, + { + "name": "ClientRequestUserAgent", + "type": "string" + }, + { + "name": "ClientResponseCode", + "type": "int" + }, + { + "name": "ClientSrcPort", + "type": "int" + }, + { + "name": "ClientSSLCipher", + "type": "string" + }, + { + "name": "ClientSSLProtocol", + "type": "string" + }, + { + "name": "ClientTCPHandshakeDurationMs", + "type": "int" + }, + { + "name": "ClientTcpRtt", + "type": "int" + }, + { + "name": "ClientTCPRTTMs", + "type": "int" + }, + { + "name": "ClientTLSCipher", + "type": "string" + }, + { + "name": "ClientTlsClientHelloServerName", + "type": "string" + }, + { + "name": "ClientTLSHandshakeDurationMs", + "type": "int" + }, + { + "name": "ClientTlsProtocol", + "type": "string" + }, + { + "name": "ClientTlsStatus", + "type": "string" + }, + { + "name": "ClientTLSVersion", + "type": "string" + }, + { + "name": "ClientVersion", + "type": "string" + }, + { + "name": "ClientXRequestedWith", + "type": "string" + }, + { + "name": "ClusterID", + "type": "string" + }, + { + "name": "CNAMECategoryIDs", + "type": "dynamic" + }, + { + "name": "CNAMECategoryNames", + "type": "dynamic" + }, + { + "name": "CNAMEs", + "type": "dynamic" + }, + { + "name": "CNAMEsReversed", + "type": "dynamic" + }, + { + "name": "ColoCity", + "type": "string" + }, + { + "name": "ColoCode", + "type": "string" + }, + { + "name": "ColoCountry", + "type": "string" + }, + { + "name": "ColoGeoHash", + "type": "string" + }, + { + "name": "ColoID", + "type": "int" + }, + { + "name": "ColoName", + "type": "string" + }, + { + "name": "Connection", + "type": "string" + }, + { + "name": "ConnectionCloseReason", + "type": "string" + }, + { + "name": "ConnectionReuse", + "type": "boolean" + }, + { + "name": "ConnectTimestamp", + "type": "string" + }, + { + "name": "ContentScanObjResults", + "type": "dynamic" + }, + { + "name": "ContentScanObjSizes", + "type": "dynamic" + }, + { + "name": "ContentScanObjTypes", + "type": "dynamic" + }, + { + "name": "Cookies", + "type": "dynamic" + }, + { + "name": "Country", + "type": "string" + }, + { + "name": "CPUTimeMs", + "type": "int" + }, + { + "name": "CreatedAt", + "type": "string" + }, + { + "name": "CSPDirective", + "type": "string" + }, + { + "name": "CustomResolveDurationMs", + "type": "int" + }, + { + "name": "CustomResolverAddress", + "type": "string" + }, + { + "name": "CustomResolverPolicyID", + "type": "string" + }, + { + "name": "CustomResolverPolicyName", + "type": "string" + }, + { + "name": "CustomResolverResponse", + "type": "string" + }, + { + "name": "Datetime", + "type": "string" + }, + { + "name": "Decision", + "type": "string" + }, + { + "name": "Description", + "type": "string" + }, + { + "name": "DestAddr", + "type": "string" + }, + { + "name": "DestinationASN", + "type": "int" + }, + { + "name": "DestinationASNName", + "type": "string" + }, + { + "name": "DestinationCountry", + "type": "string" + }, + { + "name": "DestinationGeoHash", + "type": "string" + }, + { + "name": "DestinationIP", + "type": "string" + }, + { + "name": "DestinationIPContinentCode", + "type": "string" + }, + { + "name": "DestinationIPCountryCode", + "type": "string" + }, + { + "name": "DestinationPort", + "type": "int" + }, + { + "name": "DestinationTunnelID", + "type": "string" + }, + { + "name": "DetectedProtocol", + "type": "string" + }, + { + "name": "DetectedTimestamp", + "type": "string" + }, + { + "name": "DeviceID", + "type": "string" + }, + { + "name": "DeviceManufacturer", + "type": "string" + }, + { + "name": "DeviceModel", + "type": "string" + }, + { + "name": "DeviceName", + "type": "string" + }, + { + "name": "DeviceSerialNumber", + "type": "string" + }, + { + "name": "DeviceType", + "type": "string" + }, + { + "name": "Direction", + "type": "string" + }, + { + "name": "DisconnectTimestamp", + "type": "string" + }, + { + "name": "DispatchNamespace", + "type": "string" + }, + { + "name": "DoHSubdomain", + "type": "string" + }, + { + "name": "DomainName", + "type": "string" + }, + { + "name": "DoTSubdomain", + "type": "string" + }, + { + "name": "DownloadedFileNames", + "type": "dynamic" + }, + { + "name": "DownloadMatchedDlpProfileEntries", + "type": "dynamic" + }, + { + "name": "DownloadMatchedDlpProfiles", + "type": "dynamic" + }, + { + "name": "DstIP", + "type": "string" + }, + { + "name": "DstPort", + "type": "int" + }, + { + "name": "EDEErrors", + "type": "dynamic" + }, + { + "name": "EdgeCFConnectingO2O", + "type": "boolean" + }, + { + "name": "EdgeColoCode", + "type": "string" + }, + { + "name": "EdgeColoID", + "type": "int" + }, + { + "name": "EdgeEndTimestamp", + "type": "string" + }, + { + "name": "EdgePathingOp", + "type": "string" + }, + { + "name": "EdgePathingSrc", + "type": "string" + }, + { + "name": "EdgePathingStatus", + "type": "string" + }, + { + "name": "EdgeRequestHost", + "type": "string" + }, + { + "name": "EdgeResponseBodyBytes", + "type": "int" + }, + { + "name": "EdgeResponseBytes", + "type": "int" + }, + { + "name": "EdgeResponseCompressionRatio", + "type": "real" + }, + { + "name": "EdgeResponseContentType", + "type": "string" + }, + { + "name": "EdgeResponseStatus", + "type": "int" + }, + { + "name": "EdgeServerIP", + "type": "string" + }, + { + "name": "EdgeStartTimestamp", + "type": "string" + }, + { + "name": "EdgeTimeToFirstByteMs", + "type": "int" + }, + { + "name": "EDNSSubnet", + "type": "string" + }, + { + "name": "EDNSSubnetLength", + "type": "int" + }, + { + "name": "EgressColoName", + "type": "string" + }, + { + "name": "EgressIP", + "type": "string" + }, + { + "name": "EgressPort", + "type": "int" + }, + { + "name": "EgressRuleID", + "type": "string" + }, + { + "name": "EgressRuleName", + "type": "string" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "Entrypoint", + "type": "string" + }, + { + "name": "Error", + "type": "string" + }, + { + "name": "Event", + "type": "string" + }, + { + "name": "EventDetails", + "type": "dynamic" + }, + { + "name": "EventTimestampMs", + "type": "int" + }, + { + "name": "EventType", + "type": "string" + }, + { + "name": "Exceptions", + "type": "string" + }, + { + "name": "FileInfo", + "type": "dynamic" + }, + { + "name": "FinalDisposition", + "type": "string" + }, + { + "name": "FindingTypeDisplayName", + "type": "string" + }, + { + "name": "FindingTypeID", + "type": "string" + }, + { + "name": "FindingTypeSeverity", + "type": "string" + }, + { + "name": "ForensicCopyID", + "type": "string" + }, + { + "name": "ForensicCopyStatus", + "type": "string" + }, + { + "name": "From", + "type": "string" + }, + { + "name": "FromName", + "type": "string" + }, + { + "name": "GatewayRequestID", + "type": "string" + }, + { + "name": "GREChecksum", + "type": "int" + }, + { + "name": "GREEtherType", + "type": "int" + }, + { + "name": "GREHeaderLength", + "type": "int" + }, + { + "name": "GREKey", + "type": "int" + }, + { + "name": "GRESequenceNumber", + "type": "int" + }, + { + "name": "GREVersion", + "type": "int" + }, + { + "name": "Headers", + "type": "dynamic" + }, + { + "name": "Host", + "type": "string" + }, + { + "name": "HTTPHost", + "type": "string" + }, + { + "name": "HTTPMethod", + "type": "string" + }, + { + "name": "HTTPStatusCode", + "type": "int" + }, + { + "name": "HTTPVersion", + "type": "string" + }, + { + "name": "ICMPChecksum", + "type": "int" + }, + { + "name": "ICMPCode", + "type": "int" + }, + { + "name": "ICMPType", + "type": "int" + }, + { + "name": "ID", + "type": "string" + }, + { + "name": "IngressColoName", + "type": "string" + }, + { + "name": "InitialCategoryIDs", + "type": "dynamic" + }, + { + "name": "InitialCategoryNames", + "type": "dynamic" + }, + { + "name": "InitialResolvedIPs", + "type": "dynamic" + }, + { + "name": "InstanceID", + "type": "string" + }, + { + "name": "IntegrationDisplayName", + "type": "string" + }, + { + "name": "IntegrationID", + "type": "string" + }, + { + "name": "IntegrationPolicyVendor", + "type": "string" + }, + { + "name": "Interface", + "type": "string" + }, + { + "name": "InternalDNSFallbackStrategy", + "type": "string" + }, + { + "name": "InternalDNSRCode", + "type": "int" + }, + { + "name": "InternalDNSViewID", + "type": "string" + }, + { + "name": "InternalDNSZoneID", + "type": "string" + }, + { + "name": "IP", + "type": "string" + }, + { + "name": "IPAddress", + "type": "string" + }, + { + "name": "IPDestinationAddress", + "type": "string" + }, + { + "name": "IPDestinationSubnet", + "type": "string" + }, + { + "name": "IpFirewall", + "type": "boolean" + }, + { + "name": "IPFragmentOffset", + "type": "int" + }, + { + "name": "IPHeaderLength", + "type": "int" + }, + { + "name": "IPMoreFragments", + "type": "int" + }, + { + "name": "IPProtocol", + "type": "int" + }, + { + "name": "IPProtocolName", + "type": "string" + }, + { + "name": "IPSourceAddress", + "type": "string" + }, + { + "name": "IPSourceSubnet", + "type": "string" + }, + { + "name": "IPTotalLength", + "type": "int" + }, + { + "name": "IPTotalLengthBuckets", + "type": "int" + }, + { + "name": "IPTTL", + "type": "int" + }, + { + "name": "IPTTLBuckets", + "type": "int" + }, + { + "name": "IPv4Checksum", + "type": "int" + }, + { + "name": "IPv4DontFragment", + "type": "int" + }, + { + "name": "IPv4DSCP", + "type": "int" + }, + { + "name": "IPv4ECN", + "type": "int" + }, + { + "name": "IPv4Identification", + "type": "int" + }, + { + "name": "IPv4Options", + "type": "string" + }, + { + "name": "IPv6DSCP", + "type": "int" + }, + { + "name": "IPv6ECN", + "type": "int" + }, + { + "name": "IPv6ExtensionHeaders", + "type": "string" + }, + { + "name": "IPv6FlowLabel", + "type": "int" + }, + { + "name": "IPv6Identification", + "type": "int" + }, + { + "name": "IsIsolated", + "type": "boolean" + }, + { + "name": "IsResponseCached", + "type": "boolean" + }, + { + "name": "JA3Hash", + "type": "string" + }, + { + "name": "JA4", + "type": "string" + }, + { + "name": "JA4Signals", + "type": "dynamic" + }, + { + "name": "Kind", + "type": "string" + }, + { + "name": "LastKnownGoodColoCode", + "type": "string" + }, + { + "name": "LeakedCredentialCheckResult", + "type": "string" + }, + { + "name": "Links", + "type": "string" + }, + { + "name": "Location", + "type": "string" + }, + { + "name": "LocationID", + "type": "string" + }, + { + "name": "Logs", + "type": "string" + }, + { + "name": "NELType", + "type": "string" + }, + { + "name": "MatchedCategoryIDs", + "type": "dynamic" + }, + { + "name": "MatchedCategoryNames", + "type": "dynamic" + }, + { + "name": "MatchedIndicatorFeedIDs", + "type": "dynamic" + }, + { + "name": "MatchedIndicatorFeedNames", + "type": "dynamic" + }, + { + "name": "MatchIndex", + "type": "int" + }, + { + "name": "MessageDeliveryMode", + "type": "string" + }, + { + "name": "MessageID", + "type": "string" + }, + { + "name": "Metadata", + "type": "dynamic" + }, + { + "name": "Method", + "type": "string" + }, + { + "name": "MitigationReason", + "type": "string" + }, + { + "name": "MitigationScope", + "type": "string" + }, + { + "name": "MitigationSystem", + "type": "string" + }, + { + "name": "NewValue", + "type": "dynamic" + }, + { + "name": "Offramp", + "type": "string" + }, + { + "name": "OldValue", + "type": "dynamic" + }, + { + "name": "Origin", + "type": "string" + }, + { + "name": "OriginalSender", + "type": "string" + }, + { + "name": "OriginatorRayID", + "type": "string" + }, + { + "name": "OriginBytes", + "type": "int" + }, + { + "name": "OriginDNSResponseTimeMs", + "type": "int" + }, + { + "name": "OriginIP", + "type": "string" + }, + { + "name": "OriginPort", + "type": "int" + }, + { + "name": "OriginProto", + "type": "string" + }, + { + "name": "OriginRequestHeaderSendDurationMs", + "type": "int" + }, + { + "name": "OriginResponseBytes", + "type": "int" + }, + { + "name": "OriginResponseDurationMs", + "type": "int" + }, + { + "name": "OriginResponseHeaderReceiveDurationMs", + "type": "int" + }, + { + "name": "OriginResponseHTTPExpires", + "type": "string" + }, + { + "name": "OriginResponseHTTPLastModified", + "type": "string" + }, + { + "name": "OriginResponseStatus", + "type": "int" + }, + { + "name": "OriginSSLProtocol", + "type": "string" + }, + { + "name": "OriginTCPHandshakeDurationMs", + "type": "int" + }, + { + "name": "OriginTcpRtt", + "type": "int" + }, + { + "name": "OriginTLSCertificateIssuer", + "type": "string" + }, + { + "name": "OriginTLSCertificateValidationResult", + "type": "string" + }, + { + "name": "OriginTLSCipher", + "type": "string" + }, + { + "name": "OriginTlsFingerprint", + "type": "string" + }, + { + "name": "OriginTLSHandshakeDurationMs", + "type": "int" + }, + { + "name": "OriginTlsMode", + "type": "string" + }, + { + "name": "OriginTlsProtocol", + "type": "string" + }, + { + "name": "OriginTlsStatus", + "type": "string" + }, + { + "name": "OriginTLSVersion", + "type": "string" + }, + { + "name": "OSVersion", + "type": "string" + }, + { + "name": "Outcome", + "type": "string" + }, + { + "name": "OverrideIP", + "type": "string" + }, + { + "name": "OverridePort", + "type": "int" + }, + { + "name": "OwnerID", + "type": "string" + }, + { + "name": "PageURL", + "type": "string" + }, + { + "name": "ParentRayID", + "type": "string" + }, + { + "name": "Password", + "type": "string" + }, + { + "name": "Payload", + "type": "string" + }, + { + "name": "Phase", + "type": "string" + }, + { + "name": "PolicyID", + "type": "string" + }, + { + "name": "PolicyName", + "type": "string" + }, + { + "name": "PostureCheckName", + "type": "string" + }, + { + "name": "PostureCheckType", + "type": "string" + }, + { + "name": "PostureEvaluatedResult", + "type": "boolean" + }, + { + "name": "PostureExpectedJSON", + "type": "dynamic" + }, + { + "name": "PostureReceivedJSON", + "type": "dynamic" + }, + { + "name": "PrivateAppAUD", + "type": "string" + }, + { + "name": "ProgramFinishDatetime", + "type": "string" + }, + { + "name": "ProgramID", + "type": "string" + }, + { + "name": "ProgramStartDatetime", + "type": "string" + }, + { + "name": "ProgramType", + "type": "string" + }, + { + "name": "Protocol", + "type": "string" + }, + { + "name": "ProtocolState", + "type": "string" + }, + { + "name": "ProxyEndpoint", + "type": "string" + }, + { + "name": "ProxyProtocol", + "type": "string" + }, + { + "name": "PTY", + "type": "string" + }, + { + "name": "PurposeJustificationPrompt", + "type": "string" + }, + { + "name": "PurposeJustificationResponse", + "type": "string" + }, + { + "name": "Quarantined", + "type": "boolean" + }, + { + "name": "QueryCategoryIDs", + "type": "dynamic" + }, + { + "name": "QueryCategoryNames", + "type": "dynamic" + }, + { + "name": "QueryDO", + "type": "boolean" + }, + { + "name": "QueryID", + "type": "string" + }, + { + "name": "QueryIndicatorFeedIDs", + "type": "dynamic" + }, + { + "name": "QueryIndicatorFeedNames", + "type": "dynamic" + }, + { + "name": "QueryName", + "type": "string" + }, + { + "name": "QueryNameReversed", + "type": "string" + }, + { + "name": "QueryRD", + "type": "boolean" + }, + { + "name": "QuerySize", + "type": "int" + }, + { + "name": "QueryTCP", + "type": "boolean" + }, + { + "name": "QueryType", + "type": "int" + }, + { + "name": "QueryTypeName", + "type": "string" + }, + { + "name": "R2Path", + "type": "string" + }, + { + "name": "RayID", + "type": "string" + }, + { + "name": "RCode", + "type": "int" + }, + { + "name": "RData", + "type": "dynamic" + }, + { + "name": "RedirectTargetURI", + "type": "string" + }, + { + "name": "Ref", + "type": "string" + }, + { + "name": "Referer", + "type": "string" + }, + { + "name": "Referrer", + "type": "string" + }, + { + "name": "RegistrationID", + "type": "string" + }, + { + "name": "ReplyTo", + "type": "string" + }, + { + "name": "ReplyToName", + "type": "string" + }, + { + "name": "RequestContextCategoryIDs", + "type": "dynamic" + }, + { + "name": "RequestContextCategoryNames", + "type": "dynamic" + }, + { + "name": "RequestHeaders", + "type": "dynamic" + }, + { + "name": "RequestID", + "type": "string" + }, + { + "name": "ResolvedIPCategoryIDs", + "type": "dynamic" + }, + { + "name": "ResolvedIPCategoryNames", + "type": "dynamic" + }, + { + "name": "ResolvedIPContinentCodes", + "type": "dynamic" + }, + { + "name": "ResolvedIPCountryCodes", + "type": "dynamic" + }, + { + "name": "ResolverDecision", + "type": "string" + }, + { + "name": "ResourceID", + "type": "string" + }, + { + "name": "ResourceRecords", + "type": "dynamic" + }, + { + "name": "ResourceRecordsJSON", + "type": "string" + }, + { + "name": "ResourceType", + "type": "string" + }, + { + "name": "ResponseCached", + "type": "boolean" + }, + { + "name": "ResponseCachedStale", + "type": "boolean" + }, + { + "name": "ResponseHeaders", + "type": "dynamic" + }, + { + "name": "ResponseReason", + "type": "string" + }, + { + "name": "RuleEvaluationDurationMs", + "type": "int" + }, + { + "name": "RuleID", + "type": "string" + }, + { + "name": "RuleName", + "type": "string" + }, + { + "name": "RulesetID", + "type": "string" + }, + { + "name": "RulesetOverrideID", + "type": "string" + }, + { + "name": "SampleInterval", + "type": "int" + }, + { + "name": "ScriptName", + "type": "string" + }, + { + "name": "ScriptTags", + "type": "string" + }, + { + "name": "ScriptVersion", + "type": "string" + }, + { + "name": "SecurityAction", + "type": "string" + }, + { + "name": "SecurityActions", + "type": "dynamic" + }, + { + "name": "SecurityRuleDescription", + "type": "string" + }, + { + "name": "SecurityRuleID", + "type": "string" + }, + { + "name": "SecurityRuleIDs", + "type": "dynamic" + }, + { + "name": "SecuritySources", + "type": "dynamic" + }, + { + "name": "ServerAddress", + "type": "string" + }, + { + "name": "SessionEndTime", + "type": "string" + }, + { + "name": "SessionFinishDatetime", + "type": "string" + }, + { + "name": "SessionID", + "type": "string" + }, + { + "name": "SessionStartDatetime", + "type": "string" + }, + { + "name": "SessionStartTime", + "type": "string" + }, + { + "name": "SignatureID", + "type": "int" + }, + { + "name": "SignatureMessage", + "type": "string" + }, + { + "name": "SignatureRevision", + "type": "int" + }, + { + "name": "SinkholeID", + "type": "string" + }, + { + "name": "SmartRouteColoID", + "type": "int" + }, + { + "name": "SMTPEnvelopeFrom", + "type": "string" + }, + { + "name": "SMTPEnvelopeTo", + "type": "string" + }, + { + "name": "SMTPHeloServerIP", + "type": "string" + }, + { + "name": "SMTPHeloServerIPAsName", + "type": "string" + }, + { + "name": "SMTPHeloServerIPAsNumber", + "type": "string" + }, + { + "name": "SMTPHeloServerIPGeo", + "type": "string" + }, + { + "name": "SMTPHeloServerName", + "type": "string" + }, + { + "name": "SNI", + "type": "string" + }, + { + "name": "Source", + "type": "string" + }, + { + "name": "SourceASN", + "type": "int" + }, + { + "name": "SourceASNName", + "type": "string" + }, + { + "name": "SourceCountry", + "type": "string" + }, + { + "name": "SourceGeoHash", + "type": "string" + }, + { + "name": "SourceInternalIP", + "type": "string" + }, + { + "name": "SourceIP", + "type": "string" + }, + { + "name": "SourceIPContinentCode", + "type": "string" + }, + { + "name": "SourceIPCountryCode", + "type": "string" + }, + { + "name": "SourcePort", + "type": "int" + }, + { + "name": "SrcAddr", + "type": "string" + }, + { + "name": "SrcIP", + "type": "string" + }, + { + "name": "SrcIPContinentCode", + "type": "string" + }, + { + "name": "SrcIPCountryCode", + "type": "string" + }, + { + "name": "SrcPort", + "type": "int" + }, + { + "name": "Status", + "type": "int" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "TargetID", + "type": "string" + }, + { + "name": "TCPAcknowledgementNumber", + "type": "int" + }, + { + "name": "TCPChecksum", + "type": "int" + }, + { + "name": "TCPDataOffset", + "type": "int" + }, + { + "name": "TCPFlags", + "type": "int" + }, + { + "name": "TCPFlagsString", + "type": "string" + }, + { + "name": "TCPMSS", + "type": "int" + }, + { + "name": "TCPOptions", + "type": "string" + }, + { + "name": "TCPSACKBlocks", + "type": "string" + }, + { + "name": "TCPSACKPermitted", + "type": "int" + }, + { + "name": "TCPSequenceNumber", + "type": "int" + }, + { + "name": "TCPTimestampECR", + "type": "int" + }, + { + "name": "TCPTimestampValue", + "type": "int" + }, + { + "name": "TCPUrgentPointer", + "type": "int" + }, + { + "name": "TCPWindowScale", + "type": "int" + }, + { + "name": "TCPWindowSize", + "type": "int" + }, + { + "name": "TemporaryAccessApprovers", + "type": "dynamic" + }, + { + "name": "TemporaryAccessDuration", + "type": "int" + }, + { + "name": "ThreatCategories", + "type": "string" + }, + { + "name": "Timestamp", + "type": "string" + }, + { + "name": "TimeZone", + "type": "string" + }, + { + "name": "TimeZoneInferredMethod", + "type": "string" + }, + { + "name": "To", + "type": "string" + }, + { + "name": "ToName", + "type": "string" + }, + { + "name": "Transport", + "type": "string" + }, + { + "name": "TransportProtocol", + "type": "string" + }, + { + "name": "TriggeredRuleID", + "type": "string" + }, + { + "name": "UDPChecksum", + "type": "int" + }, + { + "name": "UDPPayloadLength", + "type": "int" + }, + { + "name": "UntrustedCertificateAction", + "type": "string" + }, + { + "name": "UploadedFileNames", + "type": "dynamic" + }, + { + "name": "UploadMatchedDlpProfileEntries", + "type": "dynamic" + }, + { + "name": "UploadMatchedDlpProfiles", + "type": "dynamic" + }, + { + "name": "UpperTierColoID", + "type": "int" + }, + { + "name": "UpstreamIP", + "type": "string" + }, + { + "name": "UpstreamResponseCode", + "type": "int" + }, + { + "name": "UpstreamResponseTimeMs", + "type": "int" + }, + { + "name": "URI", + "type": "string" + }, + { + "name": "URL", + "type": "string" + }, + { + "name": "URLContainsCDNCGIPath", + "type": "boolean" + }, + { + "name": "URLHost", + "type": "string" + }, + { + "name": "UserAgent", + "type": "string" + }, + { + "name": "UserEmail", + "type": "string" + }, + { + "name": "UserID", + "type": "string" + }, + { + "name": "Username", + "type": "string" + }, + { + "name": "UserUID", + "type": "string" + }, + { + "name": "Verdict", + "type": "string" + }, + { + "name": "VirtualNetworkID", + "type": "string" + }, + { + "name": "VirtualNetworkName", + "type": "string" + }, + { + "name": "WAFAttackScore", + "type": "int" + }, + { + "name": "WAFRCEAttackScore", + "type": "int" + }, + { + "name": "WAFSQLiAttackScore", + "type": "int" + }, + { + "name": "WAFXSSAttackScore", + "type": "int" + }, + { + "name": "WallTimeMs", + "type": "int" + }, + { + "name": "When", + "type": "string" + }, + { + "name": "WorkerCPUTime", + "type": "int" + }, + { + "name": "WorkerScriptName", + "type": "string" + }, + { + "name": "WorkerStatus", + "type": "string" + }, + { + "name": "WorkerSubrequest", + "type": "boolean" + }, + { + "name": "WorkerSubrequestCount", + "type": "int" + }, + { + "name": "WorkerWallTimeUs", + "type": "int" + }, + { + "name": "ZoneName", + "type": "string" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[variables('workspaceLocationEffective')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "CloudflareDefinition", + "title": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)", + "publisher": "Microsoft", + "descriptionMarkdown": "The Cloudflare data connector ingests Cloudflare Logpush data from Azure Blob Storage into Microsoft Sentinel. It supports multiple Cloudflare accounts, storage accounts, and containers in one workspace while retaining the Cloudflare account identity on every ingested record. Refer to the [Cloudflare Logs documentation](https://developers.cloudflare.com/logs/about/) for more information.", + "graphQueriesTableName": "CloudflareV2_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "Cloudflare logs", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Cloudflare Logs", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "Deployment permissions", + "description": "The identity adding a collector must be able to deploy resources in the Microsoft Sentinel workspace resource group and in the target storage account resource group. To create the required role assignments, use **Owner** or **Contributor** plus **User Access Administrator** at the applicable scopes." + }, + { + "name": "Microsoft Sentinel service principal access", + "description": "The template grants the Microsoft Sentinel service principal **Storage Blob Data Contributor** on the selected container and **Storage Queue Data Contributor** on the two per-instance queues. These are data-plane roles only; the template does not grant Storage Account Contributor or account-key access." + }, + { + "name": "Cloudflare Logpush", + "description": "Configure Cloudflare Logpush to write JSON or compressed JSON logs to the selected blob container. Ensure the Cloudflare identity has the required Logpush permissions. See [Cloudflare Logpush permissions](https://developers.cloudflare.com/logs/logpush/permissions/) and [Azure destination setup](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/)." + }, + { + "name": "Role-assignment propagation", + "description": "The deployment includes a bounded 90-second propagation buffer before creating the connector. The buffer uses an Azure deployment script, which can create short-lived supporting resources, incur small transient cost, and be blocked by restrictive Azure Policy. Azure role propagation can take longer; if access initially fails, wait and submit the same collector again. Deterministic naming makes that retry idempotent." + }, + { + "name": "Cleanup semantics", + "description": "Removing only the Microsoft Sentinel data connector does not remove its DCR, DCE, diagnostic setting, Event Grid subscription, queues, or role assignments. One-click deletion is intentionally not offered. Remove resources sharing the connector's deterministic instance key, but do not delete the shared `CloudflareV2_CL` table or a system topic still used by another collector." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Prepare Azure Storage and Cloudflare Logpush", + "description": "Create an Azure Storage account and blob container, then configure Cloudflare Logpush to write to that container. Follow [Create a storage account](https://learn.microsoft.com/azure/storage/common/storage-account-create), [Create a container](https://learn.microsoft.com/azure/storage/blobs/blob-containers-portal), and [Configure the Cloudflare Azure destination](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/)." + }, + { + "title": "2. Add and review Cloudflare collectors", + "description": "Select **Add new collector** for each immutable Cloudflare account and storage container combination. Redeploying the same values updates the same isolated resources instead of creating a duplicate.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ { - "name": "WorkerScriptName", - "type": "string" + "columnName": "Connector", + "columnValue": "name" }, { - "name": "WorkerStatus", - "type": "string" + "columnName": "Cloudflare account", + "columnValue": "properties.addOnAttributes.CloudflareAccountName" }, { - "name": "WorkerSubrequest", - "type": "boolean" + "columnName": "Cloudflare account ID", + "columnValue": "properties.addOnAttributes.CloudflareAccountId" }, { - "name": "WorkerSubrequestCount", - "type": "int" + "columnName": "Queue URI", + "columnValue": "properties.request.QueueUri" }, { - "name": "WorkerWallTimeUs", - "type": "int" + "columnName": "Stream", + "columnValue": "properties.dcrConfig.streamName" }, { - "name": "ZoneName", - "type": "string" + "columnName": "DCR immutable ID", + "columnValue": "properties.dcrConfig.dataCollectionRuleImmutableId" + } + ] + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Cleanup is a deliberate manual operation in this phase. Use the 13-character instance key at the end of the connector name to identify its DCR, DCE, diagnostic setting, Event Grid subscription, queues, and role assignments. Preserve the shared CloudflareV2_CL table and any Event Grid system topic used by another collector.", + "visible": true, + "inline": true + } + }, + { + "type": "ContextPane", + "parameters": { + "contextPaneType": "DataConnectorsContextPane", + "title": "Add a Cloudflare collector", + "subtitle": "Cloudflare Logpush through Azure Blob Storage", + "label": "Add new collector", + "isPrimary": true, + "instructionSteps": [ + { + "instructions": [ + { + "type": "ServicePrincipalIDTextBox_test", + "parameters": { + "tenantId": "[subscription().tenantId]", + "name": "principalId", + "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Cloudflare account ID", + "placeholder": "Enter the immutable Cloudflare account ID", + "description": "Used with the storage and workspace identity to derive deterministic Azure resource names. Do not enter an API token or other secret.", + "type": "text", + "name": "CloudflareAccountId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Cloudflare account display name", + "placeholder": "For example, Contoso Production", + "description": "A friendly label shown in the connections grid and retained on ingested records. It is not used directly in Azure resource names.", + "type": "text", + "name": "CloudflareAccountName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account name", + "placeholder": "Enter the Azure Storage account name", + "type": "text", + "name": "StorageAccountName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Blob container name", + "placeholder": "Enter the blob container name", + "type": "text", + "name": "ContainerName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account resource group", + "placeholder": "Enter the resource group name", + "type": "text", + "name": "StorageAccountResourceGroupName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Storage account subscription ID", + "placeholder": "Enter the subscription GUID", + "type": "text", + "name": "StorageAccountSubscription", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Existing Event Grid system topic name (optional)", + "placeholder": "Leave blank for the first collector on this storage account", + "description": "Azure Event Grid supports one system topic for a storage account. Leave blank to create or reuse this connector's deterministic topic. If another integration already owns the storage account's system topic, enter that topic name so only a new per-instance event subscription is added.", + "type": "text", + "name": "EGSystemTopicName", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Custom log table name (optional)", + "placeholder": "Leave blank to use CloudflareV2_CL", + "description": "Name of the Log Analytics custom table this collector writes to. Must end in _CL. Leave blank to use the solution default CloudflareV2_CL. Each collector instance may target its own table; instances that share a table name share that table.", + "type": "text", + "name": "TableName", + "validations": { + "required": false, + "regex": "^$|^[A-Za-z][A-Za-z0-9_]{0,42}_CL$", + "message": "Table name must start with a letter, contain only letters, digits and underscores, and end with _CL." + } + } + } + ] } ] } + } + ] + } + ], + "isConnectivityCriteriasMatchSome": false + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Cloudflare", + "email": "[variables('_email')]" + }, + "support": { + "name": "Cloudflare", + "email": "support@cloudflare.com", + "tier": "Partner", + "link": "https://support.cloudflare.com" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", + "location": "[variables('workspaceLocationEffective')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "connectorDefinitionName": { + "defaultValue": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "principalId": { + "defaultValue": "principalId", + "type": "securestring", + "minLength": 1 + }, + "CloudflareAccountId": { + "defaultValue": "CloudflareAccountId", + "type": "securestring", + "minLength": 1 + }, + "CloudflareAccountName": { + "defaultValue": "CloudflareAccountName", + "type": "securestring", + "minLength": 1 + }, + "StorageAccountName": { + "defaultValue": "StorageAccountName", + "type": "securestring", + "minLength": 1 + }, + "ContainerName": { + "defaultValue": "ContainerName", + "type": "securestring", + "minLength": 1 + }, + "StorageAccountResourceGroupName": { + "defaultValue": "StorageAccountResourceGroupName", + "type": "securestring", + "minLength": 1 + }, + "StorageAccountSubscription": { + "defaultValue": "StorageAccountSubscription", + "type": "securestring", + "minLength": 1 + }, + "EGSystemTopicName": { + "defaultValue": "", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "forceUpdateTag": { + "type": "securestring", + "defaultValue": "[[utcNow()]", + "metadata": { + "description": "Forces the bounded RBAC propagation buffer to run whenever the same deterministic collector is submitted again." + } + }, + "TableName": { + "defaultValue": "", + "type": "securestring" + } + }, + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]", + "resourcePrefix": "cloudflare", + "queuePrefix": "cf", + "tableNameDefault": "CloudflareV2_CL", + "tableName": "[[if(empty(trim(parameters('TableName'))), variables('tableNameDefault'), trim(parameters('TableName')))]", + "outputStreamName": "[[concat('Custom-', variables('tableName'))]", + "workspaceResourceId": "[[resourceId('Microsoft.OperationalInsights/workspaces', parameters('innerWorkspace'))]", + "instanceKey": "[[uniqueString(toLower(trim(parameters('CloudflareAccountId'))), toLower(trim(parameters('StorageAccountSubscription'))), toLower(trim(parameters('StorageAccountResourceGroupName'))), toLower(trim(parameters('StorageAccountName'))), toLower(trim(parameters('ContainerName'))), toLower(variables('workspaceResourceId')))]", + "connectorName": "[[format('{0}-{1}', variables('resourcePrefix'), variables('instanceKey'))]", + "dceName": "[[format('{0}-{1}', variables('resourcePrefix'), variables('instanceKey'))]", + "dcrName": "[[format('{0}-{1}', variables('resourcePrefix'), variables('instanceKey'))]", + "diagnosticSettingName": "[[format('{0}-{1}-logerrors', variables('resourcePrefix'), variables('instanceKey'))]", + "storageAccountName": "[[toLower(trim(parameters('StorageAccountName')))]", + "blobContainerName": "[[toLower(trim(parameters('ContainerName')))]", + "queueName": "[[format('{0}-{1}-notification', variables('queuePrefix'), variables('instanceKey'))]", + "dlqName": "[[format('{0}-{1}-dlq', variables('queuePrefix'), variables('instanceKey'))]", + "storageAccountId": "[[resourceId(trim(parameters('StorageAccountSubscription')), trim(parameters('StorageAccountResourceGroupName')), 'Microsoft.Storage/storageAccounts', variables('storageAccountName'))]", + "blobContainerResourceId": "[[resourceId(trim(parameters('StorageAccountSubscription')), trim(parameters('StorageAccountResourceGroupName')), 'Microsoft.Storage/storageAccounts/blobServices/containers', variables('storageAccountName'), 'default', variables('blobContainerName'))]", + "notificationQueueResourceId": "[[resourceId(trim(parameters('StorageAccountSubscription')), trim(parameters('StorageAccountResourceGroupName')), 'Microsoft.Storage/storageAccounts/queueServices/queues', variables('storageAccountName'), 'default', variables('queueName'))]", + "dlqResourceId": "[[resourceId(trim(parameters('StorageAccountSubscription')), trim(parameters('StorageAccountResourceGroupName')), 'Microsoft.Storage/storageAccounts/queueServices/queues', variables('storageAccountName'), 'default', variables('dlqName'))]", + "eventGridSystemTopicDefaultName": "[[format('sentinel-{0}-{1}', variables('resourcePrefix'), uniqueString(toLower(trim(parameters('StorageAccountSubscription'))), toLower(trim(parameters('StorageAccountResourceGroupName'))), variables('storageAccountName')))]", + "eventGridSystemTopicName": "[[if(empty(parameters('EGSystemTopicName')), variables('eventGridSystemTopicDefaultName'), parameters('EGSystemTopicName'))]", + "eventGridSubscriptionName": "[[format('{0}-{1}-blobcreated', variables('resourcePrefix'), variables('instanceKey'))]", + "createEventGridSystemTopic": "[[empty(parameters('EGSystemTopicName'))]", + "storageBlobContributorRoleId": "[[subscriptionResourceId(trim(parameters('StorageAccountSubscription')), 'Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "storageQueueContributorRoleId": "[[subscriptionResourceId(trim(parameters('StorageAccountSubscription')), 'Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "blobRaGuid": "[[guid(variables('blobContainerResourceId'), parameters('principalId'), variables('storageBlobContributorRoleId'))]", + "notificationQueueRaGuid": "[[guid(variables('notificationQueueResourceId'), parameters('principalId'), variables('storageQueueContributorRoleId'))]", + "dlqRaGuid": "[[guid(variables('dlqResourceId'), parameters('principalId'), variables('storageQueueContributorRoleId'))]", + "dceResourceId": "[[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]", + "dcrResourceId": "[[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]", + "tableResourceId": "[[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('innerWorkspace'), variables('tableName'))]", + "storageNestedDeploymentName": "[[format('{0}-{1}-storage', variables('resourcePrefix'), variables('instanceKey'))]", + "storageNestedDeploymentId": "[[resourceId(trim(parameters('StorageAccountSubscription')), trim(parameters('StorageAccountResourceGroupName')), 'Microsoft.Resources/deployments', variables('storageNestedDeploymentName'))]", + "rbacPropagationScriptName": "[[format('{0}-{1}-rbac', variables('resourcePrefix'), variables('instanceKey'))]", + "rbacPropagationScriptId": "[[resourceId('Microsoft.Resources/deploymentScripts', variables('rbacPropagationScriptName'))]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, - "destinations": { - "logAnalytics": [ - { - "workspaceResourceId": "[variables('workspaceResourceId')]", - "name": "clv2ws1" - } - ] + "author": { + "name": "Cloudflare", + "email": "[variables('_email')]" }, - "dataFlows": [ - { - "streams": [ - "Custom-Cloudflare" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | extend TimeGenerated = now(), NELType = Type | project-away Type | project TimeGenerated, NELType, AccountID, BytesReceived, BytesSent, ClientTCPHandshakeDurationMs, ClientTLSCipher, ClientTLSHandshakeDurationMs, ClientTLSVersion, ConnectionCloseReason, ConnectionReuse, DestinationTunnelID, DetectedProtocol, DeviceID, DeviceName, EgressColoName, EgressIP, EgressPort, EgressRuleID, EgressRuleName, Email, IngressColoName, Offramp, OriginIP, OriginPort, OriginTLSCertificateIssuer, OriginTLSCertificateValidationResult, OriginTLSCipher, OriginTLSVersion, Protocol, RegistrationID, RuleEvaluationDurationMs, SessionEndTime, SessionID, SessionStartTime, SourceIP, SourceInternalIP, SourcePort, UserID, CPUTimeMs, DispatchNamespace, Entrypoint, Event, EventTimestampMs, EventType, Exceptions, Logs, Outcome, ScriptName, ScriptTags, ScriptVersion, WallTimeMs, ClientAddress, Error, PTY, Payload, ProgramFinishDatetime, ProgramID, ProgramStartDatetime, ProgramType, ServerAddress, SessionFinishDatetime, SessionStartDatetime, TargetID, UserEmail, Username, Body, BodyLength, DestAddr, Headers, Host, Method, Password, R2Path, Referrer, SinkholeID, SrcAddr, Timestamp, URI, URL, UserAgent, AttackCampaignID, AttackID, AttackVector, ColoCity, ColoCode, ColoCountry, ColoGeoHash, ColoName, Datetime, DestinationASN, DestinationASNName, DestinationCountry, DestinationGeoHash, DestinationPort, Direction, GREChecksum, GREEtherType, GREHeaderLength, GREKey, GRESequenceNumber, GREVersion, ICMPChecksum, ICMPCode, ICMPType, IPDestinationAddress, IPDestinationSubnet, IPFragmentOffset, IPHeaderLength, IPMoreFragments, IPProtocol, IPProtocolName, IPSourceAddress, IPSourceSubnet, IPTTL, IPTTLBuckets, IPTotalLength, IPTotalLengthBuckets, IPv4Checksum, IPv4DSCP, IPv4DontFragment, IPv4ECN, IPv4Identification, IPv4Options, IPv6DSCP, IPv6ECN, IPv6ExtensionHeaders, IPv6FlowLabel, IPv6Identification, MitigationReason, MitigationScope, MitigationSystem, ProtocolState, RuleID, RuleName, RulesetID, RulesetOverrideID, SampleInterval, SourceASN, SourceASNName, SourceCountry, SourceGeoHash, TCPAcknowledgementNumber, TCPChecksum, TCPDataOffset, TCPFlags, TCPFlagsString, TCPMSS, TCPOptions, TCPSACKBlocks, TCPSACKPermitted, TCPSequenceNumber, TCPTimestampECR, TCPTimestampValue, TCPUrgentPointer, TCPWindowScale, TCPWindowSize, UDPChecksum, UDPPayloadLength, Verdict, Action, DestinationIP, SignatureID, SignatureMessage, SignatureRevision, ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, OverrideIP, OverridePort, PolicyID, PolicyName, ProxyEndpoint, SNI, SourceIPContinentCode, SourceIPCountryCode, TransportProtocol, VirtualNetworkID, VirtualNetworkName, BlockedFileHash, BlockedFileName, BlockedFileReason, BlockedFileSize, BlockedFileType, DownloadMatchedDlpProfileEntries, DownloadMatchedDlpProfiles, DownloadedFileNames, FileInfo, ForensicCopyStatus, HTTPHost, HTTPMethod, HTTPStatusCode, HTTPVersion, IsIsolated, PrivateAppAUD, Quarantined, RedirectTargetURI, Referer, RequestID, UntrustedCertificateAction, UploadMatchedDlpProfileEntries, UploadMatchedDlpProfiles, UploadedFileNames, AuthoritativeNameServerIPs, CNAMECategoryIDs, CNAMECategoryNames, CNAMEs, CNAMEsReversed, ColoID, CustomResolveDurationMs, CustomResolverAddress, CustomResolverPolicyID, CustomResolverPolicyName, CustomResolverResponse, DoHSubdomain, DoTSubdomain, DstIP, DstPort, EDEErrors, InitialCategoryIDs, InitialCategoryNames, InitialResolvedIPs, InternalDNSFallbackStrategy, InternalDNSRCode, InternalDNSViewID, InternalDNSZoneID, IsResponseCached, Location, LocationID, MatchedCategoryIDs, MatchedCategoryNames, MatchedIndicatorFeedIDs, MatchedIndicatorFeedNames, QueryCategoryIDs, QueryCategoryNames, QueryID, QueryIndicatorFeedIDs, QueryIndicatorFeedNames, QueryName, QueryNameReversed, QuerySize, QueryType, QueryTypeName, RCode, RData, RequestContextCategoryIDs, RequestContextCategoryNames, ResolvedIPCategoryIDs, ResolvedIPCategoryNames, ResolvedIPContinentCodes, ResolvedIPCountryCodes, ResolverDecision, ResourceRecords, ResourceRecordsJSON, SrcIP, SrcIPContinentCode, SrcIPCountryCode, SrcPort, TimeZone, TimeZoneInferredMethod, AlertID, AlertReasons, Attachments, CC, CCName, FinalDisposition, From, FromName, Links, MessageDeliveryMode, MessageID, Origin, OriginalSender, ReplyTo, ReplyToName, SMTPEnvelopeFrom, SMTPEnvelopeTo, SMTPHeloServerIP, SMTPHeloServerIPAsName, SMTPHeloServerIPAsNumber, SMTPHeloServerIPGeo, SMTPHeloServerName, Subject, ThreatCategories, To, ToName, ClientResponseCode, ClusterID, EDNSSubnet, EDNSSubnetLength, QueryDO, QueryRD, QueryTCP, ResponseCached, ResponseCachedStale, ResponseReason, UpstreamIP, UpstreamResponseCode, UpstreamResponseTimeMs, ForensicCopyID, GatewayRequestID, Phase, TriggeredRuleID, ClientVersion, DeviceManufacturer, DeviceModel, DeviceSerialNumber, DeviceType, OSVersion, PostureCheckName, PostureCheckType, PostureEvaluatedResult, PostureExpectedJSON, PostureReceivedJSON, UserUID, AssetDisplayName, AssetExternalID, AssetLink, AssetMetadata, DetectedTimestamp, FindingTypeDisplayName, FindingTypeID, FindingTypeSeverity, InstanceID, IntegrationDisplayName, IntegrationID, IntegrationPolicyVendor, Decision, DomainName, ActionResult, ActionType, ActorEmail, ActorID, ActorIP, ActorType, ID, Interface, Metadata, NewValue, OldValue, OwnerID, ResourceID, ResourceType, When, Allowed, AppDomain, AppUUID, Connection, Country, CreatedAt, IPAddress, PurposeJustificationPrompt, PurposeJustificationResponse, RayID, TemporaryAccessApprovers, TemporaryAccessDuration, ClientASN, ClientASNDescription, ClientCountry, ClientIP, ClientIPClass, ClientRefererHost, ClientRefererPath, ClientRefererQuery, ClientRefererScheme, ClientRequestHost, ClientRequestMethod, ClientRequestPath, ClientRequestProtocol, ClientRequestQuery, ClientRequestScheme, ClientRequestUserAgent, ContentScanObjResults, ContentScanObjSizes, ContentScanObjTypes, Description, EdgeColoCode, EdgeResponseStatus, Kind, LeakedCredentialCheckResult, MatchIndex, OriginResponseStatus, OriginatorRayID, Ref, BotDetectionIDs, BotDetectionTags, BotScore, BotScoreSrc, BotTags, CacheCacheStatus, CacheReserveUsed, CacheResponseBytes, CacheResponseStatus, CacheTieredFill, ClientCity, ClientDeviceType, ClientLatitude, ClientLongitude, ClientMTLSAuthCertFingerprint, ClientMTLSAuthStatus, ClientRegionCode, ClientRequestBytes, ClientRequestReferer, ClientRequestSource, ClientRequestURI, ClientSSLCipher, ClientSSLProtocol, ClientSrcPort, ClientTCPRTTMs, ClientXRequestedWith, Cookies, EdgeCFConnectingO2O, EdgeColoID, EdgeEndTimestamp, EdgePathingOp, EdgePathingSrc, EdgePathingStatus, EdgeRequestHost, EdgeResponseBodyBytes, EdgeResponseBytes, EdgeResponseCompressionRatio, EdgeResponseContentType, EdgeServerIP, EdgeStartTimestamp, EdgeTimeToFirstByteMs, JA3Hash, JA4, JA4Signals, OriginDNSResponseTimeMs, OriginRequestHeaderSendDurationMs, OriginResponseBytes, OriginResponseDurationMs, OriginResponseHTTPExpires, OriginResponseHTTPLastModified, OriginResponseHeaderReceiveDurationMs, OriginSSLProtocol, OriginTCPHandshakeDurationMs, OriginTLSHandshakeDurationMs, ParentRayID, RequestHeaders, ResponseHeaders, SecurityAction, SecurityRuleDescription, SecurityRuleID, SecuritySources, SmartRouteColoID, UpperTierColoID, WAFAttackScore, WAFRCEAttackScore, WAFSQLiAttackScore, WAFXSSAttackScore, WorkerCPUTime, WorkerScriptName, WorkerStatus, WorkerSubrequest, WorkerSubrequestCount, WorkerWallTimeUs, ZoneName, ClientIPASN, ClientIPASNDescription, ClientIPCountry, LastKnownGoodColoCode, CSPDirective, PageURL, URLContainsCDNCGIPath, URLHost, Application, ClientBytes, ClientMatchedIpFirewall, ClientPort, ClientProto, ClientTcpRtt, ClientTlsClientHelloServerName, ClientTlsProtocol, ClientTlsStatus, ConnectTimestamp, DisconnectTimestamp, IpFirewall, OriginBytes, OriginProto, OriginTcpRtt, OriginTlsFingerprint, OriginTlsMode, OriginTlsProtocol, OriginTlsStatus, ProxyProtocol, Status, EventDetails, IP, Source, SecurityActions, SecurityRuleIDs, Transport", - "outputStream": "Custom-CloudflareV2_CL" - } - ] + "support": { + "name": "Cloudflare", + "email": "support@cloudflare.com", + "tier": "Partner", + "link": "https://support.cloudflare.com" + } } }, { - "name": "CloudflareV2_CL", - "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "[parameters('workspace-location')]", - "kind": null, + "apiVersion": "2022-10-01", + "name": "[[concat(parameters('innerWorkspace'), '/', variables('tableName'))]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "schema": { - "name": "CloudflareV2_CL", + "name": "[[variables('tableName')]", "columns": [ { "name": "TimeGenerated", "type": "datetime" }, + { + "name": "CloudflareAccountId", + "type": "string" + }, + { + "name": "CloudflareAccountName", + "type": "string" + }, { "name": "AccountID", "type": "string" @@ -4398,464 +4936,2309 @@ { "name": "WorkerScriptName", "type": "string" - }, - { - "name": "WorkerStatus", - "type": "string" - }, - { - "name": "WorkerSubrequest", - "type": "boolean" - }, - { - "name": "WorkerSubrequestCount", - "type": "int" - }, - { - "name": "WorkerWallTimeUs", - "type": "int" - }, - { - "name": "ZoneName", - "type": "string" - } - ] - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "version": "[variables('dataConnectorCCPVersion')]" - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", - "apiVersion": "2022-09-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", - "location": "[parameters('workspace-location')]", - "kind": "Customizable", - "properties": { - "connectorUiConfig": { - "id": "CloudflareDefinition", - "title": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)", - "publisher": "Microsoft", - "descriptionMarkdown": " The Cloudflare data connector provides the capability to ingest Cloudflare logs into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/)for more information.\n\nNOTE: The Cloudflare (Using Blob Container) (via Codeless Connector Framework) data connector available in the solution requires the Azure Blob Storage account and the Microsoft Sentinel workspace to be in the same Azure subscription and the same Resource Group. Deploying across different subscriptions or resource groups may result in errors such as CreateDataFlowResources not defined during connector configuration.
", - "graphQueriesTableName": "CloudflareV2_CL", - "graphQueries": [ - { - "metricName": "Total events received", - "legend": "Cloudflare logs", - "baseQuery": "{{graphQueriesTableName}}" - } - ], - "sampleQueries": [ - { - "description": "Cloudflare Logs", - "query": "{{graphQueriesTableName}}\n | take 10" - } - ], - "dataTypes": [ - { - "name": "{{graphQueriesTableName}}", - "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max(TimeGenerated)\n|where isnotempty(Time)" - } - ], - "connectivityCriteria": [ - { - "type": "HasDataConnectors" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and Write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true, - "action": false + }, + { + "name": "WorkerStatus", + "type": "string" + }, + { + "name": "WorkerSubrequest", + "type": "boolean" + }, + { + "name": "WorkerSubrequestCount", + "type": "int" + }, + { + "name": "WorkerWallTimeUs", + "type": "int" + }, + { + "name": "ZoneName", + "type": "string" + } + ] } } - ], - "customs": [ - { - "name": "Create a storage account and a container", - "description": "Before setting up logpush in Cloudflare, first create a storage account and a container in Microsoft Azure. Use [this guide](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) to know more about Container and Blob. Follow the steps in the [documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal) to create an Azure Storage account." - }, - { - "name": "Generate a Blob SAS URL", - "description": "Create and Write permissions are required. Refer the [documentation](https://learn.microsoft.com/en-us/azure/ai-services/translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers) to know more about Blob SAS token and url." - }, - { - "name": "Collecting logs from Cloudflare to your Blob container", - "description": "Follow the steps in the [documentation](https://developers.cloudflare.com/logs/get-started/enable-destinations/azure/) for collecting logs from Cloudflare to your Blob container." + }, + { + "type": "Microsoft.Insights/dataCollectionEndpoints", + "apiVersion": "2022-06-01", + "name": "[[variables('dceName')]", + "location": "[variables('workspaceLocationEffective')]", + "dependsOn": [ + "[[variables('tableResourceId')]" + ], + "properties": { + "networkAcls": { + "publicNetworkAccess": "Enabled" + } } - ] - }, - "instructionSteps": [ + }, { - "title": "Connect Cloudflare Logs to Microsoft Sentinel", - "description": "To enable Cloudflare logs for Microsoft Sentinel, provide the required information below and click on Connect.\n>", - "instructions": [ - { - "parameters": { - "tenantId": "[subscription().tenantId]", - "name": "principalId", - "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f" - }, - "type": "ServicePrincipalIDTextBox_test" - }, - { - "parameters": { - "label": "The Blob container's URL you want to collect data from", - "type": "text", - "name": "blobContainerUri", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account resource group name", - "type": "text", - "name": "StorageAccountResourceGroupName", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account location", - "type": "text", - "name": "StorageAccountLocation", - "validations": { - "required": true - } - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "The Blob container's storage account subscription id", - "type": "text", - "name": "StorageAccountSubscription", - "validations": { - "required": true - } - }, - "type": "Textbox" + "type": "Microsoft.Insights/dataCollectionRules", + "apiVersion": "2022-06-01", + "name": "[[variables('dcrName')]", + "location": "[variables('workspaceLocationEffective')]", + "dependsOn": [ + "[[variables('dceResourceId')]", + "[[variables('tableResourceId')]" + ], + "properties": { + "dataCollectionEndpointId": "[[variables('dceResourceId')]", + "streamDeclarations": { + "Custom-Cloudflare": { + "columns": [ + { + "name": "AccountID", + "type": "string" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ActionResult", + "type": "boolean" + }, + { + "name": "ActionType", + "type": "string" + }, + { + "name": "ActorEmail", + "type": "string" + }, + { + "name": "ActorID", + "type": "string" + }, + { + "name": "ActorIP", + "type": "string" + }, + { + "name": "ActorType", + "type": "string" + }, + { + "name": "AlertID", + "type": "string" + }, + { + "name": "AlertReasons", + "type": "string" + }, + { + "name": "Allowed", + "type": "boolean" + }, + { + "name": "AppDomain", + "type": "string" + }, + { + "name": "Application", + "type": "string" + }, + { + "name": "ApplicationIDs", + "type": "dynamic" + }, + { + "name": "ApplicationNames", + "type": "dynamic" + }, + { + "name": "AppUUID", + "type": "string" + }, + { + "name": "AssetDisplayName", + "type": "string" + }, + { + "name": "AssetExternalID", + "type": "string" + }, + { + "name": "AssetLink", + "type": "string" + }, + { + "name": "AssetMetadata", + "type": "dynamic" + }, + { + "name": "Attachments", + "type": "string" + }, + { + "name": "AttackCampaignID", + "type": "string" + }, + { + "name": "AttackID", + "type": "string" + }, + { + "name": "AttackVector", + "type": "string" + }, + { + "name": "AuthoritativeNameServerIPs", + "type": "dynamic" + }, + { + "name": "BlockedFileHash", + "type": "string" + }, + { + "name": "BlockedFileName", + "type": "string" + }, + { + "name": "BlockedFileReason", + "type": "string" + }, + { + "name": "BlockedFileSize", + "type": "int" + }, + { + "name": "BlockedFileType", + "type": "string" + }, + { + "name": "Body", + "type": "dynamic" + }, + { + "name": "BodyLength", + "type": "int" + }, + { + "name": "BotDetectionIDs", + "type": "dynamic" + }, + { + "name": "BotDetectionTags", + "type": "dynamic" + }, + { + "name": "BotScore", + "type": "int" + }, + { + "name": "BotScoreSrc", + "type": "string" + }, + { + "name": "BotTags", + "type": "dynamic" + }, + { + "name": "BytesReceived", + "type": "int" + }, + { + "name": "BytesSent", + "type": "int" + }, + { + "name": "CacheCacheStatus", + "type": "string" + }, + { + "name": "CacheReserveUsed", + "type": "boolean" + }, + { + "name": "CacheResponseBytes", + "type": "int" + }, + { + "name": "CacheResponseStatus", + "type": "int" + }, + { + "name": "CacheTieredFill", + "type": "boolean" + }, + { + "name": "CategoryIDs", + "type": "dynamic" + }, + { + "name": "CategoryNames", + "type": "dynamic" + }, + { + "name": "CC", + "type": "string" + }, + { + "name": "CCName", + "type": "string" + }, + { + "name": "ClientAddress", + "type": "string" + }, + { + "name": "ClientASN", + "type": "int" + }, + { + "name": "ClientASNDescription", + "type": "string" + }, + { + "name": "ClientBytes", + "type": "int" + }, + { + "name": "ClientCity", + "type": "string" + }, + { + "name": "ClientCountry", + "type": "string" + }, + { + "name": "ClientDeviceType", + "type": "string" + }, + { + "name": "ClientIP", + "type": "string" + }, + { + "name": "ClientIPASN", + "type": "int" + }, + { + "name": "ClientIPASNDescription", + "type": "string" + }, + { + "name": "ClientIPClass", + "type": "string" + }, + { + "name": "ClientIPCountry", + "type": "string" + }, + { + "name": "ClientLatitude", + "type": "string" + }, + { + "name": "ClientLongitude", + "type": "string" + }, + { + "name": "ClientMatchedIpFirewall", + "type": "string" + }, + { + "name": "ClientMTLSAuthCertFingerprint", + "type": "string" + }, + { + "name": "ClientMTLSAuthStatus", + "type": "string" + }, + { + "name": "ClientPort", + "type": "int" + }, + { + "name": "ClientProto", + "type": "string" + }, + { + "name": "ClientRefererHost", + "type": "string" + }, + { + "name": "ClientRefererPath", + "type": "string" + }, + { + "name": "ClientRefererQuery", + "type": "string" + }, + { + "name": "ClientRefererScheme", + "type": "string" + }, + { + "name": "ClientRegionCode", + "type": "string" + }, + { + "name": "ClientRequestBytes", + "type": "int" + }, + { + "name": "ClientRequestHost", + "type": "string" + }, + { + "name": "ClientRequestMethod", + "type": "string" + }, + { + "name": "ClientRequestPath", + "type": "string" + }, + { + "name": "ClientRequestProtocol", + "type": "string" + }, + { + "name": "ClientRequestQuery", + "type": "string" + }, + { + "name": "ClientRequestReferer", + "type": "string" + }, + { + "name": "ClientRequestScheme", + "type": "string" + }, + { + "name": "ClientRequestSource", + "type": "string" + }, + { + "name": "ClientRequestURI", + "type": "string" + }, + { + "name": "ClientRequestUserAgent", + "type": "string" + }, + { + "name": "ClientResponseCode", + "type": "int" + }, + { + "name": "ClientSrcPort", + "type": "int" + }, + { + "name": "ClientSSLCipher", + "type": "string" + }, + { + "name": "ClientSSLProtocol", + "type": "string" + }, + { + "name": "ClientTCPHandshakeDurationMs", + "type": "int" + }, + { + "name": "ClientTcpRtt", + "type": "int" + }, + { + "name": "ClientTCPRTTMs", + "type": "int" + }, + { + "name": "ClientTLSCipher", + "type": "string" + }, + { + "name": "ClientTlsClientHelloServerName", + "type": "string" + }, + { + "name": "ClientTLSHandshakeDurationMs", + "type": "int" + }, + { + "name": "ClientTlsProtocol", + "type": "string" + }, + { + "name": "ClientTlsStatus", + "type": "string" + }, + { + "name": "ClientTLSVersion", + "type": "string" + }, + { + "name": "ClientVersion", + "type": "string" + }, + { + "name": "ClientXRequestedWith", + "type": "string" + }, + { + "name": "ClusterID", + "type": "string" + }, + { + "name": "CNAMECategoryIDs", + "type": "dynamic" + }, + { + "name": "CNAMECategoryNames", + "type": "dynamic" + }, + { + "name": "CNAMEs", + "type": "dynamic" + }, + { + "name": "CNAMEsReversed", + "type": "dynamic" + }, + { + "name": "ColoCity", + "type": "string" + }, + { + "name": "ColoCode", + "type": "string" + }, + { + "name": "ColoCountry", + "type": "string" + }, + { + "name": "ColoGeoHash", + "type": "string" + }, + { + "name": "ColoID", + "type": "int" + }, + { + "name": "ColoName", + "type": "string" + }, + { + "name": "Connection", + "type": "string" + }, + { + "name": "ConnectionCloseReason", + "type": "string" + }, + { + "name": "ConnectionReuse", + "type": "boolean" + }, + { + "name": "ConnectTimestamp", + "type": "string" + }, + { + "name": "ContentScanObjResults", + "type": "dynamic" + }, + { + "name": "ContentScanObjSizes", + "type": "dynamic" + }, + { + "name": "ContentScanObjTypes", + "type": "dynamic" + }, + { + "name": "Cookies", + "type": "dynamic" + }, + { + "name": "Country", + "type": "string" + }, + { + "name": "CPUTimeMs", + "type": "int" + }, + { + "name": "CreatedAt", + "type": "string" + }, + { + "name": "CSPDirective", + "type": "string" + }, + { + "name": "CustomResolveDurationMs", + "type": "int" + }, + { + "name": "CustomResolverAddress", + "type": "string" + }, + { + "name": "CustomResolverPolicyID", + "type": "string" + }, + { + "name": "CustomResolverPolicyName", + "type": "string" + }, + { + "name": "CustomResolverResponse", + "type": "string" + }, + { + "name": "Datetime", + "type": "string" + }, + { + "name": "Decision", + "type": "string" + }, + { + "name": "Description", + "type": "string" + }, + { + "name": "DestAddr", + "type": "string" + }, + { + "name": "DestinationASN", + "type": "int" + }, + { + "name": "DestinationASNName", + "type": "string" + }, + { + "name": "DestinationCountry", + "type": "string" + }, + { + "name": "DestinationGeoHash", + "type": "string" + }, + { + "name": "DestinationIP", + "type": "string" + }, + { + "name": "DestinationIPContinentCode", + "type": "string" + }, + { + "name": "DestinationIPCountryCode", + "type": "string" + }, + { + "name": "DestinationPort", + "type": "int" + }, + { + "name": "DestinationTunnelID", + "type": "string" + }, + { + "name": "DetectedProtocol", + "type": "string" + }, + { + "name": "DetectedTimestamp", + "type": "string" + }, + { + "name": "DeviceID", + "type": "string" + }, + { + "name": "DeviceManufacturer", + "type": "string" + }, + { + "name": "DeviceModel", + "type": "string" + }, + { + "name": "DeviceName", + "type": "string" + }, + { + "name": "DeviceSerialNumber", + "type": "string" + }, + { + "name": "DeviceType", + "type": "string" + }, + { + "name": "Direction", + "type": "string" + }, + { + "name": "DisconnectTimestamp", + "type": "string" + }, + { + "name": "DispatchNamespace", + "type": "string" + }, + { + "name": "DoHSubdomain", + "type": "string" + }, + { + "name": "DomainName", + "type": "string" + }, + { + "name": "DoTSubdomain", + "type": "string" + }, + { + "name": "DownloadedFileNames", + "type": "dynamic" + }, + { + "name": "DownloadMatchedDlpProfileEntries", + "type": "dynamic" + }, + { + "name": "DownloadMatchedDlpProfiles", + "type": "dynamic" + }, + { + "name": "DstIP", + "type": "string" + }, + { + "name": "DstPort", + "type": "int" + }, + { + "name": "EDEErrors", + "type": "dynamic" + }, + { + "name": "EdgeCFConnectingO2O", + "type": "boolean" + }, + { + "name": "EdgeColoCode", + "type": "string" + }, + { + "name": "EdgeColoID", + "type": "int" + }, + { + "name": "EdgeEndTimestamp", + "type": "string" + }, + { + "name": "EdgePathingOp", + "type": "string" + }, + { + "name": "EdgePathingSrc", + "type": "string" + }, + { + "name": "EdgePathingStatus", + "type": "string" + }, + { + "name": "EdgeRequestHost", + "type": "string" + }, + { + "name": "EdgeResponseBodyBytes", + "type": "int" + }, + { + "name": "EdgeResponseBytes", + "type": "int" + }, + { + "name": "EdgeResponseCompressionRatio", + "type": "real" + }, + { + "name": "EdgeResponseContentType", + "type": "string" + }, + { + "name": "EdgeResponseStatus", + "type": "int" + }, + { + "name": "EdgeServerIP", + "type": "string" + }, + { + "name": "EdgeStartTimestamp", + "type": "string" + }, + { + "name": "EdgeTimeToFirstByteMs", + "type": "int" + }, + { + "name": "EDNSSubnet", + "type": "string" + }, + { + "name": "EDNSSubnetLength", + "type": "int" + }, + { + "name": "EgressColoName", + "type": "string" + }, + { + "name": "EgressIP", + "type": "string" + }, + { + "name": "EgressPort", + "type": "int" + }, + { + "name": "EgressRuleID", + "type": "string" + }, + { + "name": "EgressRuleName", + "type": "string" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "Entrypoint", + "type": "string" + }, + { + "name": "Error", + "type": "string" + }, + { + "name": "Event", + "type": "string" + }, + { + "name": "EventDetails", + "type": "dynamic" + }, + { + "name": "EventTimestampMs", + "type": "int" + }, + { + "name": "EventType", + "type": "string" + }, + { + "name": "Exceptions", + "type": "string" + }, + { + "name": "FileInfo", + "type": "dynamic" + }, + { + "name": "FinalDisposition", + "type": "string" + }, + { + "name": "FindingTypeDisplayName", + "type": "string" + }, + { + "name": "FindingTypeID", + "type": "string" + }, + { + "name": "FindingTypeSeverity", + "type": "string" + }, + { + "name": "ForensicCopyID", + "type": "string" + }, + { + "name": "ForensicCopyStatus", + "type": "string" + }, + { + "name": "From", + "type": "string" + }, + { + "name": "FromName", + "type": "string" + }, + { + "name": "GatewayRequestID", + "type": "string" + }, + { + "name": "GREChecksum", + "type": "int" + }, + { + "name": "GREEtherType", + "type": "int" + }, + { + "name": "GREHeaderLength", + "type": "int" + }, + { + "name": "GREKey", + "type": "int" + }, + { + "name": "GRESequenceNumber", + "type": "int" + }, + { + "name": "GREVersion", + "type": "int" + }, + { + "name": "Headers", + "type": "dynamic" + }, + { + "name": "Host", + "type": "string" + }, + { + "name": "HTTPHost", + "type": "string" + }, + { + "name": "HTTPMethod", + "type": "string" + }, + { + "name": "HTTPStatusCode", + "type": "int" + }, + { + "name": "HTTPVersion", + "type": "string" + }, + { + "name": "ICMPChecksum", + "type": "int" + }, + { + "name": "ICMPCode", + "type": "int" + }, + { + "name": "ICMPType", + "type": "int" + }, + { + "name": "ID", + "type": "string" + }, + { + "name": "IngressColoName", + "type": "string" + }, + { + "name": "InitialCategoryIDs", + "type": "dynamic" + }, + { + "name": "InitialCategoryNames", + "type": "dynamic" + }, + { + "name": "InitialResolvedIPs", + "type": "dynamic" + }, + { + "name": "InstanceID", + "type": "string" + }, + { + "name": "IntegrationDisplayName", + "type": "string" + }, + { + "name": "IntegrationID", + "type": "string" + }, + { + "name": "IntegrationPolicyVendor", + "type": "string" + }, + { + "name": "Interface", + "type": "string" + }, + { + "name": "InternalDNSFallbackStrategy", + "type": "string" + }, + { + "name": "InternalDNSRCode", + "type": "int" + }, + { + "name": "InternalDNSViewID", + "type": "string" + }, + { + "name": "InternalDNSZoneID", + "type": "string" + }, + { + "name": "IP", + "type": "string" + }, + { + "name": "IPAddress", + "type": "string" + }, + { + "name": "IPDestinationAddress", + "type": "string" + }, + { + "name": "IPDestinationSubnet", + "type": "string" + }, + { + "name": "IpFirewall", + "type": "boolean" + }, + { + "name": "IPFragmentOffset", + "type": "int" + }, + { + "name": "IPHeaderLength", + "type": "int" + }, + { + "name": "IPMoreFragments", + "type": "int" + }, + { + "name": "IPProtocol", + "type": "int" + }, + { + "name": "IPProtocolName", + "type": "string" + }, + { + "name": "IPSourceAddress", + "type": "string" + }, + { + "name": "IPSourceSubnet", + "type": "string" + }, + { + "name": "IPTotalLength", + "type": "int" + }, + { + "name": "IPTotalLengthBuckets", + "type": "int" + }, + { + "name": "IPTTL", + "type": "int" + }, + { + "name": "IPTTLBuckets", + "type": "int" + }, + { + "name": "IPv4Checksum", + "type": "int" + }, + { + "name": "IPv4DontFragment", + "type": "int" + }, + { + "name": "IPv4DSCP", + "type": "int" + }, + { + "name": "IPv4ECN", + "type": "int" + }, + { + "name": "IPv4Identification", + "type": "int" + }, + { + "name": "IPv4Options", + "type": "string" + }, + { + "name": "IPv6DSCP", + "type": "int" + }, + { + "name": "IPv6ECN", + "type": "int" + }, + { + "name": "IPv6ExtensionHeaders", + "type": "string" + }, + { + "name": "IPv6FlowLabel", + "type": "int" + }, + { + "name": "IPv6Identification", + "type": "int" + }, + { + "name": "IsIsolated", + "type": "boolean" + }, + { + "name": "IsResponseCached", + "type": "boolean" + }, + { + "name": "JA3Hash", + "type": "string" + }, + { + "name": "JA4", + "type": "string" + }, + { + "name": "JA4Signals", + "type": "dynamic" + }, + { + "name": "Kind", + "type": "string" + }, + { + "name": "LastKnownGoodColoCode", + "type": "string" + }, + { + "name": "LeakedCredentialCheckResult", + "type": "string" + }, + { + "name": "Links", + "type": "string" + }, + { + "name": "Location", + "type": "string" + }, + { + "name": "LocationID", + "type": "string" + }, + { + "name": "Logs", + "type": "string" + }, + { + "name": "MatchedCategoryIDs", + "type": "dynamic" + }, + { + "name": "MatchedCategoryNames", + "type": "dynamic" + }, + { + "name": "MatchedIndicatorFeedIDs", + "type": "dynamic" + }, + { + "name": "MatchedIndicatorFeedNames", + "type": "dynamic" + }, + { + "name": "MatchIndex", + "type": "int" + }, + { + "name": "MessageDeliveryMode", + "type": "string" + }, + { + "name": "MessageID", + "type": "string" + }, + { + "name": "Metadata", + "type": "dynamic" + }, + { + "name": "Method", + "type": "string" + }, + { + "name": "MitigationReason", + "type": "string" + }, + { + "name": "MitigationScope", + "type": "string" + }, + { + "name": "MitigationSystem", + "type": "string" + }, + { + "name": "NewValue", + "type": "dynamic" + }, + { + "name": "Offramp", + "type": "string" + }, + { + "name": "OldValue", + "type": "dynamic" + }, + { + "name": "Origin", + "type": "string" + }, + { + "name": "OriginalSender", + "type": "string" + }, + { + "name": "OriginatorRayID", + "type": "string" + }, + { + "name": "OriginBytes", + "type": "int" + }, + { + "name": "OriginDNSResponseTimeMs", + "type": "int" + }, + { + "name": "OriginIP", + "type": "string" + }, + { + "name": "OriginPort", + "type": "int" + }, + { + "name": "OriginProto", + "type": "string" + }, + { + "name": "OriginRequestHeaderSendDurationMs", + "type": "int" + }, + { + "name": "OriginResponseBytes", + "type": "int" + }, + { + "name": "OriginResponseDurationMs", + "type": "int" + }, + { + "name": "OriginResponseHeaderReceiveDurationMs", + "type": "int" + }, + { + "name": "OriginResponseHTTPExpires", + "type": "string" + }, + { + "name": "OriginResponseHTTPLastModified", + "type": "string" + }, + { + "name": "OriginResponseStatus", + "type": "int" + }, + { + "name": "OriginSSLProtocol", + "type": "string" + }, + { + "name": "OriginTCPHandshakeDurationMs", + "type": "int" + }, + { + "name": "OriginTcpRtt", + "type": "int" + }, + { + "name": "OriginTLSCertificateIssuer", + "type": "string" + }, + { + "name": "OriginTLSCertificateValidationResult", + "type": "string" + }, + { + "name": "OriginTLSCipher", + "type": "string" + }, + { + "name": "OriginTlsFingerprint", + "type": "string" + }, + { + "name": "OriginTLSHandshakeDurationMs", + "type": "int" + }, + { + "name": "OriginTlsMode", + "type": "string" + }, + { + "name": "OriginTlsProtocol", + "type": "string" + }, + { + "name": "OriginTlsStatus", + "type": "string" + }, + { + "name": "OriginTLSVersion", + "type": "string" + }, + { + "name": "OSVersion", + "type": "string" + }, + { + "name": "Outcome", + "type": "string" + }, + { + "name": "OverrideIP", + "type": "string" + }, + { + "name": "OverridePort", + "type": "int" + }, + { + "name": "OwnerID", + "type": "string" + }, + { + "name": "PageURL", + "type": "string" + }, + { + "name": "ParentRayID", + "type": "string" + }, + { + "name": "Password", + "type": "string" + }, + { + "name": "Payload", + "type": "string" + }, + { + "name": "Phase", + "type": "string" + }, + { + "name": "PolicyID", + "type": "string" + }, + { + "name": "PolicyName", + "type": "string" + }, + { + "name": "PostureCheckName", + "type": "string" + }, + { + "name": "PostureCheckType", + "type": "string" + }, + { + "name": "PostureEvaluatedResult", + "type": "boolean" + }, + { + "name": "PostureExpectedJSON", + "type": "dynamic" + }, + { + "name": "PostureReceivedJSON", + "type": "dynamic" + }, + { + "name": "PrivateAppAUD", + "type": "string" + }, + { + "name": "ProgramFinishDatetime", + "type": "string" + }, + { + "name": "ProgramID", + "type": "string" + }, + { + "name": "ProgramStartDatetime", + "type": "string" + }, + { + "name": "ProgramType", + "type": "string" + }, + { + "name": "Protocol", + "type": "string" + }, + { + "name": "ProtocolState", + "type": "string" + }, + { + "name": "ProxyEndpoint", + "type": "string" + }, + { + "name": "ProxyProtocol", + "type": "string" + }, + { + "name": "PTY", + "type": "string" + }, + { + "name": "PurposeJustificationPrompt", + "type": "string" + }, + { + "name": "PurposeJustificationResponse", + "type": "string" + }, + { + "name": "Quarantined", + "type": "boolean" + }, + { + "name": "QueryCategoryIDs", + "type": "dynamic" + }, + { + "name": "QueryCategoryNames", + "type": "dynamic" + }, + { + "name": "QueryDO", + "type": "boolean" + }, + { + "name": "QueryID", + "type": "string" + }, + { + "name": "QueryIndicatorFeedIDs", + "type": "dynamic" + }, + { + "name": "QueryIndicatorFeedNames", + "type": "dynamic" + }, + { + "name": "QueryName", + "type": "string" + }, + { + "name": "QueryNameReversed", + "type": "string" + }, + { + "name": "QueryRD", + "type": "boolean" + }, + { + "name": "QuerySize", + "type": "int" + }, + { + "name": "QueryTCP", + "type": "boolean" + }, + { + "name": "QueryType", + "type": "int" + }, + { + "name": "QueryTypeName", + "type": "string" + }, + { + "name": "R2Path", + "type": "string" + }, + { + "name": "RayID", + "type": "string" + }, + { + "name": "RCode", + "type": "int" + }, + { + "name": "RData", + "type": "dynamic" + }, + { + "name": "RedirectTargetURI", + "type": "string" + }, + { + "name": "Ref", + "type": "string" + }, + { + "name": "Referer", + "type": "string" + }, + { + "name": "Referrer", + "type": "string" + }, + { + "name": "RegistrationID", + "type": "string" + }, + { + "name": "ReplyTo", + "type": "string" + }, + { + "name": "ReplyToName", + "type": "string" + }, + { + "name": "RequestContextCategoryIDs", + "type": "dynamic" + }, + { + "name": "RequestContextCategoryNames", + "type": "dynamic" + }, + { + "name": "RequestHeaders", + "type": "dynamic" + }, + { + "name": "RequestID", + "type": "string" + }, + { + "name": "ResolvedIPCategoryIDs", + "type": "dynamic" + }, + { + "name": "ResolvedIPCategoryNames", + "type": "dynamic" + }, + { + "name": "ResolvedIPContinentCodes", + "type": "dynamic" + }, + { + "name": "ResolvedIPCountryCodes", + "type": "dynamic" + }, + { + "name": "ResolverDecision", + "type": "string" + }, + { + "name": "ResourceID", + "type": "string" + }, + { + "name": "ResourceRecords", + "type": "dynamic" + }, + { + "name": "ResourceRecordsJSON", + "type": "string" + }, + { + "name": "ResourceType", + "type": "string" + }, + { + "name": "ResponseCached", + "type": "boolean" + }, + { + "name": "ResponseCachedStale", + "type": "boolean" + }, + { + "name": "ResponseHeaders", + "type": "dynamic" + }, + { + "name": "ResponseReason", + "type": "string" + }, + { + "name": "RuleEvaluationDurationMs", + "type": "int" + }, + { + "name": "RuleID", + "type": "string" + }, + { + "name": "RuleName", + "type": "string" + }, + { + "name": "RulesetID", + "type": "string" + }, + { + "name": "RulesetOverrideID", + "type": "string" + }, + { + "name": "SampleInterval", + "type": "int" + }, + { + "name": "ScriptName", + "type": "string" + }, + { + "name": "ScriptTags", + "type": "string" + }, + { + "name": "ScriptVersion", + "type": "string" + }, + { + "name": "SecurityAction", + "type": "string" + }, + { + "name": "SecurityActions", + "type": "dynamic" + }, + { + "name": "SecurityRuleDescription", + "type": "string" + }, + { + "name": "SecurityRuleID", + "type": "string" + }, + { + "name": "SecurityRuleIDs", + "type": "dynamic" + }, + { + "name": "SecuritySources", + "type": "dynamic" + }, + { + "name": "ServerAddress", + "type": "string" + }, + { + "name": "SessionEndTime", + "type": "string" + }, + { + "name": "SessionFinishDatetime", + "type": "string" + }, + { + "name": "SessionID", + "type": "string" + }, + { + "name": "SessionStartDatetime", + "type": "string" + }, + { + "name": "SessionStartTime", + "type": "string" + }, + { + "name": "SignatureID", + "type": "int" + }, + { + "name": "SignatureMessage", + "type": "string" + }, + { + "name": "SignatureRevision", + "type": "int" + }, + { + "name": "SinkholeID", + "type": "string" + }, + { + "name": "SmartRouteColoID", + "type": "int" + }, + { + "name": "SMTPEnvelopeFrom", + "type": "string" + }, + { + "name": "SMTPEnvelopeTo", + "type": "string" + }, + { + "name": "SMTPHeloServerIP", + "type": "string" + }, + { + "name": "SMTPHeloServerIPAsName", + "type": "string" + }, + { + "name": "SMTPHeloServerIPAsNumber", + "type": "string" + }, + { + "name": "SMTPHeloServerIPGeo", + "type": "string" + }, + { + "name": "SMTPHeloServerName", + "type": "string" + }, + { + "name": "SNI", + "type": "string" + }, + { + "name": "Source", + "type": "string" + }, + { + "name": "SourceASN", + "type": "int" + }, + { + "name": "SourceASNName", + "type": "string" + }, + { + "name": "SourceCountry", + "type": "string" + }, + { + "name": "SourceGeoHash", + "type": "string" + }, + { + "name": "SourceInternalIP", + "type": "string" + }, + { + "name": "SourceIP", + "type": "string" + }, + { + "name": "SourceIPContinentCode", + "type": "string" + }, + { + "name": "SourceIPCountryCode", + "type": "string" + }, + { + "name": "SourcePort", + "type": "int" + }, + { + "name": "SrcAddr", + "type": "string" + }, + { + "name": "SrcIP", + "type": "string" + }, + { + "name": "SrcIPContinentCode", + "type": "string" + }, + { + "name": "SrcIPCountryCode", + "type": "string" + }, + { + "name": "SrcPort", + "type": "int" + }, + { + "name": "Status", + "type": "int" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "TargetID", + "type": "string" + }, + { + "name": "TCPAcknowledgementNumber", + "type": "int" + }, + { + "name": "TCPChecksum", + "type": "int" + }, + { + "name": "TCPDataOffset", + "type": "int" + }, + { + "name": "TCPFlags", + "type": "int" + }, + { + "name": "TCPFlagsString", + "type": "string" + }, + { + "name": "TCPMSS", + "type": "int" + }, + { + "name": "TCPOptions", + "type": "string" + }, + { + "name": "TCPSACKBlocks", + "type": "string" + }, + { + "name": "TCPSACKPermitted", + "type": "int" + }, + { + "name": "TCPSequenceNumber", + "type": "int" + }, + { + "name": "TCPTimestampECR", + "type": "int" + }, + { + "name": "TCPTimestampValue", + "type": "int" + }, + { + "name": "TCPUrgentPointer", + "type": "int" + }, + { + "name": "TCPWindowScale", + "type": "int" + }, + { + "name": "TCPWindowSize", + "type": "int" + }, + { + "name": "TemporaryAccessApprovers", + "type": "dynamic" + }, + { + "name": "TemporaryAccessDuration", + "type": "int" + }, + { + "name": "ThreatCategories", + "type": "string" + }, + { + "name": "Timestamp", + "type": "string" + }, + { + "name": "TimeZone", + "type": "string" + }, + { + "name": "TimeZoneInferredMethod", + "type": "string" + }, + { + "name": "To", + "type": "string" + }, + { + "name": "ToName", + "type": "string" + }, + { + "name": "Transport", + "type": "string" + }, + { + "name": "TransportProtocol", + "type": "string" + }, + { + "name": "TriggeredRuleID", + "type": "string" + }, + { + "name": "Type", + "type": "string" + }, + { + "name": "UDPChecksum", + "type": "int" + }, + { + "name": "UDPPayloadLength", + "type": "int" + }, + { + "name": "UntrustedCertificateAction", + "type": "string" + }, + { + "name": "UploadedFileNames", + "type": "dynamic" + }, + { + "name": "UploadMatchedDlpProfileEntries", + "type": "dynamic" + }, + { + "name": "UploadMatchedDlpProfiles", + "type": "dynamic" + }, + { + "name": "UpperTierColoID", + "type": "int" + }, + { + "name": "UpstreamIP", + "type": "string" + }, + { + "name": "UpstreamResponseCode", + "type": "int" + }, + { + "name": "UpstreamResponseTimeMs", + "type": "int" + }, + { + "name": "URI", + "type": "string" + }, + { + "name": "URL", + "type": "string" + }, + { + "name": "URLContainsCDNCGIPath", + "type": "boolean" + }, + { + "name": "URLHost", + "type": "string" + }, + { + "name": "UserAgent", + "type": "string" + }, + { + "name": "UserEmail", + "type": "string" + }, + { + "name": "UserID", + "type": "string" + }, + { + "name": "Username", + "type": "string" + }, + { + "name": "UserUID", + "type": "string" + }, + { + "name": "Verdict", + "type": "string" + }, + { + "name": "VirtualNetworkID", + "type": "string" + }, + { + "name": "VirtualNetworkName", + "type": "string" + }, + { + "name": "WAFAttackScore", + "type": "int" + }, + { + "name": "WAFRCEAttackScore", + "type": "int" + }, + { + "name": "WAFSQLiAttackScore", + "type": "int" + }, + { + "name": "WAFXSSAttackScore", + "type": "int" + }, + { + "name": "WallTimeMs", + "type": "int" + }, + { + "name": "When", + "type": "string" + }, + { + "name": "WorkerCPUTime", + "type": "int" + }, + { + "name": "WorkerScriptName", + "type": "string" + }, + { + "name": "WorkerStatus", + "type": "string" + }, + { + "name": "WorkerSubrequest", + "type": "boolean" + }, + { + "name": "WorkerSubrequestCount", + "type": "int" + }, + { + "name": "WorkerWallTimeUs", + "type": "int" + }, + { + "name": "ZoneName", + "type": "string" + } + ] + } }, - { - "parameters": { - "label": "The event grid topic name of the blob container's storage account if exist. else keep empty.", - "description": "The data flow using event grid to send 'blob-created event' notifications. There could be only one event grid topic for each storage account.\nGo to your blob container's storage account and look in the 'Events' section. If you already have a topic, please provide it's name. Else, keep the text box empty.", - "type": "text", - "name": "EGSystemTopicName", - "validations": { - "required": false + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[[variables('workspaceResourceId')]", + "name": "clv2ws1" } - }, - "type": "Textbox" + ] }, - { - "parameters": { - "label": "toggle", - "name": "toggle" - }, - "type": "ConnectionToggleButton" - } - ] - } - ], - "isConnectivityCriteriasMatchSome": false - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", - "apiVersion": "2022-01-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", - "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorCCPVersion')]", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "[variables('_solutionName')]", - "kind": "Solution" - }, - "author": { - "name": "Cloudflare", - "email": "[variables('_email')]" - }, - "support": { - "name": "Cloudflare", - "email": "support@cloudflare.com", - "tier": "Partner", - "link": "https://support.cloudflare.com" - }, - "dependencies": { - "criteria": [ - { - "version": "[variables('dataConnectorCCPVersion')]", - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "kind": "ResourcesDataConnector" - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "displayName": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)", - "contentKind": "ResourcesDataConnector", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorCCPVersion')]", - "parameters": { - "guidValue": { - "defaultValue": "[[newGuid()]", - "type": "securestring" - }, - "innerWorkspace": { - "defaultValue": "[parameters('workspace')]", - "type": "securestring" - }, - "connectorDefinitionName": { - "defaultValue": "Cloudflare (Using Blob Container) (via Codeless Connector Framework)", - "type": "securestring", - "minLength": 1 - }, - "workspace": { - "defaultValue": "[parameters('workspace')]", - "type": "securestring" - }, - "dcrConfig": { - "defaultValue": { - "dataCollectionEndpoint": "data collection Endpoint", - "dataCollectionRuleImmutableId": "data collection rule immutableId" - }, - "type": "object" - }, - "principalId": { - "defaultValue": "principalId", - "type": "securestring", - "minLength": 1 - }, - "blobContainerUri": { - "defaultValue": "blobContainerUri", - "type": "securestring", - "minLength": 1 - }, - "StorageAccountResourceGroupName": { - "defaultValue": "StorageAccountResourceGroupName", - "type": "securestring", - "minLength": 1 - }, - "StorageAccountLocation": { - "defaultValue": "StorageAccountLocation", - "type": "securestring", - "minLength": 1 - }, - "StorageAccountSubscription": { - "defaultValue": "StorageAccountSubscription", - "type": "securestring", - "minLength": 1 + "dataFlows": [ + { + "streams": [ + "Custom-Cloudflare" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "[[concat('source | extend TimeGenerated = now(), NELType = Type, CloudflareAccountId = ''', replace(replace(parameters('CloudflareAccountId'), '''', ''), '\\', ''), ''', CloudflareAccountName = ''', replace(replace(parameters('CloudflareAccountName'), '''', ''), '\\', ''), ''' | project-away Type | project TimeGenerated, CloudflareAccountId, CloudflareAccountName, NELType, AccountID, BytesReceived, BytesSent, ClientTCPHandshakeDurationMs, ClientTLSCipher, ClientTLSHandshakeDurationMs, ClientTLSVersion, ConnectionCloseReason, ConnectionReuse, DestinationTunnelID, DetectedProtocol, DeviceID, DeviceName, EgressColoName, EgressIP, EgressPort, EgressRuleID, EgressRuleName, Email, IngressColoName, Offramp, OriginIP, OriginPort, OriginTLSCertificateIssuer, OriginTLSCertificateValidationResult, OriginTLSCipher, OriginTLSVersion, Protocol, RegistrationID, RuleEvaluationDurationMs, SessionEndTime, SessionID, SessionStartTime, SourceIP, SourceInternalIP, SourcePort, UserID, CPUTimeMs, DispatchNamespace, Entrypoint, Event, EventTimestampMs, EventType, Exceptions, Logs, Outcome, ScriptName, ScriptTags, ScriptVersion, WallTimeMs, ClientAddress, Error, PTY, Payload, ProgramFinishDatetime, ProgramID, ProgramStartDatetime, ProgramType, ServerAddress, SessionFinishDatetime, SessionStartDatetime, TargetID, UserEmail, Username, Body, BodyLength, DestAddr, Headers, Host, Method, Password, R2Path, Referrer, SinkholeID, SrcAddr, Timestamp, URI, URL, UserAgent, AttackCampaignID, AttackID, AttackVector, ColoCity, ColoCode, ColoCountry, ColoGeoHash, ColoName, Datetime, DestinationASN, DestinationASNName, DestinationCountry, DestinationGeoHash, DestinationPort, Direction, GREChecksum, GREEtherType, GREHeaderLength, GREKey, GRESequenceNumber, GREVersion, ICMPChecksum, ICMPCode, ICMPType, IPDestinationAddress, IPDestinationSubnet, IPFragmentOffset, IPHeaderLength, IPMoreFragments, IPProtocol, IPProtocolName, IPSourceAddress, IPSourceSubnet, IPTTL, IPTTLBuckets, IPTotalLength, IPTotalLengthBuckets, IPv4Checksum, IPv4DSCP, IPv4DontFragment, IPv4ECN, IPv4Identification, IPv4Options, IPv6DSCP, IPv6ECN, IPv6ExtensionHeaders, IPv6FlowLabel, IPv6Identification, MitigationReason, MitigationScope, MitigationSystem, ProtocolState, RuleID, RuleName, RulesetID, RulesetOverrideID, SampleInterval, SourceASN, SourceASNName, SourceCountry, SourceGeoHash, TCPAcknowledgementNumber, TCPChecksum, TCPDataOffset, TCPFlags, TCPFlagsString, TCPMSS, TCPOptions, TCPSACKBlocks, TCPSACKPermitted, TCPSequenceNumber, TCPTimestampECR, TCPTimestampValue, TCPUrgentPointer, TCPWindowScale, TCPWindowSize, UDPChecksum, UDPPayloadLength, Verdict, Action, DestinationIP, SignatureID, SignatureMessage, SignatureRevision, ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, OverrideIP, OverridePort, PolicyID, PolicyName, ProxyEndpoint, SNI, SourceIPContinentCode, SourceIPCountryCode, TransportProtocol, VirtualNetworkID, VirtualNetworkName, BlockedFileHash, BlockedFileName, BlockedFileReason, BlockedFileSize, BlockedFileType, DownloadMatchedDlpProfileEntries, DownloadMatchedDlpProfiles, DownloadedFileNames, FileInfo, ForensicCopyStatus, HTTPHost, HTTPMethod, HTTPStatusCode, HTTPVersion, IsIsolated, PrivateAppAUD, Quarantined, RedirectTargetURI, Referer, RequestID, UntrustedCertificateAction, UploadMatchedDlpProfileEntries, UploadMatchedDlpProfiles, UploadedFileNames, AuthoritativeNameServerIPs, CNAMECategoryIDs, CNAMECategoryNames, CNAMEs, CNAMEsReversed, ColoID, CustomResolveDurationMs, CustomResolverAddress, CustomResolverPolicyID, CustomResolverPolicyName, CustomResolverResponse, DoHSubdomain, DoTSubdomain, DstIP, DstPort, EDEErrors, InitialCategoryIDs, InitialCategoryNames, InitialResolvedIPs, InternalDNSFallbackStrategy, InternalDNSRCode, InternalDNSViewID, InternalDNSZoneID, IsResponseCached, Location, LocationID, MatchedCategoryIDs, MatchedCategoryNames, MatchedIndicatorFeedIDs, MatchedIndicatorFeedNames, QueryCategoryIDs, QueryCategoryNames, QueryID, QueryIndicatorFeedIDs, QueryIndicatorFeedNames, QueryName, QueryNameReversed, QuerySize, QueryType, QueryTypeName, RCode, RData, RequestContextCategoryIDs, RequestContextCategoryNames, ResolvedIPCategoryIDs, ResolvedIPCategoryNames, ResolvedIPContinentCodes, ResolvedIPCountryCodes, ResolverDecision, ResourceRecords, ResourceRecordsJSON, SrcIP, SrcIPContinentCode, SrcIPCountryCode, SrcPort, TimeZone, TimeZoneInferredMethod, AlertID, AlertReasons, Attachments, CC, CCName, FinalDisposition, From, FromName, Links, MessageDeliveryMode, MessageID, Origin, OriginalSender, ReplyTo, ReplyToName, SMTPEnvelopeFrom, SMTPEnvelopeTo, SMTPHeloServerIP, SMTPHeloServerIPAsName, SMTPHeloServerIPAsNumber, SMTPHeloServerIPGeo, SMTPHeloServerName, Subject, ThreatCategories, To, ToName, ClientResponseCode, ClusterID, EDNSSubnet, EDNSSubnetLength, QueryDO, QueryRD, QueryTCP, ResponseCached, ResponseCachedStale, ResponseReason, UpstreamIP, UpstreamResponseCode, UpstreamResponseTimeMs, ForensicCopyID, GatewayRequestID, Phase, TriggeredRuleID, ClientVersion, DeviceManufacturer, DeviceModel, DeviceSerialNumber, DeviceType, OSVersion, PostureCheckName, PostureCheckType, PostureEvaluatedResult, PostureExpectedJSON, PostureReceivedJSON, UserUID, AssetDisplayName, AssetExternalID, AssetLink, AssetMetadata, DetectedTimestamp, FindingTypeDisplayName, FindingTypeID, FindingTypeSeverity, InstanceID, IntegrationDisplayName, IntegrationID, IntegrationPolicyVendor, Decision, DomainName, ActionResult, ActionType, ActorEmail, ActorID, ActorIP, ActorType, ID, Interface, Metadata, NewValue, OldValue, OwnerID, ResourceID, ResourceType, When, Allowed, AppDomain, AppUUID, Connection, Country, CreatedAt, IPAddress, PurposeJustificationPrompt, PurposeJustificationResponse, RayID, TemporaryAccessApprovers, TemporaryAccessDuration, ClientASN, ClientASNDescription, ClientCountry, ClientIP, ClientIPClass, ClientRefererHost, ClientRefererPath, ClientRefererQuery, ClientRefererScheme, ClientRequestHost, ClientRequestMethod, ClientRequestPath, ClientRequestProtocol, ClientRequestQuery, ClientRequestScheme, ClientRequestUserAgent, ContentScanObjResults, ContentScanObjSizes, ContentScanObjTypes, Description, EdgeColoCode, EdgeResponseStatus, Kind, LeakedCredentialCheckResult, MatchIndex, OriginResponseStatus, OriginatorRayID, Ref, BotDetectionIDs, BotDetectionTags, BotScore, BotScoreSrc, BotTags, CacheCacheStatus, CacheReserveUsed, CacheResponseBytes, CacheResponseStatus, CacheTieredFill, ClientCity, ClientDeviceType, ClientLatitude, ClientLongitude, ClientMTLSAuthCertFingerprint, ClientMTLSAuthStatus, ClientRegionCode, ClientRequestBytes, ClientRequestReferer, ClientRequestSource, ClientRequestURI, ClientSSLCipher, ClientSSLProtocol, ClientSrcPort, ClientTCPRTTMs, ClientXRequestedWith, Cookies, EdgeCFConnectingO2O, EdgeColoID, EdgeEndTimestamp, EdgePathingOp, EdgePathingSrc, EdgePathingStatus, EdgeRequestHost, EdgeResponseBodyBytes, EdgeResponseBytes, EdgeResponseCompressionRatio, EdgeResponseContentType, EdgeServerIP, EdgeStartTimestamp, EdgeTimeToFirstByteMs, JA3Hash, JA4, JA4Signals, OriginDNSResponseTimeMs, OriginRequestHeaderSendDurationMs, OriginResponseBytes, OriginResponseDurationMs, OriginResponseHTTPExpires, OriginResponseHTTPLastModified, OriginResponseHeaderReceiveDurationMs, OriginSSLProtocol, OriginTCPHandshakeDurationMs, OriginTLSHandshakeDurationMs, ParentRayID, RequestHeaders, ResponseHeaders, SecurityAction, SecurityRuleDescription, SecurityRuleID, SecuritySources, SmartRouteColoID, UpperTierColoID, WAFAttackScore, WAFRCEAttackScore, WAFSQLiAttackScore, WAFXSSAttackScore, WorkerCPUTime, WorkerScriptName, WorkerStatus, WorkerSubrequest, WorkerSubrequestCount, WorkerWallTimeUs, ZoneName, ClientIPASN, ClientIPASNDescription, ClientIPCountry, LastKnownGoodColoCode, CSPDirective, PageURL, URLContainsCDNCGIPath, URLHost, Application, ClientBytes, ClientMatchedIpFirewall, ClientPort, ClientProto, ClientTcpRtt, ClientTlsClientHelloServerName, ClientTlsProtocol, ClientTlsStatus, ConnectTimestamp, DisconnectTimestamp, IpFirewall, OriginBytes, OriginProto, OriginTcpRtt, OriginTlsFingerprint, OriginTlsMode, OriginTlsProtocol, OriginTlsStatus, ProxyProtocol, Status, EventDetails, IP, Source, SecurityActions, SecurityRuleIDs, Transport')]", + "outputStream": "[[variables('outputStreamName')]" + } + ] + } }, - "EGSystemTopicName": { - "defaultValue": "", - "type": "securestring" - } - }, - "variables": { - "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]", - "connectorName": "sentinel-connector", - "blobContainerUriPart": "[concat('.blob.core', '.windows.net')]", - "storageAccountName": "[[split(split(parameters('blobContainerUri'), 'https://')[1], variables('blobContainerUriPart'))[0]]", - "blobContainerName": "[[split(split(parameters('blobContainerUri'), concat(variables('blobContainerUriPart'), '/'))[1], '/')[0]]", - "queueName": "[[concat(variables('connectorName'), '-notification')]", - "dlqName": "[[concat(variables('connectorName'), '-dlq')]", - "storageAccountId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Storage/storageAccounts', variables('storageAccountName'))]", - "notificationQueueResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Storage/storageAccounts/queueServices/queues', variables('storageAccountName'), 'default', variables('queueName'))]", - "dlqResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Storage/storageAccounts/queueServices/queues', variables('storageAccountName'), 'default', variables('dlqName'))]", - "EGSystemTopicDefaultName": "[[format('eg-system-topic-{0}-{1}', variables('connectorName'), parameters('innerWorkspace'))]", - "EGSystemTopicName": "[[if(empty(parameters('EGSystemTopicName')), variables('EGSystemTopicDefaultName'), parameters('EGSystemTopicName'))]", - "EGTopicResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.EventGrid/systemTopics', variables('EGSystemTopicName'))]", - "EgSubscriptionName": "[[format('{0}-{1}', variables('connectorName'), 'blobcreatedevents')]", - "EgSubscriptionResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.EventGrid/systemTopics/eventSubscriptions', variables('EGSystemTopicName'), variables('EgSubscriptionName'))]", - "storageBlobContributorRoleId": "[[subscriptionResourceId(parameters('StorageAccountSubscription'), 'Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", - "storageQueueContributorRoleId": "[[subscriptionResourceId(parameters('StorageAccountSubscription'), 'Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", - "blobRaGuid": "[[guid(variables('storageAccountName'), variables('blobContainerName'))]", - "notificationQueueRaGuid": "[[guid(variables('storageAccountName'), variables('queueName'))]", - "dlqRaGuid": "[[guid(variables('storageAccountName'), variables('dlqName'))]", - "blobRoleAssignmentResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments', variables('storageAccountName'), 'default', variables('blobContainerName'), 'Microsoft.Authorization', variables('blobRaGuid'))]", - "notificationQueueRoleAssignmentResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Storage/storageAccounts/queueServices/queues/providers/roleAssignments', variables('storageAccountName'), 'default', variables('queueName'), 'Microsoft.Authorization', variables('notificationQueueRaGuid'))]", - "dlqRoleAssignmentResourceId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Storage/storageAccounts/queueServices/queues/providers/roleAssignments', variables('storageAccountName'), 'default', variables('dlqName'), 'Microsoft.Authorization', variables('dlqRaGuid'))]", - "nestedDeploymentName": "CreateDataFlowResources", - "nestedDeploymentId": "[[resourceId(parameters('StorageAccountResourceGroupName'), 'Microsoft.Resources/deployments', variables('nestedDeploymentName'))]" - }, - "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", - "apiVersion": "2022-01-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "name": "[[variables('diagnosticSettingName')]", + "scope": "[[format('Microsoft.Insights/dataCollectionRules/{0}', variables('dcrName'))]", + "dependsOn": [ + "[[variables('dcrResourceId')]" + ], "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "kind": "ResourcesDataConnector", - "version": "[variables('dataConnectorCCPVersion')]", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "[variables('_solutionName')]", - "kind": "Solution" - }, - "author": { - "name": "Cloudflare", - "email": "[variables('_email')]" - }, - "support": { - "name": "Cloudflare", - "email": "support@cloudflare.com", - "tier": "Partner", - "link": "https://support.cloudflare.com" - } + "workspaceId": "[[variables('workspaceResourceId')]", + "logs": [ + { + "category": "LogErrors", + "enabled": true + } + ] } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2021-04-01", - "name": "[[variables('nestedDeploymentName')]", + "name": "[[variables('storageNestedDeploymentName')]", "properties": { "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "parameters": { + "storageAccountName": { + "value": "[[variables('storageAccountName')]" + }, + "storageAccountId": { + "value": "[[variables('storageAccountId')]" + }, + "blobContainerName": { + "value": "[[variables('blobContainerName')]" + }, + "queueName": { + "value": "[[variables('queueName')]" + }, + "dlqName": { + "value": "[[variables('dlqName')]" + }, + "eventGridSystemTopicName": { + "value": "[[variables('eventGridSystemTopicName')]" + }, + "eventGridSubscriptionName": { + "value": "[[variables('eventGridSubscriptionName')]" + }, + "createEventGridSystemTopic": { + "value": "[[variables('createEventGridSystemTopic')]" + }, + "principalId": { + "value": "[[parameters('principalId')]" + }, + "storageQueueContributorRoleId": { + "value": "[[variables('storageQueueContributorRoleId')]" + }, + "storageBlobContributorRoleId": { + "value": "[[variables('storageBlobContributorRoleId')]" + }, + "notificationQueueRaGuid": { + "value": "[[variables('notificationQueueRaGuid')]" + }, + "dlqRaGuid": { + "value": "[[variables('dlqRaGuid')]" + }, + "blobRaGuid": { + "value": "[[variables('blobRaGuid')]" + } + }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", + "parameters": { + "storageAccountName": { + "type": "string" + }, + "storageAccountId": { + "type": "string" + }, + "blobContainerName": { + "type": "string" + }, + "queueName": { + "type": "string" + }, + "dlqName": { + "type": "string" + }, + "eventGridSystemTopicName": { + "type": "string" + }, + "eventGridSubscriptionName": { + "type": "string" + }, + "createEventGridSystemTopic": { + "type": "bool" + }, + "principalId": { + "type": "securestring" + }, + "storageQueueContributorRoleId": { + "type": "string" + }, + "storageBlobContributorRoleId": { + "type": "string" + }, + "notificationQueueRaGuid": { + "type": "string" + }, + "dlqRaGuid": { + "type": "string" + }, + "blobRaGuid": { + "type": "string" + } + }, "resources": [ { "type": "Microsoft.Storage/storageAccounts/queueServices/queues", - "apiVersion": "2021-04-01", - "name": "[[concat(variables('storageAccountName'), '/default/', variables('queueName'))]", - "dependsOn": [], + "apiVersion": "2025-06-01", + "name": "[[concat(parameters('storageAccountName'), '/default/', parameters('queueName'))]", "properties": {} }, { "type": "Microsoft.Storage/storageAccounts/queueServices/queues", - "apiVersion": "2021-04-01", - "name": "[[concat(variables('storageAccountName'), '/default/', variables('dlqName'))]", - "dependsOn": [], + "apiVersion": "2025-06-01", + "name": "[[concat(parameters('storageAccountName'), '/default/', parameters('dlqName'))]", "properties": {} }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[[parameters('notificationQueueRaGuid')]", + "scope": "[[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('queueName'))]", + "dependsOn": [ + "[[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('queueName'))]" + ], + "properties": { + "roleDefinitionId": "[[parameters('storageQueueContributorRoleId')]", + "principalId": "[[parameters('principalId')]", + "principalType": "ServicePrincipal" + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[[parameters('dlqRaGuid')]", + "scope": "[[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('dlqName'))]", + "dependsOn": [ + "[[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('dlqName'))]" + ], + "properties": { + "roleDefinitionId": "[[parameters('storageQueueContributorRoleId')]", + "principalId": "[[parameters('principalId')]", + "principalType": "ServicePrincipal" + } + }, { "type": "Microsoft.EventGrid/systemTopics", - "apiVersion": "2022-06-15", - "name": "[[variables('EGSystemTopicName')]", - "location": "[[parameters('StorageAccountLocation')]", + "apiVersion": "2025-02-15", + "name": "[[parameters('eventGridSystemTopicName')]", + "location": "[[resourceGroup().location]", + "condition": "[[parameters('createEventGridSystemTopic')]", "properties": { - "source": "[[variables('storageAccountId')]", + "source": "[[parameters('storageAccountId')]", "topicType": "microsoft.storage.storageaccounts" - }, - "condition": "[[empty(parameters('EGSystemTopicName'))]" + } }, { "type": "Microsoft.EventGrid/systemTopics/eventSubscriptions", - "apiVersion": "2023-12-15-preview", - "name": "[[format('{0}/{1}', variables('EGSystemTopicName'), variables('EgSubscriptionName'))]", + "apiVersion": "2025-02-15", + "name": "[[format('{0}/{1}', parameters('eventGridSystemTopicName'), parameters('eventGridSubscriptionName'))]", "dependsOn": [ - "[[format('Microsoft.EventGrid/systemTopics/{0}', variables('EGSystemTopicName'))]" + "[[resourceId('Microsoft.EventGrid/systemTopics', parameters('eventGridSystemTopicName'))]", + "[[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('queueName'))]" ], "properties": { "destination": { "endpointType": "StorageQueue", "properties": { - "queueName": "[[variables('queueName')]", - "resourceId": "[[variables('storageAccountId')]" + "queueName": "[[parameters('queueName')]", + "resourceId": "[[parameters('storageAccountId')]" } }, "filter": { "includedEventTypes": [ "Microsoft.Storage.BlobCreated" ], - "subjectBeginsWith": "[[format('{0}/{1}', '/blobServices/default/containers', variables('blobContainerName'))]" + "subjectBeginsWith": "[[format('{0}/{1}', '/blobServices/default/containers', parameters('blobContainerName'))]" } } }, { - "type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments", - "apiVersion": "2018-01-01-preview", - "name": "[[concat(variables('storageAccountName'), '/default/', variables('blobContainerName'), '/Microsoft.Authorization/', variables('blobRaGuid'))]", - "properties": { - "roleDefinitionId": "[[variables('storageBlobContributorRoleId')]", - "principalId": "[[parameters('principalId')]" - } - }, - { - "type": "Microsoft.Storage/storageAccounts/queueServices/queues/providers/roleAssignments", - "apiVersion": "2018-01-01-preview", - "name": "[[concat(variables('storageAccountName'), '/default/', variables('queueName'), '/Microsoft.Authorization/', variables('notificationQueueRaGuid'))]", - "dependsOn": [ - "[[variables('notificationQueueResourceId')]" - ], - "properties": { - "roleDefinitionId": "[[variables('storageQueueContributorRoleId')]", - "principalId": "[[parameters('principalId')]" - } - }, - { - "type": "Microsoft.Storage/storageAccounts/queueServices/queues/providers/roleAssignments", - "apiVersion": "2018-01-01-preview", - "name": "[[concat(variables('storageAccountName'), '/default/', variables('dlqName'), '/Microsoft.Authorization/', variables('dlqRaGuid'))]", - "dependsOn": [ - "[[variables('dlqResourceId')]" - ], + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[[parameters('blobRaGuid')]", + "scope": "[[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('blobContainerName'))]", "properties": { - "roleDefinitionId": "[[variables('storageQueueContributorRoleId')]", - "principalId": "[[parameters('principalId')]" + "roleDefinitionId": "[[parameters('storageBlobContributorRoleId')]", + "principalId": "[[parameters('principalId')]", + "principalType": "ServicePrincipal" } } ] } }, - "subscriptionId": "[[parameters('StorageAccountSubscription')]", - "resourceGroup": "[[parameters('StorageAccountResourceGroupName')]" + "subscriptionId": "[[trim(parameters('StorageAccountSubscription'))]", + "resourceGroup": "[[trim(parameters('StorageAccountResourceGroupName'))]" + }, + { + "type": "Microsoft.Resources/deploymentScripts", + "apiVersion": "2023-08-01", + "name": "[[variables('rbacPropagationScriptName')]", + "location": "[variables('workspaceLocationEffective')]", + "kind": "AzurePowerShell", + "dependsOn": [ + "[[variables('storageNestedDeploymentId')]" + ], + "properties": { + "azPowerShellVersion": "11.5", + "forceUpdateTag": "[[parameters('forceUpdateTag')]", + "retentionInterval": "PT1H", + "cleanupPreference": "Always", + "timeout": "PT5M", + "scriptContent": "$ErrorActionPreference = 'Stop'\n$delaySeconds = 90\n$intervalSeconds = 15\n$elapsedSeconds = 0\nWrite-Host \"Starting bounded Azure role-assignment propagation buffer for $delaySeconds seconds.\"\nwhile ($elapsedSeconds -lt $delaySeconds) {\n $sleepSeconds = [Math]::Min($intervalSeconds, $delaySeconds - $elapsedSeconds)\n Start-Sleep -Seconds $sleepSeconds\n $elapsedSeconds += $sleepSeconds\n Write-Host \"Propagation buffer progress: $elapsedSeconds / $delaySeconds seconds.\"\n}\nWrite-Host 'Propagation buffer complete. Data-plane authorization can still take longer; deterministic redeployment is safe.'" + } }, { - "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CloudflareUsingBlob', parameters('guidValue'))]", + "name": "[[concat(parameters('innerWorkspace'), '/Microsoft.SecurityInsights/', variables('connectorName'))]", "apiVersion": "2023-02-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "kind": "StorageAccountBlobContainer", "properties": { "connectorDefinitionName": "CloudflareDefinition", - "dataType": "CloudflareV2_CL", + "dataType": "[[variables('tableName')]", + "addOnAttributes": { + "CloudflareAccountId": "[[parameters('CloudflareAccountId')]", + "CloudflareAccountName": "[[parameters('CloudflareAccountName')]" + }, "dcrConfig": { - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "dataCollectionEndpoint": "[[reference(variables('dceResourceId'), '2022-06-01').logsIngestion.endpoint]", + "dataCollectionRuleImmutableId": "[[reference(variables('dcrResourceId'), '2022-06-01').immutableId]", "streamName": "Custom-Cloudflare" }, "auth": { @@ -4874,7 +7257,10 @@ } }, "dependsOn": [ - "[[variables('nestedDeploymentId')]" + "[[variables('rbacPropagationScriptId')]", + "[[variables('dcrResourceId')]", + "[[variables('dceResourceId')]", + "[[variables('storageNestedDeploymentId')]" ] } ] @@ -4892,12 +7278,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('parserObject1').parserTemplateSpecName1]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cloudflare Data Parser with template version 3.0.3", + "description": "Cloudflare Data Parser with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -4908,7 +7294,7 @@ "name": "[variables('parserObject1')._parserName1]", "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Parser for Cloudflare", @@ -4973,7 +7359,7 @@ "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "2025-07-01", "name": "[variables('parserObject1')._parserName1]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Parser for Cloudflare", @@ -4993,7 +7379,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ "[variables('parserObject1')._parserId1]" @@ -5024,12 +7410,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCF Workbook with template version 3.0.3", + "description": "CloudflareCCF Workbook with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -5039,7 +7425,7 @@ { "type": "Microsoft.Insights/workbooks", "name": "[variables('workbookContentId1')]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "kind": "shared", "apiVersion": "2021-08-01", "metadata": { @@ -5116,12 +7502,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFClientErrors_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFClientErrors_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -5132,7 +7518,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_1", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Client errors", @@ -5201,12 +7587,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFClientTlsErrors_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFClientTlsErrors_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -5217,7 +7603,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_2", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Client TLS errors", @@ -5286,12 +7672,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFFilesRequested_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFFilesRequested_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -5302,7 +7688,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_3", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Files requested", @@ -5371,12 +7757,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFRareUAs_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFRareUAs_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -5387,7 +7773,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_4", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Rare user agents", @@ -5456,12 +7842,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFServerErrors_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFServerErrors_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -5472,7 +7858,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_5", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Server errors", @@ -5541,12 +7927,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFServerTlsErrors_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFServerTlsErrors_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -5557,7 +7943,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_6", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Server TLS errors", @@ -5626,12 +8012,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFTopNetworkRules_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFTopNetworkRules_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -5642,7 +8028,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_7", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Top Network rules", @@ -5711,12 +8097,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFTopWafRules_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFTopWafRules_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -5727,7 +8113,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_8", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Top WAF rules", @@ -5796,12 +8182,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFUnexpectedCountries_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFUnexpectedCountries_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -5812,7 +8198,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_9", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Unexpected countries", @@ -5881,12 +8267,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFUnexpectedEdgeResponse_HuntingQueries Hunting Query with template version 3.0.3", + "description": "CloudflareCCFUnexpectedEdgeResponse_HuntingQueries Hunting Query with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -5897,7 +8283,7 @@ "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2025-07-01", "name": "Cloudflare_CCF_Hunting_Query_10", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "eTag": "*", "displayName": "Cloudflare - Unexpected edge response", @@ -5966,12 +8352,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFBadClientIp_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFBadClientIp_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -5983,7 +8369,7 @@ "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects requests from IP with bad reputation index.", "displayName": "Cloudflare - Bad client IP", @@ -5999,10 +8385,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6080,12 +8466,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFEmptyUA_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFEmptyUA_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -6097,7 +8483,7 @@ "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects requests where user agent is empty.", "displayName": "Cloudflare - Empty user agent", @@ -6113,10 +8499,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6185,12 +8571,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFMultipleErrorsSource_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFMultipleErrorsSource_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -6202,7 +8588,7 @@ "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects multiple failure requests from single source in short timeframe.", "displayName": "Cloudflare - Multiple error requests from single source", @@ -6218,10 +8604,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6290,12 +8676,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFMultipleUAs_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFMultipleUAs_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -6307,7 +8693,7 @@ "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects requests with different user agents from one source in short timeframe.", "displayName": "Cloudflare - Multiple user agents for single source", @@ -6323,10 +8709,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6395,12 +8781,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFUnexpectedCountry_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFUnexpectedCountry_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -6412,7 +8798,7 @@ "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects requests from countries which are in blocklist.", "displayName": "Cloudflare - Client request from country in blocklist", @@ -6428,10 +8814,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6509,12 +8895,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFUnexpectedPost_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFUnexpectedPost_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -6526,7 +8912,7 @@ "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects post requests to unusual extensions.", "displayName": "Cloudflare - Unexpected POST requests", @@ -6542,10 +8928,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6615,12 +9001,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFUnexpectedRequest_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFUnexpectedRequest_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -6632,7 +9018,7 @@ "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects client requests to unusual client request.", "displayName": "Cloudflare - Unexpected client request", @@ -6648,10 +9034,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6720,12 +9106,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFUnexpectedUrl_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFUnexpectedUrl_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -6737,7 +9123,7 @@ "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects client requests to unusual URI.", "displayName": "Cloudflare - Unexpected URI", @@ -6753,10 +9139,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6825,12 +9211,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFWafThreatAllowed_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFWafThreatAllowed_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -6842,7 +9228,7 @@ "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects WAF \"Allowed\" action on threat events.", "displayName": "Cloudflare - WAF Allowed threat", @@ -6858,10 +9244,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -6939,12 +9325,12 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CloudflareCCFXSSProbingPattern_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CloudflareCCFXSSProbingPattern_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -6956,7 +9342,7 @@ "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { "description": "Detects XSS probing patterns.", "displayName": "Cloudflare - XSS probing pattern in request", @@ -6972,10 +9358,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CloudflareDataConnector", "dataTypes": [ "Cloudflare" - ] + ], + "connectorId": "CloudflareDataConnector" } ], "tactics": [ @@ -7052,14 +9438,14 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", - "location": "[parameters('workspace-location')]", + "location": "[variables('workspaceLocationEffective')]", "properties": { - "version": "3.0.3", + "version": "3.1.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Cloudflare CCF", "publisherDisplayName": "Cloudflare", - "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Cloudflare solution provides the capability to ingest Cloudflare logs into Microsoft Sentinel using the Codeless Connector Framework (CCF) and Azure Blob Storage. Refer to Cloudflare documentation for more information.
\nUnderlying Microsoft Technologies used:
\nAzure Monitor HTTP Data Collector API (for reference, legacy support)
\nData Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Cloudflare solution ingests Cloudflare logs into Microsoft Sentinel from Azure Blob Storage. It supports multiple account and container instances with deterministic ingestion resources and account provenance.
\nUnderlying Microsoft Technologies used:
\nAzure deployment scripts, which can create transient supporting resources and operational cost
\nData Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", diff --git a/Solutions/Cloudflare CCF/Package/testParameters.json b/Solutions/Cloudflare CCF/Package/testParameters.json index 787a8129586..f9b00f92e0c 100644 --- a/Solutions/Cloudflare CCF/Package/testParameters.json +++ b/Solutions/Cloudflare CCF/Package/testParameters.json @@ -21,20 +21,6 @@ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, - "resourceGroupName": { - "type": "string", - "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "resource group name where Microsoft Sentinel is setup" - } - }, - "subscription": { - "type": "string", - "defaultValue": "[last(split(subscription().id, '/'))]", - "metadata": { - "description": "subscription id where Microsoft Sentinel is setup" - } - }, "workbook1-name": { "type": "string", "defaultValue": "Cloudflare CCF", diff --git a/Solutions/Cloudflare CCF/ReleaseNotes.md b/Solutions/Cloudflare CCF/ReleaseNotes.md index 0d24704af4b..f71883a159f 100644 --- a/Solutions/Cloudflare CCF/ReleaseNotes.md +++ b/Solutions/Cloudflare CCF/ReleaseNotes.md @@ -1,5 +1,9 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |------------|-------------------------------|--------------------| +| 3.1.3 | 29-07-2026 | Fixed two deployment-blocking template defects found during end-to-end validation. The storage-side nested deployment set the Event Grid system topic location via `reference()` on the storage account, which ARM rejects inside an inner-scoped nested deployment ("template function 'reference' is not expected at this location"); the topic now uses `resourceGroup().location`, which resolves to the storage account's region because the nested deployment already targets that scope. Separately, the unused `location` parameter carried `minLength: 1` and solution resources consumed `workspace-location` directly, so an empty value from the portal UI failed validation; `location` no longer enforces a minimum length and resource locations now resolve through a `workspaceLocationEffective` variable that falls back to the resource group location. | +| 3.1.2 | 29-07-2026 | Fixed Cloudflare account attribution: CloudflareAccountId and CloudflareAccountName were projected by the DCR transform but never assigned, so both columns always ingested as null. Each connection's DCR transform now injects its own account values, and the columns were removed from the input stream declaration because Cloudflare blob payloads never carry them. | +| 3.1.1 | 29-07-2026 | Fixed multi-instance connector deployment failure: the storage-side nested deployment now uses inner-scope expression evaluation so cross-subscription and cross-resource-group queue, Event Grid and RBAC resources resolve correctly. Modernized queue role assignments and refreshed storage and Event Grid API versions. | +| 3.1.0 | 23-07-2026 | Added reproducible multi-instance Cloudflare Blob collectors with deterministic per-instance DCR/DCE, queues and Event Grid subscriptions, account provenance, DCR LogErrors diagnostics, and explicit RBAC/cleanup guidance. Blob lifecycle automation is deferred pending a least-privilege design. | | 3.0.3 | 11-05-2026 | Modified workbook file and fixed workbook metadata to reference Cloudflare parser and CCF connector; added deployment prerequisites note to connector description | | 3.0.2 | 22-04-2026 | Fixed DCR transformKql for Type field and corrected invalid field data types | | 3.0.1 | 08-12-2025 | Fixed invalid GUIDs, updated analytic rules, aligned URL entity mappings with legacy Cloudflare solution | diff --git a/Solutions/Cloudflare CCF/Tests/validate_cloudflare_package.py b/Solutions/Cloudflare CCF/Tests/validate_cloudflare_package.py new file mode 100644 index 00000000000..d935dc61945 --- /dev/null +++ b/Solutions/Cloudflare CCF/Tests/validate_cloudflare_package.py @@ -0,0 +1,367 @@ +#!/usr/bin/env python3 +"""Targeted source/package checks for the Cloudflare CCF reference proposal.""" + +from __future__ import annotations + +import json +import re +import subprocess +import sys +from pathlib import Path +from typing import Any, Iterable + + +SOLUTION_RELATIVE = Path("Solutions/Cloudflare CCF") +CONNECTOR_RELATIVE = Path( + "Data Connectors/CloudflareLog_CCF/CloudflareLog_ConnectorDefinition.json" +) +POLLER_RELATIVE = Path( + "Data Connectors/CloudflareLog_CCF/CloudflareLog_PollerConfig.json" +) +DCR_RELATIVE = Path("Data Connectors/CloudflareLog_CCF/CloudflareLog_DCR.json") +TABLE_RELATIVE = Path("Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json") +PACKAGE_RELATIVE = Path("Package/mainTemplate.json") +SEAN_REF = "refs/remotes/seanstark/seanstark-cloudflare" + + +def load_json(path: Path) -> Any: + with path.open(encoding="utf-8") as handle: + return json.load(handle) + + +def walk(value: Any) -> Iterable[Any]: + yield value + if isinstance(value, dict): + for child in value.values(): + yield from walk(child) + elif isinstance(value, list): + for child in value: + yield from walk(child) + + +def find_connection_template(package: dict[str, Any]) -> dict[str, Any]: + for resource in package.get("resources", []): + properties = resource.get("properties", {}) + if "Connections" in str(properties.get("contentId", "")): + return properties["mainTemplate"] + raise AssertionError("Connections content template was not generated") + + +def find_definition_resource(package: dict[str, Any]) -> dict[str, Any]: + for resource in walk(package): + if ( + isinstance(resource, dict) + and resource.get("type") + == "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions" + ): + return resource + raise AssertionError("Packaged data connector definition was not found") + + +def first_resource(resources: list[dict[str, Any]], resource_type: str) -> dict[str, Any]: + for resource in resources: + if resource.get("type") == resource_type: + return resource + raise AssertionError(f"Required resource type was not generated: {resource_type}") + + +def projected_columns(transform: str) -> list[str]: + marker = "| project " + if marker not in transform: + raise AssertionError("DCR transform does not contain a final project operator") + tail = transform.rsplit(marker, 1)[1] + # A packaged transform is an ARM concat() expression, so the final projected column + # is followed by the closing string literal and bracket. + tail = tail.split("')]")[0].rstrip("'") + return [column.strip() for column in tail.split(",")] + + +def git_show_json(repo_root: Path, ref: str, relative_path: Path) -> Any | None: + result = subprocess.run( + ["git", "-C", str(repo_root), "show", f"{ref}:{relative_path.as_posix()}"], + check=False, + capture_output=True, + text=True, + ) + if result.returncode != 0: + return None + return json.loads(result.stdout) + + +def validate(repo_root: Path) -> list[str]: + solution = repo_root / SOLUTION_RELATIVE + connector_definition = load_json(solution / CONNECTOR_RELATIVE) + poller = load_json(solution / POLLER_RELATIVE)[0] + dcr = load_json(solution / DCR_RELATIVE)[0] + table = load_json(solution / TABLE_RELATIVE) + package = load_json(solution / PACKAGE_RELATIVE) + messages: list[str] = [] + + deployment_config = poller.get("connectionDeployment", {}) + assert deployment_config.get("mode") == "PerInstance" + assert poller.get("UseRandomGuid") is False + assert "newGuid" not in json.dumps(poller) + messages.append("PASS source opts into deterministic per-instance packaging") + + account_columns = {"CloudflareAccountId", "CloudflareAccountName"} + table_columns = { + column["name"] for column in table["properties"]["schema"]["columns"] + } + stream_columns = { + column["name"] + for column in dcr["properties"]["streamDeclarations"]["Custom-Cloudflare"][ + "columns" + ] + } + transform = dcr["properties"]["dataFlows"][0]["transformKql"] + project_columns = set(projected_columns(transform)) + assert account_columns <= table_columns + # The account columns are synthesized per connection, not ingested: Cloudflare blob + # payloads never carry them, so declaring them on the input stream would guarantee + # nulls. They must be assigned in the transform instead. + assert not (account_columns & stream_columns), ( + "account columns must not be declared on the input stream: " + f"{sorted(account_columns & stream_columns)}" + ) + assert account_columns <= project_columns + for column in sorted(account_columns): + assert f"{column} = ''" in transform, ( + f"authoritative transform is missing the '{column} = \\'\\'' attribution placeholder" + ) + assert table_columns == project_columns, ( + f"DCR/table mismatch. Missing from project: {sorted(table_columns - project_columns)}; " + f"not in table: {sorted(project_columns - table_columns)}" + ) + assert "NELType = Type" in transform + assert "LogType =" not in transform + messages.append("PASS DCR projection exactly matches the shared table and preserves NELType") + + source_instructions = connector_definition["properties"]["connectorUiConfig"][ + "instructionSteps" + ] + source_instruction_types = { + value.get("type") + for value in walk(source_instructions) + if isinstance(value, dict) and "type" in value + } + assert {"DataConnectorsGrid", "ContextPane"} <= source_instruction_types + grid = next( + value + for value in walk(source_instructions) + if isinstance(value, dict) and value.get("type") == "DataConnectorsGrid" + ) + mappings = { + item["columnName"]: item["columnValue"] + for item in grid["parameters"]["mapping"] + } + assert mappings["Queue URI"] == "properties.request.QueueUri" + assert "menuItems" not in grid["parameters"] + messages.append("PASS source grid uses QueueUri casing and does not imply full deletion") + + connection_template = find_connection_template(package) + serialized_connection = json.dumps(connection_template, separators=(",", ":")) + assert "newGuid" not in serialized_connection + assert "guidValue" not in connection_template.get("parameters", {}) + assert "dcrConfig" not in connection_template.get("parameters", {}) + + identity_expression = connection_template["variables"]["instanceKey"] + for parameter_name in deployment_config["identityParameters"]: + assert f"parameters('{parameter_name}')" in identity_expression + assert f"toLower(trim(parameters('{parameter_name}')))" in identity_expression + assert "workspaceResourceId" in identity_expression + + deterministic_variables = { + "connectorName", + "dceName", + "dcrName", + "diagnosticSettingName", + "queueName", + "dlqName", + "eventGridSubscriptionName", + "storageNestedDeploymentName", + "rbacPropagationScriptName", + } + for variable_name in deterministic_variables: + assert "instanceKey" in connection_template["variables"][variable_name] + + queue_prefix = deployment_config["queuePrefix"] + assert re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,14})[a-z0-9]", queue_prefix) + maximum_queue_length = len(queue_prefix) + 1 + 13 + len("-notification") + assert 3 <= maximum_queue_length <= 63 + messages.append("PASS full immutable identity drives collision-safe Azure resource names") + + allowed_parameter_types = {"securestring", "object", "array"} + for parameter_name, parameter in connection_template["parameters"].items(): + assert parameter["type"] in allowed_parameter_types, ( + f"{parameter_name} uses unsupported connector-template type " + f"{parameter['type']}" + ) + context_textboxes = [ + value + for value in walk(source_instructions) + if isinstance(value, dict) and value.get("type") == "Textbox" + ] + assert all( + textbox["parameters"].get("type") != "password" + for textbox in context_textboxes + ) + assert set(poller["properties"]["addOnAttributes"]) == account_columns + messages.append("PASS no actual secret field enters resource identity or enrichment") + + resources = connection_template["resources"] + required_resource_types = { + "Microsoft.OperationalInsights/workspaces/tables", + "Microsoft.Insights/dataCollectionEndpoints", + "Microsoft.Insights/dataCollectionRules", + "Microsoft.Insights/diagnosticSettings", + "Microsoft.Resources/deployments", + "Microsoft.Resources/deploymentScripts", + "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + } + generated_types = {resource.get("type") for resource in resources} + assert required_resource_types <= generated_types + + connector = first_resource( + resources, + "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + ) + assert connector["properties"]["addOnAttributes"] == { + "CloudflareAccountId": "[[parameters('CloudflareAccountId')]", + "CloudflareAccountName": "[[parameters('CloudflareAccountName')]", + } + assert "QueueUri" in connector["properties"]["request"] + assert "queueUri" not in connector["properties"]["request"] + assert "dceResourceId" in connector["properties"]["dcrConfig"][ + "dataCollectionEndpoint" + ] + assert "dcrResourceId" in connector["properties"]["dcrConfig"][ + "dataCollectionRuleImmutableId" + ] + + packaged_dcr = first_resource(resources, "Microsoft.Insights/dataCollectionRules") + packaged_transform = packaged_dcr["properties"]["dataFlows"][0]["transformKql"] + assert account_columns <= set(projected_columns(packaged_transform)) + assert "NELType = Type" in packaged_transform + # Each connection owns its DCR, so the connection-scoped account values are baked + # into that DCR's transform. addOnAttributes lives on the connector ARM resource and + # is never injected into the DCR or the destination table, so relying on it alone + # would ingest the columns as null. + assert packaged_transform.startswith("[[concat("), ( + "packaged transform must be an ARM expression that injects per-connection attribution" + ) + for column in sorted(account_columns): + # In the packaged ARM expression the opening KQL quote is escaped as '', so the + # assignment must be immediately followed by the scrubbed parameter injection. + expected = ( + f"{column} = ''', replace(replace(parameters('{column}'), '''', ''), '\\', '')" + ) + assert expected in packaged_transform, ( + f"packaged transform does not inject a scrubbed parameters('{column}') value" + ) + + diagnostics = first_resource(resources, "Microsoft.Insights/diagnosticSettings") + assert diagnostics["properties"]["workspaceId"] == "[[variables('workspaceResourceId')]" + assert {"category": "LogErrors", "enabled": True} in diagnostics["properties"]["logs"] + messages.append("PASS package preserves per-instance DCR/DCE, provenance, and LogErrors") + + forbidden_role = "17d1049b-9a84-46fb-8f53-869881c3d3ab" + assert forbidden_role not in serialized_connection + assert "Microsoft.ManagedIdentity/userAssignedIdentities" not in serialized_connection + assert "managementPolicies" not in serialized_connection + assert "BlobDeleteRetentionDays" not in serialized_connection + messages.append("PASS unsafe lifecycle automation and Storage Account Contributor are absent") + + packaged_definition = find_definition_resource(package) + packaged_instruction_types = { + value.get("type") + for value in walk( + packaged_definition["properties"]["connectorUiConfig"]["instructionSteps"] + ) + if isinstance(value, dict) and "type" in value + } + assert {"DataConnectorsGrid", "ContextPane"} <= packaged_instruction_types + messages.append("PASS V3 package preserves the grid and nested context pane") + + sean_package = git_show_json( + repo_root, SEAN_REF, SOLUTION_RELATIVE / PACKAGE_RELATIVE + ) + if sean_package is None: + messages.append( + "SKIP Sean structural comparison (refs/remotes/seanstark/seanstark-cloudflare is unavailable)" + ) + else: + sean_connection = find_connection_template(sean_package) + sean_types = {resource.get("type") for resource in sean_connection["resources"]} + structural_features = { + "Microsoft.OperationalInsights/workspaces/tables", + "Microsoft.Insights/dataCollectionEndpoints", + "Microsoft.Insights/dataCollectionRules", + "Microsoft.Insights/diagnosticSettings", + "Microsoft.Resources/deployments", + "Microsoft.Resources/deploymentScripts", + "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + } + assert structural_features <= sean_types + assert structural_features <= generated_types + messages.append( + "PASS hardened package retains Sean's phase-one multi-instance resource topology" + ) + + # Regression guard for the packaging defect that broke lab deployments: the + # storage-side nested deployment targets the storage account's own + # subscription/resource group, so it MUST evaluate expressions with inner + # scope. Under the ARM default (outer) scope every resourceId() below is + # resolved against the parent deployment's resource group, and ARM rejects + # the deployment with "The resource '.../queues/