Cloudflare CCF 3.1.1: add per-instance storage deployment mode for multi-instance CCF connectors

Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_PollerConfig.json

@@ -1,16 +1,40 @@
 [
     {
-        "name": "CloudflareUsingBlob",
+        "name": "[[concat(parameters('innerWorkspace'), '/Microsoft.SecurityInsights/', variables('connectorName'))]",
+        "UseRandomGuid": false,
+        "connectionDeployment": {
+            "mode": "PerInstance",
+            "resourcePrefix": "cloudflare",
+            "queuePrefix": "cf",
+            "tableName": "CloudflareV2_CL",
+            "identityParameters": [
+                "CloudflareAccountId",
+                "StorageAccountSubscription",
+                "StorageAccountResourceGroupName",
+                "StorageAccountName",
+                "ContainerName"
+            ],
+            "enableDcrLogErrors": true,
+            "attributionColumns": {
+                "CloudflareAccountId": "CloudflareAccountId",
+                "CloudflareAccountName": "CloudflareAccountName"
+            },
+            "rolePropagationDelaySeconds": 90
+        },
         "apiVersion": "2022-12-01-preview",
         "type": "Microsoft.SecurityInsights/dataConnectors",
         "location": "{{location}}",
         "kind": "StorageAccountBlobContainer",
         "properties": {
             "connectorDefinitionName": "CloudflareDefinition",
-            "dataType": "CloudflareV2_CL",
+            "dataType": "[[variables('tableName')]",
+            "addOnAttributes": {
+                "CloudflareAccountId": "[[parameters('CloudflareAccountId')]",
+                "CloudflareAccountName": "[[parameters('CloudflareAccountName')]"
+            },
             "dcrConfig": {
-                "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
-                "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}",
+                "dataCollectionEndpoint": "[[reference(variables('dceResourceId'), '2022-06-01').logsIngestion.endpoint]",
+                "dataCollectionRuleImmutableId": "[[reference(variables('dcrResourceId'), '2022-06-01').immutableId]",
                 "streamName": "Custom-Cloudflare"
             },
             "auth": {

Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json

@@ -11,6 +11,14 @@
                     "name": "TimeGenerated",
                     "type": "datetime"
                 },
+                {
+                    "name": "CloudflareAccountId",
+                    "type": "string"
+                },
+                {
+                    "name": "CloudflareAccountName",
+                    "type": "string"
+                },
                 {
                     "name": "AccountID",
                     "type": "string"

Solutions/Cloudflare CCF/Data/Solution_Cloudflare.json

@@ -2,7 +2,7 @@
   "Name": "Cloudflare CCF",
   "Author": "Cloudflare - support@cloudflare.com",
   "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">",
-  "Description": "The [Cloudflare](https://www.cloudflare.com/) solution provides the capability to ingest [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel using the Codeless Connector Framework (CCF) and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/) for more information.\n\n**Underlying Microsoft Technologies used:**\r\n\n  a. [Codeless Connector Framework](https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector)\n\n  b. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) (for reference, legacy support)",
+  "Description": "The [Cloudflare](https://www.cloudflare.com/) solution ingests [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel from Azure Blob Storage. It supports multiple account and container instances with deterministic ingestion resources and account provenance.\n\n**Underlying Microsoft Technologies used:**\n\n  a. [Codeless Connector Framework](https://learn.microsoft.com/azure/sentinel/create-codeless-connector)\n\n  b. [Azure Monitor data collection rules](https://learn.microsoft.com/azure/azure-monitor/data-collection/data-collection-rule-overview)\n\n  c. [Azure Event Grid](https://learn.microsoft.com/azure/event-grid/overview) and [Azure Queue Storage](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)\n\n  d. [Azure deployment scripts](https://learn.microsoft.com/azure/azure-resource-manager/templates/deployment-script-template), which can create transient supporting resources and operational cost",
   "Data Connectors": [
     "Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_ConnectorDefinition.json"
   ],
@@ -38,7 +38,7 @@
   ],
   "Metadata": "SolutionMetadata.json",
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Cloudflare CCF",
-  "Version": "3.0.3",
+  "Version": "3.1.3",
   "TemplateSpec": true,
   "Is1PConnector": false
-}
+}

Solutions/Cloudflare CCF/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cloudflare](https://www.cloudflare.com/) solution provides the capability to ingest [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel using the Codeless Connector Framework (CCF) and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/) for more information.\n\n**Underlying Microsoft Technologies used:**\r\n\n  a. [Codeless Connector Framework](https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector)\n\n  b. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) (for reference, legacy support)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cloudflare](https://www.cloudflare.com/) solution ingests [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel from Azure Blob Storage. It supports multiple account and container instances with deterministic ingestion resources and account provenance.\n\n**Underlying Microsoft Technologies used:**\n\n  a. [Codeless Connector Framework](https://learn.microsoft.com/azure/sentinel/create-codeless-connector)\n\n  b. [Azure Monitor data collection rules](https://learn.microsoft.com/azure/azure-monitor/data-collection/data-collection-rule-overview)\n\n  c. [Azure Event Grid](https://learn.microsoft.com/azure/event-grid/overview) and [Azure Queue Storage](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)\n\n  d. [Azure deployment scripts](https://learn.microsoft.com/azure/azure-resource-manager/templates/deployment-script-template), which can create transient supporting resources and operational cost\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -452,7 +452,7 @@
     ],
     "outputs": {
       "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
-      "location": "[location()]",
+      "location": "[if(empty(location()), first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location)), location())]",
       "workspace": "[basics('workspace')]"
     }
   }