Configure Cloudflare WAF for Arctic Wolf monitoring using Log Explorer API

You can configure Cloudflare WAF® to send the necessary logs to Arctic Wolf® for security monitoring using Log Explorer API.

Note: If you use Cloudflare WAF Enterprise, follow Configure Cloudflare WAF for Arctic Wolf monitoring using Logpush instead. This guide is for Cloudflare WAF with the Log Explorer add-on only.

以下のリソースが必要です。

  • A Cloudflare WAF plan with the Log Explorer add-on.
  • A user with Super Administrator permissions

Create a Cloudflare API token

  1. Sign in to the Cloudflare Dashboard.
  2. In the navigation menu, select the account to configure from the drop-down list.
  3. Go to Manage Account > API Tokens.
  4. Click Create Token.
  5. In the Token name field, enter a unique and descriptive name.

    For example: Arctic Wolf - Log Monitoring

  6. In the Permission policies section, click Start from scratch.
  7. In Edit Policy, select Entire Account from the drop-down list.
  8. In the search for permission groups field, complete these steps:
    1. Search for Access: Audit Logs and then in Cloudflare One / Zero Trust > Access: Audit Logs select Read.
    2. Search for Account logs and then in Analytics & Logs > Account Logs select Read.
    3. Search for Account Settings and then in Account & Billing > Account Settings select Read.
  9. Click + Add policy.
  10. In Edit Policy, select All Domains from the drop-down list.
    1. Search for Zone and then in DNS & Zones > Zone select Read.
    2. Search for Zone Logs and then in Analytics & Logs > Zone Logs select Read.
  11. Set Token Expiration to No expiration.
  12. To restrict API calls to Arctic Wolf IP addresses, in the Client IP Address Filtering section, add the IP addresses found in the Arctic Wolf Unified Portal under Settings > Allowlist Requirements.
  13. Click Review Token and review the token details.
  14. Click Create Token.
  15. Copy the Account ID and API Token and save them in a safe, encrypted location. You will provide these values later.
    Note: The API token is only displayed once.

Get Zone IDs from the Cloudflare Dashboard

Note: The Cloudflare WAF API integration supports a maximum of 15 zones per account.
  1. In the Cloudflare WAF Dashboard, select the account that you used in Create a Cloudflare API token
  2. In the navigation menu, click Domains > Overview.
  3. For each domain that you want Arctic Wolf to monitor, click ... > Copy zone id and then save the ID in a safe, encrypted location to provide later.

Enable Firewall Events Log Explorer Dataset in Cloudflare

Repeat these steps for each domain (zone) that you want Arctic Wolf to monitor. If you add a domain later, repeat these steps to add the domain to monitoring.

  1. Sign in to Cloudflare Dashboard.
  2. Go to Log Explorer > Manage datasets, or go directly to the Manage datasets page.
  3. Select the account that you used in Create a Cloudflare API token.
  4. Click + Add dataset.
  5. From the Dataset list, select Firewall Events.
  6. From the Zone list, select the zone that you want to monitor.
  7. In the Select Fields section, click Select All to include all available fields.
  8. Leave the Filter logs section with the default values.
  9. Click Add.
    The dataset appears in the dataset list.

Enable HTTP Requests Log Explorer Dataset in Cloudflare

Repeat these steps for each domain (zone) that you want Arctic Wolf to monitor. If you add a domain later, repeat these steps to add the domain to monitoring.

  1. Sign in to Cloudflare Dashboard.
  2. Go to Log Explorer > Manage datasets, or go directly to the Manage datasets page.
  3. Select the account that you used in Create a Cloudflare API token.
  4. Click + Add dataset.
  5. From the Dataset list, select HTTP requests.
  6. From the Zone list, select the zone that you want to monitor.
  7. In the Select Fields section, click Select All to include all available fields.
  8. Leave the Filter logs section with the default values.
  9. Click Add.
    The dataset appears in the dataset list.

Provide Cloudflare WAF credentials to Arctic Wolf

Note:

Time-based events are polled with a delay to make sure that data is available. If API credentials fail, for example due to expired credentials, Arctic Wolf notifies you and requests a new set of credentials. Provide refreshed credentials promptly to ensure complete data polling and coverage.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. ナビゲーションメニューで、［データ収集］ > ［クラウドセンサ］をクリックします。
  3. Click Add Account +.
  4. On the Add Account page, click Cloudflare WAF API.
  5. Configure these settings:
  6. Click Test and submit credentials.