Skip to content

[Cloudflare Logpush] Add support for new fields and Page Shield data stream #9809

New issue
New issue
Closed
#12782
Closed
[Cloudflare Logpush] Add support for new fields and Page Shield data stream#9809
#12782
Assignees
efd6
Labels
Integration:cloudflare_logpushCloudflare LogpushTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]mapping/pipeline issue
@chemamartinez

Description

@chemamartinez
chemamartinez
opened on May 7, 2024

Cloudflare has updated most of its event datasets with new fields that the integration doesn't support. Here there is a table with the fields that are missed so far.

Data stream Fields Type
dns_firewall ResponseReason string
firewall ContentScanObjResults array[string]
ContentScanObjSizes array[int]
ContentScanObjTypes array[string]
LeakedCredentialCheckResult string
MatchIndex int
Ref string
gateway_dns AccountID string
ApplicationName string
AuthoritativeNameServerIPs array[string]
CNAMECategoryIDs array[int]
CNAMECategoryNames array[string]
CNAMEs array[string]
CNAMEsReversed array[string]
CustomResolveDurationMs int
CustomResolverAddress string
CustomResolverPolicyID (deprecated) string
CustomResolverPolicyName (deprecated) string
CustomResolverResponse string
DoHSubdomain string
DoTSubdomain string
EDEErrors array[int]
InitialCategoryIDs array[int]
InitialCategoryNames array[string]
IsResponseCached bool
MatchedIndicatorFeedIDs array[int]
MatchedIndicatorFeedNames array[string]
PolicyName string
QueryID string
QueryIndicatorFeedIDs array[int]
QueryIndicatorFeedNames array[string]
ResolvedIPCategoryIDs array[int]
ResolvedIPCategoryNames array[string]
ResolvedIPContinentCodes array[string]
ResolvedIPCountryCodes array[string]
ResourceRecords array[object]
ResourceRecordsJSON string
SrcIPContinentCode string
SrcIPCountryCode string
gateway_http ApplicationIDs array[int]
ApplicationNames array[string]
CategoryIDs array[int]
CategoryNames array[string]
DestinationIPContinentCode string
DestinationIPCountryCode string
DownloadMatchedDlpProfileEntries * array[string]
DownloadMatchedDlpProfiles * array[string]
ForensicCopyStatus * string
PrivateAppAUD * string
ProxyEndpoint string
Quarantined * bool
SessionID string
SourceIPContinentCode string
SourceIPCountryCode string
UploadMatchedDlpProfileEntries * array[string]
UploadMatchedDlpProfiles * array[string]
VirtualNetworkID string
VirtualNetworkName string
gateway_network ApplicationIDs array[int]
ApplicationNames array[string]
CategoryIDs array[int]
CategoryNames array[string]
DestinationIPContinentCode string
DestinationIPCountryCode string
DetectedProtocol string
ProxyEndpoint string
SourceIPContinentCode string
SourceIPCountryCode string
TransportProtocol string
VirtualNetworkID string
VirtualNetworkName string
http_request BotDetectionTags array[string]
CacheReserveUsed bool
ClientCity string
ClientLatitude string
ClientLongitude string
ClientRegionCode string
ContentScanObjResults array[string]
ContentScanObjSizes array[int]
ContentScanObjTypes array[string]
LeakedCredentialCheckResult string
network_analytics AttackVector string
ColoCity string
ColoCode string
DestinationASNName string
IPTTL int
IPTTLBuckets int
IPv4DSCP int
IPv4ECN int
IPv6DSCP int
IPv6ECN int
RuleName string
SourceASNName string
TCPMSS int
TCPSACKBlocks string
TCPSACKPermitted int
TCPTimestampECR int
network_session DetectedProtocol string
workers_trace Entrypoint string
ScriptVersion object

Reference: https://developers.cloudflare.com/logs/reference/log-fields/

Also new datasets have been added:

Data stream Fields Type
page_shield_events Action string
CSPDirective string
Host string
PageURL string
PolicyID string
ResourceType string
Timestamp int or string
URL string
URLContainsCDNCGIPath (deprecated) bool
URLHost string
dlp_forensic_copies AccountID string
Datetime int or string
ForensicCopyID string
GatewayRequestID string
Headers object
Payload string
Phase string
TriggeredRuleID string
email_security_alerts AlertID string
AlertReasons array[string]
Attachments array[object]
CC array[string]
CCName array[string]
FinalDisposition string
From string
FromName string
Links array[string]
MessageDeliveryMode string
MessageID string
Origin string
OriginalSender string
ReplyTo string
ReplyToName string
SMTPEnvelopeFrom string
SMTPEnvelopeTo array[string]
SMTPHeloServerIP string
SMTPHeloServerIPAsName string
SMTPHeloServerIPAsNumber string
SMTPHeloServerIPGeo string
SMTPHeloServerName string
Subject string
ThreatCategories array[string]
Timestamp int or sting
To array[string]
ToName array[string]

Metadata

Metadata

Assignees

Labels

Integration:cloudflare_logpushCloudflare LogpushTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]mapping/pipeline issue

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions