cloudflare

This download consists of Cloudflare Kibana dashboards example with the needed Ingest Node Pipeline and Index Template. Using this integration you have everything you need to analyse the logs from Cloudflare.

What is Cloudflare?

Cloudflare is one of the biggest networks operating on the Internet. People use Cloudflare services for the purposes of increasing the security and performance of their web sites and services. Cloudflare’s services sit between a website’s visitor and the Cloudflare customer’s hosting provider, acting as a reverse proxy for websites.

What are the Benefits of Cloudflare?

Using Cloudflare in front of your web application has a lot of benefits, like

  • Protection Against Malicious Traffic
  • Reduced Latency
  • Reduced Server Load
  • Universal SSL Certificate

How to setup the Kibana dashboard?

You can find the complete guide here.

Step 1 – Preparation

Before getting Cloudflare logs into Elastic you need to

  1. Install an AWS Lambda function, available in the file cloudflare-elastic-lambda.zip from GitHub at this location: https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.3-7.xOpen external link.
  2. Upload the cloudflare-elastic-lambda.zip file to an S3 bucket.

Step 2 – Deploy the contents from this download

Step 3 – Create the Lambda function in AWS

To create the Lambda function:

  1. Install the function: create the Lambda, which will read Cloudflare logs from S3 and import them into your Elastic cluster.
  2. Log in to your AWS console and navigate to the Lambda section. Create a new function, using the Java 8 runtime and give it a name such as cloudflare-elastic-logs.
  3. Configure the handler as com.cloudflare.elastic.ElasticLambdaForwarder::handleRequest and upload the function that we had previously saved to our S3 bucket.
  4. Configure the function. The Lambda function requires the following environment variables:
    • elastic_hostname: Copy the Elasticsearch endpoint URL from your deployment. Remove the port number and https:// prefix; for example: 2202aa790db546268248a5bd1e35aea6.us-west1.gcp.cloud.es.io.
    • elastic_username: Enter elastic.
    • elastic_password: Use the randomly generated password that was created for you.
  5. To connect your Cloudflare S3 log bucket. the last step is to tell the Lambda function to listen for events on the S3 bucket where your Cloudflare logs reside. Choose the S3 trigger type and configure it with the name of the S3 bucket. For Event type, select All object create events.
  6. Ensure your execution role is configured. In order for the function to be able to read logs from the S3 bucket, you may have to configure the execution role.
  7. View the execution role and add an inline policy that enables the function to read from the bucket.
  8. Give the policy a name and save it.
  9. Save the Lambda and start logging.
  10. Finally, save the Lambda configuration. Once it is saved, the Cloudflare logs will start showing up in Kibana on your Elastic Cloud deployment.
Tested versions 7.14
ECS compliant Yes

You must log in to submit a review.

Related downloads

OpenSIEM Logstash Parsing

Logstash Parsing Configurations for Elastic SIEM parses many different sources into ECS

Elastic Stack Monitoring Dashboard

Kibana dashboards that is showing the monitoring data collected by Elastics in built monitoring capabilities.

Logstash Meraki Pipeline

Logstash Pipeline to load Meraki logs via Syslog into Elasticsearch

ACSC Advisory IOCs detection rules

ACSC Advisory IOCs detection rules for Elastic SIEM

Plex ingest node pipeline

A plex ingest node pipeline to parse logs from Plex for Elasticsearch

These downloads could be also interesting for you

Terraform Elasticsearch environments

Terraform example scripts to deploy Elastic Cloud Clusters + all necessary components in AWS and GCP

Sigma Windows inbuilt detection rules

A collection of rules based on the Sigma rules for Windows (inbuilt folder) based on Winlogbeat data .

Kibana Maps with Open Weather Map

This is the default basemap of Kibana incl. the Open Weather Map tile for temperature, wind and pressure

Watch to detect large shards

This watch is getting data from the Elasticsearch shards API directly and checking for large shards.

Watcher History Dashboard

This dashboard shows the history of executed watcher jobs.

Google Cloud Log Ingestion dashboard

Canvas Board to analyze the log data collection of Google Cloud via Dataflow using the Google Cloud Metric module data