SIEM: HEC - Cloudflare

TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: HTTP Event Collector (HEC)
ENVIRONMENT: Cloudflare
SUMMARY: Configuration Guide for Keeper Security

• Vendor Information
• Configuration Checklist

Vendor Information

Configuration Checklist

Part 1 - Authentication Token Creation within Huntress Dashboard

1. Open the Huntress Portal.
2. Hover over SIEM on the left navigation menu.
3. Click Source Management.

4. Click Add Source and select Cloudflare.

5. Click add.

6. Set Configuration Details and Save:
   • Select the appropriate Organization from the dropdown.
   • Enter a unique name of the source.
   • (Optional) Enter a description for the source.

7. Record the HTTP Event Collector Token.

Note: Keep this secure as it is the equivalent of a password

Part 2 - Setting up Logpush within Cloudflare

This feature requires Cloudflare Enterprise.

1. Log in to Cloudflare using admin credentials.
2. Head to Logs section (Analytics & Logs > Logpush OR Search Logpush).
3. Create a Logpush Job.
4. Select ‘Splunk’ as the Destination.

5. Enter in the information from the Huntress created source:
   • Splunk raw HTTP Event Collector URL: Add ‘/raw’ add to the end if it’s not there already.
   • Channel ID: Create a random GUID using a tool like guidgenerator.com.
   • Auth Token: Add ‘Splunk ’ to the beginning as shown (note the space between Splunk and the token).
   • Source type: Use cloudflare:json for ease.

6. Select the datasets you are interested in pushing to Huntress, we would suggest Access Requests and Audit Logs at minimum.

7. Leave everything else as standard and save the Logpush configuration.