Hello,
We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone else ever had this issue?
Thank you,
Technically what the technician conveyed is true as they use the same underlying connector. However while both log sources use the same connector, it would make more sense to treat them as different datasources considering the functionality of these two datasources are different and the target detection rules or policies are likely to be completely different. Trust this makes sense.
As a best practice, we recommend creating a separate data source specifically for WAF logs, applying the correct parser and setting the Cloudflare Events Log Type to Firewall Adaptive Events logs. Also, please verify that your Cloudflare API token includes the appropriate permission scopes for WAF log access, since different log types require distinct permissions. This approach will help avoid access issues and ensure both log types are ingested correctly.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
