Connect Cloudflare

The Cloudflare connector reads your accounts, zones, DNS records, WAF custom rules, Workers, Access applications, audit logs and security events. With setup and response access it can also propose WAF rule changes and set up Logpush so Cloudflare sends HTTP request logs to Vigilbase. Every change still needs an approved plan.

Before you start

• You need the integration.manage and credential.manage permissions in Vigilbase OS.
• You need a Cloudflare user who can authorise access to the accounts you want to connect.

Connect with one click

1. 1

   Open Integrations, choose Add connection and select Cloudflare.

2. 2

   Choose Access. Read and write (recommended) lets Vigilbase propose response actions; nothing changes in Cloudflare until someone approves a plan. Read only means Vigilbase only reads.

3. 3

   Choose Continue with Cloudflare. Cloudflare shows one screen with two kinds of access: Read (accounts, zones, DNS, firewall rules, audit logs and security events) and Setup and response (set up Logpush and change WAF rules).

4. 4

   Choose your accounts and permissions on Cloudflare's screen. You can turn off any setup or response permission, or choose Read Only. Cloudflare grants permissions for every zone in the accounts you pick.

5. 5

   Pick the account if asked. If you authorised more than one account, choose which one this connection covers. Vigilbase then discovers its zones.

Vigilbase records exactly the permissions Cloudflare returned. Granting access changes nothing by itself.

Connect with an API token

If you prefer, choose Use an API token instead and create a scoped token in Cloudflare.

Give the read token these permissions: Zone > Zone > Read, Zone > DNS > Read, Zone > Zone WAF > Read, Account > Account Settings > Read, Account > Account Analytics > Read and Zone > Analytics > Read. To read Workers and Access applications, also add Workers Scripts Read and Access: Apps and Policies Read. Write permissions, such as Zone WAF Edit, are granted separately.

Change access later

On the connection page, open Setup & access.

• Change access re-runs the Cloudflare sign-in so you can add or remove setup and response permissions. You confirm it's you first.
• The Setup and response access table shows each capability and whether Cloudflare granted it.

Set up HTTP request logs

Security events show only requests that matched a rule. For complete HTTP request logs, Cloudflare must push them to Vigilbase with a Logpush job. Vigilbase can create the job for you once a person approves the plan.

1. 1

   Open the connection's Setup & access tab. Find Cloudflare HTTP request logs.

2. 2

   Choose Set up zones. The button shows how many zones can be set up. If it is missing, your connection lacks Logpush permission; choose Allow Logpush setup to grant it.

3. 3

   Select the zones and review. The dialog explains what Cloudflare bills and which fields Vigilbase asks for.

4. 4

   Choose Create plan. One plan covers all the Logpush zones you selected, and opens under Approvals.

5. 5

   Get the plan approved. With separation of duties on, someone other than you must approve it, unless your policy allows owners and admins to approve their own Logpush setup.

After approval, the zones table shows each zone's method, progress, last delivery and events in the last 24 hours. Progress goes from plan approved, to job created and validated, to first delivery.

What Vigilbase asks for

Each Logpush job asks for exactly 12 fields per request: RayID, EdgeStartTimestamp, ClientIP, ClientCountry, ClientASN, ClientRequestHost, ClientRequestMethod, ClientRequestPath, EdgeResponseStatus, CacheCacheStatus, SecurityAction and SecurityRuleID. It never asks for query strings, cookies or headers. Requests dropped by DDoS mitigation are excluded.

The token in each Logpush job is part of the job's destination in Cloudflare, so Cloudflare account admins and anyone who can edit Logpush can see it. Vigilbase stores only a digest of it.

Set up Logpush yourself

Choose Set up Logpush manually instead to create the job in Cloudflare yourself:

1. 1

   Choose a zone.

2. 2

   Generate its token. The token is for that one zone.

3. 3

   Create the job in Cloudflare. Copy the endpoint straight away; it is shown only once. Use the dataset, output type, timestamp format and max_upload_bytes shown on the page.

4. 4

   Wait for the first delivery. The zone shows Receiving logs once Vigilbase receives it.

Use Regenerate token or Revoke on a zone to replace or remove its manual token.

Stop Logpush

Choose Stop Logpush on a zone to create a removal plan. After approval, Vigilbase deletes the job in Cloudflare and revokes the zone's token.

Disabling the connection does not delete Logpush jobs in Cloudflare. The disable dialog warns you and offers Create removal plan first.

Response actions

With setup and response access, Vigilbase can propose these WAF changes:

• enable or disable a WAF custom rule
• block an IP address with a new WAF custom rule

Disabling a rule weakens protection, so those plans carry a warning. After execution, Vigilbase verifies the rule state, the rule's matches in security events and the edge error rate. See Verification.

What is not collected

• Zone settings, Gateway configuration, DNSSEC state and DNS analytics.
• Managed rulesets, rate limiting rules and account-level custom rulesets.
• Access policies: an Access application links to the hostnames it protects, not to people.
• Allowed requests that matched no rule, unless you set up HTTP request logs.