启用 IBM QRadar

配置 QRadar/Cloudflare 集成时，可选择以下方法之一：

HTTP Receiver 协议

要将 Cloudflare 日志发送到 QRadar，需要通过 API 创建推送到 HTTP 端点的 Logpush 任务。下方提供两个 curl 示例，说明如何将 Cloudflare Firewall 事件与 Cloudflare HTTP 事件发送到 QRadar。

Cloudflare Firewall 事件

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "<NAME>",
		"output_options": {
				"field_names": [
						"Action",
						"ClientIP",
						"ClientASN",
						"ClientASNDescription",
						"ClientCountry",
						"ClientIPClass",
						"ClientRefererHost",
						"ClientRefererPath",
						"ClientRefererQuery",
						"ClientRefererScheme",
						"ClientRequestHost",
						"ClientRequestMethod",
						"ClientRequestPath",
						"ClientRequestProtocol",
						"ClientRequestQuery",
						"ClientRequestScheme",
						"ClientRequestUserAgent",
						"EdgeColoCode",
						"EdgeResponseStatus",
						"Kind",
						"MatchIndex",
						"Metadata",
						"OriginResponseStatus",
						"OriginatorRayID",
						"RayID",
						"RuleID",
						"Source",
						"Datetime"
				],
				"timestamp_format": "rfc3339"
		},
		"destination_conf": "<QRADAR_URL>:<LOG_SOURCE_PORT>",
		"max_upload_bytes": 5000000,
		"max_upload_records": 1000,
		"dataset": "firewall_events",
		"enabled": true
	}'

Cloudflare HTTP 事件

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "<NAME>",
		"output_options": {
				"field_names": [
						"ClientRequestMethod",
						"EdgeResponseStatus",
						"ClientIP",
						"ClientSrcPort",
						"CacheCacheStatus",
						"ClientCountry",
						"ClientDeviceType",
						"ClientIPClass",
						"ClientMTLSAuthCertFingerprint",
						"ClientMTLSAuthStatus",
						"ClientRegionCode",
						"ClientRequestBytes",
						"ClientRequestHost",
						"ClientRequestPath",
						"ClientRequestProtocol",
						"ClientRequestReferer",
						"ClientRequestScheme",
						"ClientRequestSource",
						"ClientRequestURI",
						"ClientRequestUserAgent",
						"ClientSSLCipher",
						"ClientSSLProtocol",
						"ClientXRequestedWith",
						"EdgeEndTimestamp",
						"EdgeRequestHost",
						"EdgeResponseBodyBytes",
						"EdgeResponseBytes",
						"EdgeServerIP",
						"EdgeStartTimestamp",
						"SecurityActions",
						"SecurityRuleIDs",
						"SecuritySources",
						"OriginIP",
						"OriginResponseStatus",
						"OriginSSLProtocol",
						"ParentRayID",
						"RayID",
						"SecurityAction",
						"WAFAttackScore",
						"SecurityRuleID",
						"SecurityRuleDescription",
						"WAFSQLiAttackScore",
						"WAFXSSAttackScore",
						"EdgeStartTimestamp"
				],
				"timestamp_format": "rfc3339"
		},
		"destination_conf": "<QRADAR_URL>:<LOG_SOURCE_PORT>",
		"max_upload_bytes": 5000000,
		"max_upload_records": 1000,
		"dataset": "http_requests",
		"enabled": true
	}'

Cloudflare 检查 IP 地址与端口的可达性，并验证 HTTP Receive 日志来源的证书。若所有参数有效，将创建 Logpush 并开始向 HTTP Receiver 日志来源发送事件。

Amazon AWS S3 Rest API

使用 Amazon S3 REST API 协议时，IBM QRadar 从 Amazon S3 bucket 收集 Cloudflare 日志事件。要使用此选项，你需要：

创建 Amazon S3 bucket ↗ 存储 Cloudflare 日志。记录 bucket 名称以及具有足够写入权限的 AWS access key ID 与 secret access key。
启用 Logpush 到 Amazon S3。
在 AWS Management Console 中，前往 Amazon S3 服务。创建 bucket 端点，允许 Cloudflare 直接将日志发送到 S3 bucket。
按照使用 Amazon AWS S3 REST API 协议将 Cloudflare 日志与 QRadar 集成 ↗ 的步骤操作。
通过在 Cloudflare 中生成一些日志并确认它们被传送到 S3 bucket 并随后转发到 QRadar 来测试配置。