Add Cloudflare Security Events CCF connector (GraphQL Analytics API)#1
Draft
Tom Plant (pl4nty) wants to merge 5 commits into
Draft
Conversation
…API) Adds a Codeless Connector Framework (CCF) RestApiPoller connector that ingests Cloudflare security/firewall events into Microsoft Sentinel via the Cloudflare GraphQL Analytics API (firewallEventsAdaptive dataset, queried at account scope). - POST to https://api.cloudflare.com/client/v4/graphql with a templated GraphQL body (queryParametersTemplate + isPostPayloadJson), injecting the account tag via parameters('accountId') and the poll window via the {_QueryWindowStartTime}/{_QueryWindowEndTime} tokens. - Bearer API token auth (Account Analytics > Read scope). - DCR maps the camelCase GraphQL fields to PascalCase columns and derives TimeGenerated from the event datetime. - New custom table CloudflareSecurityEvents_CL (90-day retention) with a broadly-available core field set (34 columns) chosen for compatibility across Cloudflare plans/entitlements. Mirrors the structure of the sibling CloudflareApi_CCF (audit logs) connector.
Signed-off-by: GitHub <noreply@github.com>
The transformKql failed to compile (InvalidTransformQuery) because the incoming column 'datetime' is parsed as the KQL datetime type keyword, and 'source' collides with the transform's implicit input table name. Reference all incoming columns with bracket notation (['datetime'], ['source'], ...) and use a single project to rename to the PascalCase table columns.
Apply the same bracket-quoted column reference fix to the transformKql embedded in the packaged mainTemplate.json and 3.0.4.zip, so the deployed artifact matches the corrected DCR and the data collection rule compiles.
Align with the project convention (PascalCase columns, simple transform) and
remove the brittle bracket-quoted rename.
- Do the camelCase->PascalCase mapping in the GraphQL query itself via field
aliases (e.g. 'Action: action', 'TimeGenerated: datetime'), so the polled
payload already uses the table's column names.
- DCR stream now declares PascalCase columns (TimeGenerated typed datetime,
which parses the ISO8601 value), so the transform collapses to 'source'.
- This also sidesteps the KQL reserved-word collisions ('datetime', 'source')
that forced the previous bracket-quoted project.
Applied to the source files and the packaged mainTemplate.json / 3.0.4.zip.
Verified the full aliased query against the live GraphQL API (HTTP 200, no
errors, all 34 PascalCase fields returned).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Codeless Connector Framework (CCF)
RestApiPollerdata connector that ingests Cloudflare security / firewall events into Microsoft Sentinel via the Cloudflare GraphQL Analytics API (firewallEventsAdaptivedataset, queried at account scope).It lives alongside the existing
CloudflareApi_CCF(audit logs) andCloudflareLog_CCFconnectors in the Cloudflare CCF solution and mirrors their four-file structure.New folder:
Solutions/Cloudflare CCF/Data Connectors/CloudflareSecurityEvents_CCF/CloudflareSecurityEvents_ConnectorDefinition.jsonCloudflareSecurityEventsDefinition)CloudflareSecurityEvents_PollerConfig.jsonRestApiPollerpolling config (GraphQL POST)CloudflareSecurityEvents_DCR.jsonCloudflareSecurityEvents_Table.jsonCloudflareSecurityEvents_CL(90-day retention)How it works
https://api.cloudflare.com/client/v4/graphqlwith a templated GraphQL body (queryParametersTemplate+isPostPayloadJson: true).parameters('accountId'); the poll window is injected via the CCF{_QueryWindowStartTime}/{_QueryWindowEndTime}tokens (queryTimeFormat: yyyy-MM-ddTHH:mm:ssZ,queryWindowInMin: 10).Account Analytics > Readscope).TimeGeneratedfrom the eventdatetime.Validation
The exact GraphQL query embedded in
queryParametersTemplatewas tested live against the Cloudflare GraphQL API:concat(...)resolution simulated → produces valid JSON body with the correctaccountTagand time tokens.dataType/table name, andconnectorDefinitionName/definition id are all consistent.Conventions followed (per Azure/Azure-Sentinel PR Azure#13317 feedback)
httpMethod/queryWindowInMinhardcoded (not parameterized).dataTypematches the table name;connectorDefinitionNamematches the definition id; definition file name matches id.retentionInDaysset; connector markedisPreview: true.Design decisions / notes
ZoneTagis included so events remain attributable per-zone.botScore*, WAF Attack Scorewaf*Score, Content Scanning, Leaked Credentials, JA3/JA4, Firewall-for-AI, fraud, API Shield, attack-signature fields) were excluded from v1 — requesting a field not present in a customer's GraphQL schema fails the whole query. These can be added as optional/enriched variants later.firewallEventsAdaptiveis cursor-less, so the query usesorderBy: [datetime_ASC]withlimit: 10000per poll window (the API max). Very high-volume accounts exceeding 10k events per 10-minute window may need a smallerqueryWindowInMin.Follow-ups (not in this PR)
Package/mainTemplate.json+createUiDefinition.json, bump solution version, addReleaseNotes.mdentry.CloudflareSecurityEvents_CL.https://claude.ai/code/session_01Ayem6m5j3y4xFsydDW1FBv
Generated by Claude Code