Integrate Cloudflare SSE

Choose this option if your data source supports posting events to a webhook or HTTP endpoint with bearer-token authentication.

To configure Cloudflare log forwarding to a HTTP destination, do as follows:

1. In Sophos Fusion, go to Security Operations > Integrations > Marketplace.

2. Click Cloudflare SSE.

   The Cloudflare SSE page opens. You can configure integrations here and see a list of any you've already configured.

3. In Configured integrations, click Add new.

4. In HTTP Ingest, click Set Up.

5. Enter a name for the integration, then click Done.

   Copy the Integration Key and URL that are displayed.

   Copy these values immediately, as they will not be shown again.

   

6. Follow the steps in Cloudflare's own guide using the Integration Key and URL you saved: Enable HTTP destination.

7. Configure Logpush to send the following fields to Sophos XDR:

   Click to view firewall event fields.

   • Action
   • ClientASN
   • ClientASNDescription
   • ClientCountry
   • ClientIP
   • ClientIPClass
   • ClientRefererHost
   • ClientRefererPath
   • ClientRefererQuery
   • ClientRefererScheme
   • ClientRequestHost
   • ClientRequestMethod
   • ClientRequestPath
   • ClientRequestProtocol
   • ClientRequestQuery
   • ClientRequestScheme
   • ClientRequestUserAgent
   • Datetime
   • Description
   • EdgeColoCode
   • EdgeResponseStatus
   • Kind
   • MatchIndex
   • Metadata
   • OriginResponseStatus
   • OriginatorRayID
   • RayID
   • Ref
   • RuleID
   • Source
   Click to view HTTP requests event fields.

   • ClientASN
   • ClientCountry
   • ClientDeviceType
   • ClientIP
   • ClientIPClass
   • ClientRequestBytes
   • ClientRequestHost
   • ClientRequestMethod
   • ClientRequestPath
   • ClientRequestProtocol
   • ClientRequestReferer
   • ClientRequestScheme
   • ClientRequestSource
   • ClientRequestURI
   • ClientRequestUserAgent
   • ClientSrcPort
   • EdgeEndTimestamp
   • EdgeStartTimestamp
   • EdgeRateLimitAction
   • EdgeRateLimitID
   • EdgeRequestHost
   • EdgeResponseBytes
   • EdgeResponseContentType
   • EdgeResponseStatus
   • EdgeServerIP
   • SecurityActions
   • SecurityRuleIDs
   • SecuritySources
   • OriginIP
   • OriginResponseStatus
   • RayID
   • RequestHeaders
   • ResponseHeaders
   • SecurityAction
   • WAFAttackScore
   • SecurityRuleID
   • SecurityRuleDescription
   • ZoneID
   • ZoneName

Choose this option if your data source writes events to an S3 bucket you control, and you want to keep that bucket in your AWS account.

Create integration in Sophos XDR

To configure Cloudflare log forwarding via your own customer-managed AWS S3 bucket, do as follows:

1. In Sophos Fusion, go to Security Operations > Integrations > Marketplace.

2. Click Cloudflare SSE.

   The Cloudflare SSE page opens. You can configure integrations here and see a list of any you've already configured.

3. In Configured integrations, click Add new.

4. In Customer-managed S3, click Set Up.
5. Read the S3 information, then click Next.

6. Enter a name for the integration, then click Done.

   A sample AWS CloudFormation (.yaml) template is generated upon completion of the provisioning process. You'll use this when creating a Lambda stack.

   

Create the Lambda stack

To create the Lambda stack, do as follows:

1. Log in to the AWS Console for the region (for example, https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, Lambdas, secrets, and policies, or use a role that can assume another role with these permissions.
2. In the Management and Governance section, select CloudFormation.

3. Click Create stack.

   Note

   You may see a list of CloudFormation stacks when you select CloudFormation. If that's the case, click Create stack > With new resources (standard).

   

4. In the Prerequisite - Prepare Template section, click Choose an existing template.

5. In the Specify Template section, click Upload a template file > Choose file.

6. Upload the downloaded CloudFormation template (.yaml file).

   Storing the CloudFormation template in an S3 bucket.

   Instead of uploading the template file directly, you can store the CloudFormation template in an S3 bucket and specify the S3 URL when creating the stack.

   The bucket doesn't need to be public, versioned, or encrypted, but typically, the template bucket, notification bucket, and Lambda stack should be in the same AWS account and region.

7. Click Next.

8. Enter an appropriate stack name.

   Note

   Spaces aren't allowed in stack names.

9. In the IntegrationType drop-down, choose cloudflare.

   Note

   This field describes what sort of log objects are in the NotificationBucket. If there's more than one type, or you're not sure, choose generic.

   

10. In NotificationBucket, enter the bucket name (not a URL or URI) that houses the logs.

11. (Optional) Enter the appropriate value into SNSNotificationarn if you wish to use SNS notifications going forward instead of S3 notifications.
12. Leave the remaining fields as default.
13. Click Next.
14. Accept the acknowledgment statement: I acknowledge that AWS CloudFormation might create IAM resources.
15. Click Next.
16. Review all parameters and click Submit.

17. Wait at least 30 seconds, then click Refresh.

    The process may take a minute or more to finish. A status of CREATE_COMPLETE for the stack indicates the process has finished.

Add the Lambda trigger

Once the Lambda stack is created, add a trigger as follows:

1. In the AWS Console, go to the Lambda service.
2. Locate the new Lambda by name. The default name is {STACKNAME}-scwx-tdr-lambda-{INTEGRATIONTYPE}. For example, ct-demo-sophos-xdr-lambda-cloudflare.
3. Click the Lambda name to open the stack's edit page.
4. Expand the Function overview section and click Add Trigger.

5. In the Trigger Configuration editor, select S3 from the drop-down menu.

   Optionally, use an SNS trigger configured with a previously created topic.

6. From the Bucket options, find the bucket containing the logs and select it.

7. From the Event Type options, choose All Object Create Events.
8. In the Prefix field, enter the bucket prefix where the logs are located. Leave this blank if no prefix is used.
9. Leave the Suffix field blank.
10. Accept the acknowledgment statement about the cost impact of a Lambda function.

11. Click Add.

    The configuration page for that Lambda displays again. A message at the top indicates that the trigger was added successfully. For example, The trigger wmikeking was successfully added to function Logs-XDR-Upload.

    The function is now receiving events from the trigger.

Choose this option if your data source vendor requires an ownership challenge token to be sent to the S3 destination as proof of bucket ownership.

Create integration in Sophos XDR

To configure Cloudflare log forwarding to a Sophos-managed AWS S3 bucket, do as follows:

1. In Sophos Fusion, go to Security Operations > Integrations > Marketplace.

2. Click Cloudflare SSE.

   The Cloudflare SSE page opens. You can configure integrations here and see a list of any you've already configured.

3. In Configured integrations, click Add new.

4. In S3 Ingest - Sophos-Managed (with token), click Set Up.
5. Choose the IAM User authentication type.
6. Enter a name for the integration

7. For IAM User, enter the following:

   arn:aws:iam::391854517948:user/cloudflare-logpush
   

8. Click Done.

   The integration is created and the Configured Integrations table is shown.

9. Click the integration's name to open it.

10. Click the Details tab.

11. Note the following integration parameters listed in this tab:

    • AccessPointAlias
    • AWSRegion
    • LogsFolderPath

    You need these for configuring log forwarding in Cloudflare.

    

Configure log forwarding

1. Follow the steps in Cloudflare's own guide: Enable Amazon S3.

2. Configure the following parameters:

   • Bucket: Enter the AccessPointAlias value you got from Sophos XDR.
   • Path: Enter the LogsFolderPath value you got from Sophos XDR.
   • Organize logs into daily subfolders: Turn on.
   • My policy requires AWS SSE-S3 AES256 Server Side Encryption: Turn on.

3. Cloudflare will send a file to your designated destination to prove S3 bucket ownership.

   Reload the integration's Details tab in Sophos XDR and copy the new OwnershipToken value.

4. Enter the token in the Cloudflare dashboard to verify your access to the S3 bucket.