Rapid7 and Cloudflare

InsightIDR Event Sources
1

I’m curious to know if anyone has any experience with ingesting Cloudflare log push jobs without using S3 buckets?

We’re currently in the process of setting up the following:

  1. CloudFlare Log push Job sends GZIP files to Azure Blob Storage
  2. Azure Function App runs every 5 mins to iterate over each blob and extract lines of logs
  3. Sends batches of logs to an event hub
  4. Configure Rapid7 to poll event hub for new events

Is this the easiest way to do it outside of S3 buckets? Does anyone have another working solution?

2

There is Graphl API as well in the plan before Enterprise

3

Getting CloudFlare into R7 is able (per papers) to get into Rapid7 via Azure Blob. Unfortunately there appears to be a number of things missing in the equation to make this work. So far there are two things more difficult: Salesforce sending a base-64 encoded log source and adding/configuring extensions.

I tried to do a webhook and several other methods to maybe bypass all this mess but CF has their method and it doesn’t team up well with R7. If anyone makes this work, please post how you did so.