Cloudflare audit logs

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

Overview

Cloudflare audit logs record the history of changes made within your Cloudflare account, including account-level actions such as logins and zone configuration changes. Lakewatch ingests Cloudflare audit logs from cloud storage using Auto Loader and schematizes the data with the built-in cloudflare_audit parser. This is a cloud storage source, not an API connector.

Onboard Cloudflare audit logs

To ingest Cloudflare audit logs, create a cloud-storage datasource for it and attach the built-in cloudflare_audit parser so events are written to a schematized parsed table. For prerequisites, Unity Catalog access, and the full datasource setup steps, see Cloud storage.

Parsed schema and observables

The built-in cloudflare_audit parser schematizes Cloudflare audit logs into a parsed table. Every parsed table also carries the Lakewatch-managed columns:

• lw_id: A non-null string Lakewatch uses as the primary key, supporting deduplication across incremental reads.
• time: A non-null event timestamp assigned by the parser.
• lw_meta: Standard Lakewatch processing metadata.
• lw_observables: Values extracted from fields marked as security observables in the parser.

For more information, see the Parser reference.

Parsed table schema

The cloudflare_audit parser writes the following columns (generated from the parser definition):

Column	Data type
ActionResult	BOOLEAN
ActionType	STRING
ActorEmail	STRING
ActorID	STRING
ActorIP	STRING
ActorType	STRING
ID	STRING
Interface	STRING
Metadata	VARIANT
NewValue	VARIANT
OldValue	VARIANT
OwnerID	STRING
ResourceID	STRING
ResourceType	STRING
time	TIMESTAMP

Parser observables

The parser extracts the following fields into lw_observables (generated from the parser definition):

Field	Observable
ActorEmail	email
ActorID	actor_id
ActorID	username
ActorIP	ip
OwnerID	actor_id
OwnerID	username