Cloudflare Logs 样本事件消息

使用这些样本事件消息来验证是否成功与 IBM QRadar集成。

重要信息: 由于格式化问题，请将消息格式粘贴到文本编辑器中，然后除去任何回车符或换行符。

Cloudflare 日志样本消息

示例1： 以下示例事件消息显示，向主机名 host.domain.test 发送了 HTTP ，服务器响应状态码为200。

{"ClientIP":"10.0.0.1","ClientRequestHost":"host.domain.test","ClientRequestMethod":"GET","ClientRequestURI":"/cdn-cgi/images/cf-icon-cloud.png","EdgeEndTimestamp":"2020-10-13T19:49:36Z","EdgeResponseBytes":1895,"EdgeResponseStatus":200,"EdgeStartTimestamp":"2020-10-13T19:49:36Z","RayID":"5e1b95b9ea390cc5","SecurityAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","SecurityRuleID":"","SecurityRuleDescription":"","CacheCacheStatus":"unknown","CacheResponseBytes":0,"CacheResponseStatus":0,"CacheTieredFill":false,"ClientASN":855,"ClientCountry":"xx","ClientDeviceType":"desktop","ClientIPClass":"noRecord","ClientRequestBytes":1049,"ClientRequestPath":"/cdn-cgi/images/cf-icon-cloud.png","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"http://host.domain.test/cdn-cgi/styles/main.css","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","ClientSSLCipher":"NONE","ClientSSLProtocol":"none","ClientSrcPort":53851,"ClientXRequestedWith":"","EdgeColoCode":"EWR","EdgeColoID":11,"EdgePathingOp":"unknown","EdgePathingSrc":"undef","EdgePathingStatus":"cloudflareInternalEndpoint","EdgeRequestHost":"","EdgeResponseCompressionRatio":1,"EdgeResponseContentType":"image/png","EdgeServerIP":"","SecurityActions":[],"SecurityRuleIDs":[],"SecuritySources":[],"OriginIP":"","OriginResponseBytes":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","ParentRayID":"00","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"ZoneID":304427638}
表 1. QRadar 事件有效内容中的字段名称和突出显示的值
QRadar 字段名称 事件有效内容中突出显示的值
事件标识 ClientRequestMethod + EdgeResponseStatus

对于示例中显示的 HTTP事件，事件 ID 由 ClientRequestMethod 字段和 EdgeResponseStatus 字段构成。 它们与字段之间的下划线并置在一起。
源 IP ClientIP
源端口 ClientSrcPort
设备时间 EdgeStartTimestamp

示例2： 以下示例事件消息显示，一个 HTTP 请求被发送到主机名 host.domain.test ，服务器响应的状态码为200。

{"ClientRequestMethod":"POST","ClientIP":"10.0.0.1","ClientSrcPort":53851,"CacheCacheStatus":"dynamic","ClientCountry":"xx","ClientDeviceType":"desktop","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"","ClientMTLSAuthStatus":"unknown","ClientRegionCode":"xx","ClientRequestBytes":2935,"ClientRequestHost":"host.domain.test","ClientRequestPath":"/console/test/QRadar.getAlertMessages","ClientRequestProtocol":"HTTP/2","ClientRequestReferer":"https://host.domain.test/console/qradar/jsp/test.jsp","ClientRequestScheme":"https","ClientRequestSource":"eyeball","ClientRequestURI":"/console/test/QRadar.getAlertMessages","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Firefox/108.0","ClientSSLCipher":"None","ClientSSLProtocol":"TLSv1.3","ClientXRequestedWith":"","EdgeRequestHost":"host.domain.test","EdgeResponseBodyBytes":50,"EdgeResponseBytes":805,"EdgeServerIP":"10.0.0.1","SecurityActions":["allow"],"SecurityRuleIDs":["66668d0ae9c2222222222a600d17448"],"SecuritySources":["firewallRules"],"OriginIP":"10.0.0.1","OriginResponseStatus":200,"OriginSSLProtocol":"TLSv1.2","ParentRayID":"00","RayID":"78b4476e33333af2","SecurityAction":"unknown","WAFAttackScore":0,"SecurityRuleID":"","SecurityRuleDescription":"","WAFSQLiAttackScore":0,"WAFXSSAttackScore":0,"EdgeEndTimestamp":"2023-01-19T11:37:33Z","EdgeStartTimestamp":"2023-01-19T11:37:33Z","EdgeResponseStatus":200}
表 2. QRadar 事件有效内容中的字段名称和突出显示的值
QRadar 字段名称 事件有效内容中突出显示的值
事件标识 ClientRequestMethod + EdgeResponseStatus

对于示例中显示的 HTTP事件，事件 ID 由 ClientRequestMethod 字段和 EdgeResponseStatus 字段构成。 它们与字段之间的下划线并置在一起。
源 IP ClientIP
源端口 ClientSrcPort
设备时间 EdgeStartTimestamp

示例 3： 以下示例事件消息显示，一个 HTTP 请求被发送到主机名 host.domain.test ，服务器响应的状态码为 403。

{"ClientRequestMethod":"GET","ClientIP":"10.0.0.1","ClientSrcPort":53851,"CacheCacheStatus":"unknown","ClientCountry":"xx","ClientDeviceType":"desktop","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"","ClientMTLSAuthStatus":"unknown","ClientRegionCode":"xx","ClientRequestBytes":2927,"ClientRequestHost":"host.domain.test","ClientRequestPath":"/api/gui_app_framework/test","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Firefox/108.0","ClientSSLCipher":"None","ClientSSLProtocol":"TLSv1.3","ClientXRequestedWith":"","EdgeRequestHost":"","EdgeResponseBodyBytes":1751,"EdgeResponseBytes":2166,"EdgeServerIP":"","SecurityActions":["allow","block"],"SecurityRuleIDs":["66668d0ae9c2222222222a600d17448","111106BNULL"],"SecuritySources":["firewallRules","waf"],"OriginIP":"","OriginResponseStatus":0,"OriginSSLProtocol":"unknown","ParentRayID":"00","RayID":"78b4476e33333af2","SecurityAction":"drop","WAFAttackScore":0,"SecurityRuleID":"111106BNULL","SecurityRuleDescription":"SQLi - IS NULL","WAFSQLiAttackScore":0,"WAFXSSAttackScore":0,"EdgeEndTimestamp":"2023-01-19T13:06:18Z","EdgeStartTimestamp":"2023-01-19T13:06:18Z","EdgeResponseStatus":403}
表 3. QRadar 事件有效内容中的字段名称和突出显示的值
QRadar 字段名称 事件有效内容中突出显示的值
事件标识 ClientRequestMethod + EdgeResponseStatus

对于示例中显示的 HTTP事件，事件 ID 由 ClientRequestMethod 字段和 EdgeResponseStatus 字段构成。 它们与字段之间的下划线并置在一起。
源 IP ClientIP
源端口 ClientSrcPort
设备时间 EdgeStartTimestamp

示例 4： 以下示例事件消息显示，一个 HTTP 未修改请求被发送到主机名 host.domain.test ，服务器响应的状态码为 304。

{"ClientRequestMethod":"GET","ClientIP":"10.0.0.1","ClientSrcPort":53851,"CacheCacheStatus":"miss","ClientCountry":"xx","ClientDeviceType":"desktop","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"","ClientMTLSAuthStatus":"unknown","ClientRegionCode":"xx","ClientRequestBytes":2682,"ClientRequestHost":"host.domain.test","ClientRequestPath":"/console/test/1057/static/js/test.js","ClientRequestProtocol":"HTTP/2","ClientRequestReferer":"https://host.domain.test/console/plugins/1057/","ClientRequestScheme":"https","ClientRequestSource":"eyeball","ClientRequestURI":"/console/test/1057/static/js/test.js","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Firefox/108.0","ClientSSLCipher":"None","ClientSSLProtocol":"TLSv1.3","ClientXRequestedWith":"","EdgeRequestHost":"host.domain.test","EdgeResponseBodyBytes":0,"EdgeResponseBytes":366,"EdgeServerIP":"10.0.0.1","SecurityActions":["allow"],"SecurityRuleIDs":["6666d0ae9c2222222222a600d17448"],"SecuritySources":["firewallRules"],"OriginIP":"10.0.0.1","OriginResponseStatus":304,"OriginSSLProtocol":"TLSv1.2","ParentRayID":"00","RayID":"78b4476e33333af2","SecurityAction":"unknown","WAFAttackScore":0,"SecurityRuleID":"","SecurityRuleDescription":"","WAFSQLiAttackScore":0,"WAFXSSAttackScore":0,"EdgeEndTimestamp":"2023-01-19T13:06:15Z","EdgeStartTimestamp":"2023-01-19T13:06:14Z","EdgeResponseStatus":304}
表 4。 QRadar 事件有效内容中的字段名称和突出显示的值
QRadar 字段名称 事件有效内容中突出显示的值
事件标识 ClientRequestMethod + EdgeResponseStatus

对于示例中显示的 HTTP事件，事件 ID 由 ClientRequestMethod 字段和 EdgeResponseStatus 字段构成。 它们与字段之间的下划线并置在一起。
源 IP ClientIP
源端口 ClientSrcPort
设备时间 EdgeStartTimestamp

示例 5： 以下示例事件消息显示，一个 HTTP 防火墙请求发送到了主机名 host.domain.test ，服务器响应的状态码为 200。

{"Action":"allow","ClientIP":"10.0.0.1","ClientASN":45116,"ClientASNDescription":"GTPL-AS-AP Gujarat Telelink Pvt Ltd","ClientCountry":"xx","ClientIPClass":"noRecord","ClientRefererHost":"host.domain.test","ClientRefererPath":"/console/test/jsp/test.jsp","ClientRefererQuery":"","ClientRefererScheme":"https","ClientRequestHost":"host.domain.test","ClientRequestMethod":"POST","ClientRequestPath":"/console/test/QRadar.getIngressNewVersion","ClientRequestProtocol":"HTTP/2","ClientRequestQuery":"","ClientRequestScheme":"https","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Firefox/108.0","EdgeColoCode":"BOM","EdgeResponseStatus":200,"Kind":"firewall","MatchIndex":0,"Metadata":{"filter":"007b761e8a762222222f4528222ebe67","type":"customer"},"OriginResponseStatus":200,"OriginatorRayID":"00","RayID":"78b4476e33333af2","RuleID":"6538d0a111114f6aad22222600d17448","Source":"firewallrules","Datetime":"2023-01-19T11:58:00Z"}
表 5。 QRadar 事件有效内容中的字段名称和突出显示的值
QRadar 字段名称 事件有效内容中突出显示的值
事件标识 ClientRequestMethod + EdgeResponseStatus

对于样本中显示的 "防火墙请求" 事件，将使用 ClientRequestMethod 字段和 EdgeResponseStatus 字段来构造事件标识。 它们与字段之间的下划线并置在一起。
源 IP ClientIP
设备时间 Datetime

示例 6： 以下示例事件消息表明 HTTP与防火墙规则匹配，防火墙将拒绝连接请求。

{"Datetime":"2020-11-12T02:52:18Z","RayName":"5f0cf4c5fc8ce76c","Source":"firewallrules","RuleId":"6e40b9ea4da54b22a112626996d3111f","Action":"drop","EdgeColoName":"EWR","ClientIP":"10.0.0.1","ClientCountryName":"xx","ClientASNDescription":"ASN-DESCRIPTION","UserAgent":"curl/7.29.0","ClientRequestHTTPMethodName":"GET","ClientRequestHTTPHost":"host.domain.test"}
表 6。 QRadar 事件有效内容中的字段名称和突出显示的值
QRadar 字段名称 事件有效内容中突出显示的值
事件标识 Action
源 IP ClientIP
设备时间 Datetime