QRadar: How to integrate Cloudflare by using HTTP Receiver protocol

Environment

1. Registration
2. Verification
3. Response
4. Completion

1. Registration: register a LogPush from administrator's workstation by running a curl command with necessary parameters as described at Configure Cloudflare to send events to IBM QRadar when you use the HTTP Receiver protocol. (QRadar Console or managed host can be used instead).
   The most important registration parameter is "destination_conf": "<QRadar_URL:LogSource_Port>"
2. Verification: Cloudflare checks the accessibility of the IP address, port, and validates the certificate of the HTTP Receive log source.  
3. Response:  
   • Context deadline exceeded

     If the endpoint is not accessible, the following error is returned:

     {"errors":[{"code":1002,"message":"error validating destination: error writing object: Post \"https://a.b.c.d:12469\": context deadline exceeded"}],"messages":[],"result":null,"success":false}
     

   • Cannot validate certificate

     If the endpoint is accessible, Cloudflare then checks the certificate of the HTTP Receiver log source. If the default TLS Syslog certificate is used, the following error is returned:

     {"errors":[{"code":1002,"message":"error validating destination: error writing object: Post \"https://a.b.c.d:12469\": x509: cannot validate certificate for a.b.c.d because it doesn't contain any IP SANs"}],"messages":[],"result":null,"success":false}
     

   • Certificate signed by an unknown authority

     Even if the administrator has a self-signed certificate with proper public IP address in "Subject Alternative Name" session, Cloudflare still complains that the certificate must be commercially signed:

     {"errors":[{"code":1002,"message":"error validating destination: error writing object: Post \"https://a.b.c.d:12469\": x509: certificate signed by unknown authority"}],"messages":[],"result":null,"success":false}

     However, many CA providers do not support public IP address in the CN. Therefore, the recommended way is to have an FQDN in the CN. Any included IP address must be put in the SAN session.

4. Completion: If all parameters are valid, a LogPush is created, and starts to send events to HTTP Receiver log source