ingestion labels for cloudflare & zscaler internet access logs

[kaushalpatel]

what is the correct log type OR ingestion label to use in the chronicle forwarder configuration for the following logs ?

Cloudflare Network Analytics Logs
Zscaler internet access Web Logs

[Rene_Figueroa]

Hi, 

You can find our current labels (with and without default parsers) on our public documentation:

https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers

You can simply search for it. 

For "Zscaler internet access Web Logs", we have ZSCALER_INTERNET_ACCESS . For "Cloudflare Network Analytics Logs", we have 3 existing log types:

1. CLOUDFLARE_WAF
2. CLOUDFLARE
3. CLOUDFLARE_AUDIT

I think the closest one might be CLOUDFLARE; you can try that and review the parser in case the logs are not parsed. CLOUDFLARE parser use these references for the development:

# https://www.ibm.com/docs/en/dsm?topic=logs-cloudflare-sample-event-messages,

# https://developers.cloudflare.com/logs/reference/waf-fields,

# Cloudflare Audit - https://developers.cloudflare.com/logs/reference/log-fields/account/audit_logs,

# Cloudflare Gateway DNS - https://developers.cloudflare.com/logs/reference/log-fields/account/gateway_dns,

# Cloudflare Gateway HTTP - https://developers.cloudflare.com/logs/reference/log-fields/account/gateway_http

# Cloudflare Zero Trust Network Session - https://developers.cloudflare.com/logs/reference/log-fields/account/zero_trust_network_sessions/

# Cloudflare Access Requests - https://developers.cloudflare.com/logs/reference/log-fields/account/access_requests/

# Cloudflare CASB Findings - https://developers.cloudflare.com/logs/reference/log-fields/account/casb_findings/

# Cloudflare Gateway Network - https://developers.cloudflare.com/logs/reference/log-fields/account/gateway_network/

[kaushalpatel]

I see only available parser for Zscaler is for Zscaler internet access Audit logs
Do i have to create the manual parser for non audit log types ?

[Rene_Figueroa]

You can check if our other Zscaler log types (parsers) cover the non-audit logs. If you determine none of our existing log types cover your logs, you can request a new log type. 

[kaushalpatel]

what is the process to request a new log type ?

[Rene_Figueroa · Accepted solution]

You need to open a support case with us. 

https://cloud.google.com/chronicle/docs/getting-support

Please provide the public documentation for the log source as well. Thank you!