Cloudflare audit logs
Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.
Overview
Cloudflare audit logs record the history of changes made within your Cloudflare account, including account-level actions such as logins and zone configuration changes. Lakewatch ingests Cloudflare audit logs from cloud storage using Auto Loader and schematizes the data with the built-in cloudflare_audit parser. This is a cloud storage source, not an API connector.
Onboard Cloudflare audit logs
To ingest Cloudflare audit logs, create a cloud-storage datasource for it and attach the built-in cloudflare_audit parser so events are written to a schematized parsed table. For prerequisites, Unity Catalog access, and the full datasource setup steps, see Cloud storage.
Parsed schema and observables
The built-in cloudflare_audit parser schematizes Cloudflare audit logs into a parsed table. Every parsed table also carries the Lakewatch-managed columns:
lw_id: A non-null string Lakewatch uses as the primary key, supporting deduplication across incremental reads.time: A non-null event timestamp assigned by the parser.lw_meta: Standard Lakewatch processing metadata.lw_observables: Values extracted from fields marked as security observables in the parser.
For more information, see the Parser reference.
Parsed table schema
The cloudflare_audit parser writes the following columns (generated from the parser definition):
Column | Data type |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Parser observables
The parser extracts the following fields into lw_observables (generated from the parser definition):
Field | Observable |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|