Skip to content

Commit 06ec980

Browse files
ranbelranbel
committed
Merge branch 'production' into ranbel/cf1-dash-updates
merge in ia changes
2 parents 4fb3214 + b92d393 commit 06ec980

File tree

4 files changed

+60
-17
lines changed

4 files changed

+60
-17
lines changed

‎src/content/changelog/logs/2025-10-27-Sentinel-connector.mdx‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: "Azure Sentinel Connector"
3+
description: "New Azure Sentinel Connector based on Codeless Connector Framework (CCF)"
4+
date: "2025-10-27"
5+
---
6+
7+
Logpush now supports integration with [Microsoft Sentinel](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel).The new Azure Sentinel Connector built on Microsoft’s Codeless Connector Framework (CCF), is now avaialble. This solution replaces the previous Azure Functions-based connector, offering significant improvements in security, data control, and ease of use for customers. Logpush customers can send logs to Azure Blob Storage and configure this new Sentinel Connector to ingest those logs directly into Microsoft Sentinel.
8+
9+
This upgrade significantly streamlines log ingestion, improves security, and provides greater control:
10+
11+
- Simplified Implementation: Easier for engineering teams to set up and maintain.
12+
- Cost Control: New support for Data Collection Rules (DCRs) allows you to filter and transform logs at ingestion time, offering potential cost savings.
13+
- Enhanced Security: CCF provides a higher level of security compared to the older Azure Functions connector.
14+
- ata Lake Integration: Includes native integration with Data Lake.
15+
16+
Find the new solution [here](https://marketplace.microsoft.com/en-us/product/azure-application/cloudflare.azure-sentinel-solution-cloudflare-ccf?tab=Overview) and refer to the [Cloudflare's developer documention](https://developers.cloudflare.com/analytics/analytics-integrations/sentinel/#supported-logs:~:text=WorkBook%20fields,-Analytic%20rules)for more information on the connector, including setup steps, supported logs and Microsfot's resources.

‎src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx‎

Lines changed: 31 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66
label: Add a self-hosted private application
77
---
88

9-
import { Render } from "~/components";
9+
import { Render, GlossaryTooltip, } from "~/components";
1010

1111
You can configure a self-hosted Access application to manage access to specific IPs or hostnames on your private network.
1212

@@ -29,36 +29,50 @@ This feature replaces the legacy [private network app type](/cloudflare-one/acce
2929
params={{ private: true }}
3030
/>
3131

32-
6. Add the private IP and/or private hostname that represents the application. You can use [wildcards](/cloudflare-one/access-controls/policies/app-paths/) with private hostnames to protect multiple parts of an application that share a root path.
32+
6. To add an application using its private IP:
33+
1. Select **Add private IP**.
34+
2. In **IP address**, enter the private IP or CIDR range that represents the application (for example, `10.0.0.1` or `172.16.0.0/12`).
35+
3. In **Port**, enter a single port or a port range used by your application (for example, `22` or `8000-8099`).
3336

34-
:::note
35-
Private hostnames are currently only available over port `443` over HTTPS and the application must have a valid Server Name Indicator (SNI). If you are configuring a private IP on any port other than `443` and plan to use Browser Isolation, note that this [will result in a Gateway block page](/cloudflare-one/remote-browser-isolation/known-limitations/#browser-isolation-is-not-compatible-with-private-ips-on-non-443-ports).
36-
:::
37+
Comma-separated lists of ports (such as `80, 443`) are not supported. To add multiple ports for a specific IP, you can select **Add private IP** and repeat the IP address with the other port. Alternatively, create a new Access application for the other port.
3738

38-
7. <Render file="access/add-access-policies" product="cloudflare-one" />
39+
7. To add an application using its private hostname:
40+
1. Select **Add private hostname**.
41+
2. In **Hostname**, enter the private hostname of the application (for example, `wiki.internal.local`). You can use [wildcards](/cloudflare-one/access-controls/policies/app-paths/) with private hostnames to protect multiple parts of an application that share a root path.
42+
3. In **Port**, enter a single port or a port range used by your application (for example, `22` or `8000-8099`).
3943

40-
8. Configure how users will authenticate:
44+
:::note
45+
- **HTTPS applications**: Private hostnames explicitly set to port `443` (not including port ranges such as `441-444`) must have a valid Server Name Indicator (SNI).
46+
- **Non-HTTPS applications**: Private hostnames on non-`443` ports do not require a valid SNI value will be assigned an <GlossaryTooltip term="initial resolved IP">initial resolved IP</GlossaryTooltip> in the CGNAT space. Ensure that the following IP addresses are not blocked by any firewalls or excluded from Gateway traffic:
47+
48+
<Render file="gateway/egress-selector-cgnat-ips" product="cloudflare-one"/>
49+
50+
For more details on private hostname routing, refer to [Connect a private hostname](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#prerequisites)
51+
52+
8. <Render file="access/add-access-policies" product="cloudflare-one" />
53+
54+
9. Configure how users will authenticate:
4155

4256
1. Select the [**Identity providers**](/cloudflare-one/integrations/identity-providers/) you want to enable for your application.
4357
2. (Recommended) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/reusable-components/custom-pages/access-login-page/). Instead, Cloudflare will redirect users directly to your SSO login event.
4458
3. (Recommended) Turn on **WARP authentication identity** to allow users to authenticate to the application using their [WARP session identity](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). We recommend turning this on if your application is not in the browser and cannot handle a `302` redirect.
4559

46-
9. Select **Next**.
60+
10. Select **Next**.
4761

48-
10. (Optional) Configure [App Launcher settings](/cloudflare-one/access-controls/access-settings/app-launcher/) for the application.
62+
11. (Optional) Configure [App Launcher settings](/cloudflare-one/access-controls/access-settings/app-launcher/) for the application.
4963

50-
11. <Render file="access/access-block-page" product="cloudflare-one" />
64+
12. <Render file="access/access-block-page" product="cloudflare-one" />
5165

52-
12. Select **Next**.
66+
13. Select **Next**.
5367

54-
13. <Render
68+
14. <Render
5569
file="access/self-hosted-app/advanced-settings"
5670
product="cloudflare-one"
5771
/>
5872

5973
These settings only apply to private hostnames and require [Gateway TLS decryption](/cloudflare-one/traffic-policies/http-policies/tls-decryption/).
6074

61-
14. Select **Save**.
75+
15. Select **Save**.
6276

6377
Users can now connect to your private application after authenticating with Cloudflare Access.
6478

@@ -89,3 +103,7 @@ The WARP client manages sessions for all non-HTTPS applications. Users will rece
89103
### Private hostname vs private IP
90104

91105
An Access application defined by a private hostname takes precedence over an Access application defined by a private IP. For example, assume App-1 points to `wiki.internal.local` and App-2 points to `10.0.0.1`, but `wiki.internal.local` resolves to `10.0.0.1`. Users who go to `wiki.internal.local` will never match App-2; they will be allowed or blocked strictly based on App-1 Access policies (and [Gateway policies](#access-vs-gateway-policies)).
106+
107+
## Limitations
108+
109+
- Browser Isolation is only compatible with self-hosted applications on port `443`. For more information, refer to the [Browser Isolation documentation](/cloudflare-one/remote-browser-isolation/known-limitations/#browser-isolation-is-not-compatible-with-private-ips-on-non-443-ports).

‎src/content/docs/cloudflare-one/remote-browser-isolation/known-limitations.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,6 @@ You no longer need to isolate both the Identity Provider (IdP) and Service Provi
7676

7777
## Browser Isolation is not compatible with private IPs on non-`443` ports
7878

79-
Browser Isolation is not compatible with [self-hosted private applications](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) that use private IP addresses on ports other than `443`. Trying to access self-hosted applications defined by private IPs on ports other than `443` will result in a Gateway block page.
79+
Browser Isolation is not compatible with [self-hosted private applications](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) that use private IPs or hostnames on ports other than `443`. Trying to access self-hosted applications on non-`443` ports will result in a Gateway block page.
8080

8181
To use Browser Isolation for an application on a private IP address with a non-`443` port, configure a [private network application](/cloudflare-one/access-controls/applications/non-http/legacy-private-network-app/) instead.

‎src/content/docs/cloudflare-one/traffic-policies/application-app-types.mdx‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,20 +27,28 @@ Gateway sorts applications into the following app type groups:
2727
| Value | Definition |
2828
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
2929
| Artificial Intelligence | AI assistance applications |
30-
| Audio Streaming | Music streaming, podcasts, and other audio applications |
30+
| Business | Applications used for general business purposes |
3131
| Collaboration & Online Meetings | Business communication and collaboration applications |
3232
| Dating | Online dating applications |
3333
| Development | Software development and development operations applications |
34+
| Education | Applications used for educational purposes and e-learning |
3435
| Email | Email applications |
36+
| Entertainment & Events | Applications used for entertainment content and event information |
3537
| Encrypted DNS | DNS encryption applications |
3638
| File Sharing | File sharing applications |
3739
| Finance & Accounting | Financial and accounting applications |
40+
| Food & Drink | Applications related to food delivery and recipe services |
3841
| Gaming | Games and gaming applications |
42+
| Health & Fitness | Applications used for health monitoring and fitness tracking |
3943
| Human Resources | Employee management applications and workforce tools |
4044
| Instant Messaging | Instant messaging applications |
4145
| IT Management | IT deployment management applications |
4246
| Legal | Legal tools and applications |
43-
| News | News applications |
47+
| Lifestyle | Applications related to lifestyle and personal interests |
48+
| Music & Audio Streaming | Applications used for streaming music and audio |
49+
| Navigation | Applications used for maps and navigation services |
50+
| News, Books, & Magazines | Applications delivering news, books, and magazine content |
51+
| Photography & Graphic Design | Applications used for photography and graphic design |
4452
| Productivity | Business and productivity applications |
4553
| Public Cloud | Public cloud infrastructure management applications |
4654
| Sales & Marketing | Sales and marketing applications |
@@ -49,7 +57,8 @@ Gateway sorts applications into the following app type groups:
4957
| Shopping | Online shopping applications |
5058
| Social Networking | Social networking applications |
5159
| Sports | Sports streaming and news applications |
52-
| Video Streaming | Video streaming applications |
60+
| Travel | Video streaming applications |
61+
| Video Streaming & Editing | Applications used for streaming and editing video |
5362
| [Do Not Inspect](#do-not-inspect-applications) | Applications incompatible with the TLS certificate required by the [Gateway proxy](/cloudflare-one/traffic-policies/proxy/) |
5463

5564
## Application hostnames

0 commit comments

Comments
 (0)