Skip to content

[ZT] Logpush SIEM destinations #24379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 13, 2025
Merged

[ZT] Logpush SIEM destinations #24379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions src/content/docs/cloudflare-one/insights/logs/logpush.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@ sidebar:
order: 8
---

import { GlossaryTooltip } from "~/components";

:::note
Only available on Enterprise plans.
:::

With Cloudflare's [Logpush](/logs/logpush/) service, you can configure the automatic export of Zero Trust logs to third-party storage destinations or to security information and event management (SIEM) tools. Once exported, your team can analyze and audit the data as needed.
With Cloudflare's [Logpush](/logs/logpush/) service, you can configure the automatic export of Zero Trust logs to third-party storage destinations or to third-party <GlossaryTooltip term="SIEM" >security information and event management (SIEM)</GlossaryTooltip> solutions. Once exported, your team can analyze and audit the data as needed.

## Export Zero Trust logs with Logpush

Expand All @@ -29,19 +31,19 @@ To configure Logpush for Zero Trust logs:
8. (Optional) In **Advanced settings**, choose the timestamp format you prefer and whether you want to enable log sampling.
9. Select **Submit**.

The setup of your Logpush integration is now complete. Logpush will send updated logs every five minutes to your selected destination.
The setup of your Logpush integration is now complete. Logpush will send updated logs every five minutes to your selected destination. You can configure multiple destinations and add additional fields to your logs by returning to the **Logpush** page.

You can configure multiple destinations and add additional fields to your logs by returning to the **Logpush** page.
For more information on supported destinations, refer to [Enable destinations](/logs/logpush/logpush-job/enable-destinations/).

## Zero Trust datasets

Refer to [Logpush datasets](/logs/logpush/logpush-job/datasets/) for a list of all available fields.

| Dataset | Description |
| -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Dataset | Description |
| ---------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Access Requests](/logs/logpush/logpush-job/datasets/account/access_requests/) | HTTP requests to sites protected by Cloudflare Access |
| [Audit Logs](/logs/logpush/logpush-job/datasets/account/audit_logs/) | Authentication events through Cloudflare Access |
| [Browser Isolation User Actions](/logs/logpush/logpush-job/datasets/account/biso_user_actions/) | Data transfer actions performed by a user in the remote browser |
| [Browser Isolation User Actions](/logs/logpush/logpush-job/datasets/account/biso_user_actions/) | Data transfer actions performed by a user in the remote browser |
| [CASB Findings](/logs/logpush/logpush-job/datasets/account/casb_findings/) | Security issues detected by Cloudflare CASB |
| [Device Posture Results](/logs/logpush/logpush-job/datasets/account/device_posture_results/) | Device posture status from the WARP client |
| [DLP Forensic Copies](/logs/logpush/logpush-job/datasets/account/dlp_forensic_copies/) | Entire HTTP requests or payloads of HTTP requests captured by [Cloudflare DLP](/cloudflare-one/policies/data-loss-prevention/dlp-policies/logging-options/) |
Expand Down
9 changes: 2 additions & 7 deletions src/content/docs/logs/logpush/logpush-job/enable-destinations/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,14 @@ pcx_content_type: navigation
title: Enable destinations
sidebar:
order: 3

---

import { DirectoryListing, GlossaryTooltip } from "~/components"
import { DirectoryListing, GlossaryTooltip } from "~/components";

Enable pushing logs to your storage service, <GlossaryTooltip term="SIEM">SIEM solution</GlossaryTooltip>, or log management provider.

:::note


Note that you will need to allowlist IP addresses to accept incoming Cloudflare Logpush traffic. Refer to [Cloudflare IPs](https://www.cloudflare.com/ips/) for the complete list of IPs.


Note that you will need to allowlist IP addresses to accept incoming Cloudflare Logpush traffic. Refer to [Cloudflare IPs](https://www.cloudflare.com/ips/) for the complete list of IPs.
:::

<DirectoryListing />