Logpush & SIEM Integration

Cloudflare Logpush & SIEM integration for real security observability

Stream Cloudflare logs and security events into Splunk, Microsoft Sentinel, Datadog, Sumo Logic or object storage. We configure Logpush, map fields, build dashboards and wire alerting so your SOC can monitor the edge and keep audit-ready evidence.

Set up Logpush Talk to a specialist

Who this is for

Banks, fintech & financial services teams
Regulated & managed-care organisations
SaaS and platforms with a SIEM or SOC
Security teams needing audit-ready log evidence

Problems we solve

Why edge logs need to reach your SIEM

Edge events trapped in the dashboard

WAF, bot and DDoS activity lives only in the Cloudflare UI, so your SOC has no single pane and no correlation with origin and endpoint logs.

No alerting on attacks

Spikes in blocks, challenges or DNS lookups pass unnoticed until something breaks. There is no monitor wired to your on-call channels.

Auditors ask for log evidence

PCI DSS, DORA, ISO 27001 and SOC 2 reviews want demonstrable monitoring and retained logs — and screenshots of a dashboard rarely satisfy them.

Logs expire before you need them

Edge analytics retention is short. Incident investigations and audit windows often look back further than the data you currently keep.

Raw fields don't fit the SIEM

Cloudflare field names and formats don't line up with your existing parsers, so dashboards look empty or panels show the wrong values.

Plan limits block log export

Full Logpush export generally needs an eligible Cloudflare Enterprise plan. Teams discover the constraint late, after committing to a deadline.

Destinations

Where we can push your Cloudflare logs

One Logpush pipeline, configured for your SIEM or storage so edge events sit alongside the rest of your security telemetry.

Splunk

Stream Cloudflare datasets into Splunk via HEC or supported destinations, with field mapping that fits your existing indexes and dashboards.

Microsoft Sentinel

Land Cloudflare events in a Log Analytics workspace so they feed Sentinel analytics rules, workbooks and incident queues alongside your other sources.

Datadog

Forward HTTP, WAF and DNS logs to Datadog for log pipelines, monitors and security dashboards, tagged so edge events sit next to app telemetry.

Sumo Logic

Push Cloudflare logs to Sumo Logic collectors for searchable observability, parsing rules and alert monitors across your estate.

Object storage (S3 / R2 / GCS)

Archive raw logs to Amazon S3, Cloudflare R2 or Google Cloud Storage for long-term retention, cold audit evidence and replay into a SIEM later.

Generic HTTP endpoint

Send batched logs to any HTTP collector or data pipeline you run, so a home-grown lake or a less common SIEM can still consume Cloudflare data.

Datasets

What is included in the log export

We select the datasets that matter for your monitoring and compliance goals, then map their fields into your platform.

HTTP requests

Request-level fields — status, path, method, cache, country, edge response — for traffic analytics, threat hunting and forensic timelines.

WAF & firewall events

Managed-rule, custom-rule and rate-limiting matches so your SOC can alert on blocks, challenges and emerging attack patterns by ruleset.

DNS logs

Authoritative and resolver query data to spot abuse, exfiltration patterns, misconfiguration and unexpected lookup spikes.

Gateway & DLP events

Cloudflare Gateway HTTP, DNS and network activity (where licensed) for egress visibility and policy-violation alerting.

Access & Zero Trust

Authentication and authorization events from Cloudflare Access to support identity audit trails and least-privilege reviews.

DDoS & network analytics

Layer 3/4 and Layer 7 mitigation and attack-event data so volumetric incidents are recorded, alerted and reportable.

Field mapping

How do you make Cloudflare logs usable in a SIEM?

Raw Cloudflare datasets are rich but verbose, and their field names rarely match your existing parsers. We select the right datasets and fields, then map them to your schema so panels populate correctly and searches return what your analysts expect.

From there we build dashboards for WAF, bot, DDoS and DNS activity and set sensible alert thresholds, so a surge in blocks, challenges or unusual lookups is surfaced to your on-call channel rather than buried.

On the pipeline

Dataset & field selection tuned to your use cases
Field mapping and parsing for your SIEM schema
Dashboards for WAF, bot, DDoS and DNS events
Alert thresholds wired to your notification channels

SOC workflow

How a Logpush integration comes together

A clear, staged path from plan check to a monitored, documented pipeline your team owns.

1
1. Scope & plan check
We confirm your Cloudflare plan eligibility, the datasets you need, your target SIEM or storage, retention requirements and any compliance driver behind the work.
2
2. Configure Logpush
We create Logpush jobs to your chosen destination, select datasets and fields, set batching and ownership-token validation, and verify delivery end to end.
3
3. Map fields & build views
We map Cloudflare fields to your schema, build parsing where needed, and stand up dashboards for WAF, bot, DDoS and DNS activity that your team will actually use.
4
4. Alerts & handover
We define alert thresholds, document the pipeline and field mappings, and hand over runbooks so your SOC can tune and extend the integration confidently.

Retention & audit

Retention and audit evidence for compliance monitoring

Frameworks such as PCI DSS, DORA, ISO 27001 and SOC 2 expect security events to be monitored and logs to be retained and reviewable. Streaming Cloudflare events to a SIEM and archiving them to storage helps you produce that evidence on demand.

We help configure retention windows and cold archival to S3, R2 or GCS so investigations and audits can look back as far as your policy requires. We are not a compliance auditor — we help you generate useful, retained evidence that supports your programme.

What this supports

Retention windows aligned to your audit policy
Cold archive to S3, R2 or GCS for long-term evidence
Edge security events available for review on demand
Supports PCI, DORA, ISO 27001 & SOC 2 monitoring needs

Scope

What is and isn't included

What is included

Cloudflare plan & entitlement check for Logpush
Logpush job configuration to your chosen destination
Dataset selection across WAF, HTTP, DNS, Gateway, Access & DDoS
Field mapping and parsing into your SIEM schema
Security dashboards and alert-threshold setup
Retention / archival configuration and a documented runbook

What is not included

A 24/7 SOC or live incident response (unless separately agreed)
Your SIEM licensing, ingestion or storage costs
Deep SIEM-side engineering owned by your platform team
Compliance certification, audit sign-off or attestation
Application, hosting and origin log collection
Uptime or availability guarantees outside a signed SLA

When you need this

Your SOC needs Cloudflare events in its single pane of glass
Auditors are asking for monitoring and retained log evidence
You want alerting on WAF, bot, DDoS and DNS activity
Edge analytics retention is too short for your investigations
You're standing up or expanding a SIEM and need edge data in it

When Cloudflare is not enough

Log export gives you visibility, but observability is only one layer. Cloudflare and Logpush do not replace:

Secure development, code review and timely patching of your application and plugins.
Backups, disaster recovery and a tested restore process.
A dedicated anti-fraud, chargeback or payment-risk platform.
Hosting, database administration and origin server maintenance.
Full incident response and forensics for large or regulated enterprises.

What Logpush and Cloudflare can and cannot do

Logpush exports logs so your team can monitor, alert and retain evidence — it helps you see and investigate activity, but visibility is not the same as prevention. It does not run a SOC, respond to incidents on its own, or replace secure development, patching, backups, anti-fraud or full incident response. Availability of full log export depends on your Cloudflare plan and entitlements, and no vendor can promise that monitoring will catch every event. We configure Logpush as one strong layer in a complete security and compliance posture.

Related services

Explore related Cloudflare services

Banks & Financial ServicesControls and evidence regulators expect.Managed Cloudflare ServicesOngoing pipeline and rule tuning.Cloudflare AuditIndependent review of your configuration.Zero Trust ConsultantAccess events worth logging and alerting.Cloudflare WAF SetupThe rules whose events you'll monitor.ContactTell us your SIEM and datasets.

Frequently asked questions

What is Cloudflare Logpush and what does it do?

Logpush is Cloudflare's mechanism for exporting logs and event data out of Cloudflare to an external destination on a regular, batched schedule. Instead of reading events only in the Cloudflare dashboard, you stream datasets such as HTTP requests, WAF and firewall events, DNS logs, Gateway, Access and DDoS analytics into a SIEM or storage platform. That lets your team build dashboards, alert on suspicious activity and retain logs for monitoring and audit purposes.

Does Logpush require a Cloudflare Enterprise plan?

In most cases, yes. Full log export via Logpush generally requires an eligible Cloudflare Enterprise plan, and certain datasets have their own entitlement requirements. Some narrower export options or instant-logs features may be available on other plans, but availability depends entirely on your specific account, plan and add-ons. We check your plan and entitlements up front and tell you honestly what is and is not possible before any work begins, so you are not surprised later.

Which SIEM and observability platforms can you integrate?

We commonly configure Logpush to Splunk, Microsoft Sentinel, Datadog and Sumo Logic, and to object storage such as Amazon S3, Cloudflare R2 and Google Cloud Storage for long-term retention. We can also send batched logs to a generic HTTP endpoint so a custom data lake or a less common SIEM can consume Cloudflare data. We help with destination configuration, field mapping and validation, working alongside your platform team where deeper SIEM-side engineering is required.

Can this help with PCI DSS, DORA, ISO 27001 or SOC 2?

It can support the logging, monitoring and audit-evidence expectations in those frameworks. Streaming Cloudflare security events to a SIEM and retaining them helps demonstrate that edge activity is monitored and that logs are available for review. We are not a compliance auditor or certification body, and Cloudflare logging is only one input among many. We help you produce useful, retained evidence; your auditor or assessor determines whether your overall programme meets each requirement.

Do you run a 24/7 SOC and respond to alerts for us?

Not by default. This service configures the log export, field mapping, dashboards and alert thresholds so your own team or SOC can monitor effectively. We do not run a round-the-clock security operations centre or perform live incident response unless that is separately scoped and agreed. If you want ongoing tuning and monitoring support, our managed Cloudflare service can cover rule and pipeline upkeep within agreed hours.

Will exporting logs slow down or affect my site?

No. Logpush runs as a background export of log data from Cloudflare's edge to your destination and does not sit in the request path for your visitors, so it does not add latency to page loads or API calls. The main considerations are destination ingestion cost and storage volume, which is why we help you choose the right datasets and retention so you capture what matters for monitoring and audit without paying to store noise.

How this project is scoped — no hourly meter

Fixed scope, fixed timeline — priced by deliverable against an agreed Statement of Work, not by an hourly meter. Typically 2–4 weeks, delivered remotely.

What's included

Discovery & kick-off call to confirm goals and scope
Architecture & configuration review
Cloudflare setup for the agreed scope: DNS, SSL/TLS, WAF baseline, caching/performance and the products in your plan
Validation and a supervised go-live
Handover pack: runbook, configuration documentation and a team walkthrough
A 14-day post-go-live support window for fixes to what we configured

Not included (quoted separately)

Non-Cloudflare work (application/backend changes, third-party security tools)
Additional domains/zones beyond the agreed scope
Ongoing monthly management (that is a Care plan)
Anything not in the Statement of Work — handled as a separately quoted change order

Indicative “from” prices are a starting point. Your final price is confirmed in a written proposal after a free scoping call, and depends on the number of zones, the Cloudflare products in scope and environment complexity.

Get Cloudflare events into your SIEM

Tell us your Cloudflare plan, target platform and the datasets you need. You'll get an honest plan-eligibility check and a clear path to dashboards, alerting and audit-ready retention.