Sign inSign up

lumutools/cloudflare-one-threat-feeder

By lumutools

•Updated 4 months ago

Image
0

965

lumutools/cloudflare-one-threat-feeder repository overview

⁠Lumu - Cloudflare One Response Integration

Lumu Defender offers a framework to help you leverage Lumu's integrations with your existing cybersecurity stack, including Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Endpoint Detection and Response (EDR), incident response systems, and more.

The integration between Cloudflare One and Lumu allows you to leverage the Zero Trust Reusable Lists to receive and respond to adversaries by updating the Reusable Lists (URLs, hostnames, and IP addresses), improving your organization's detection and response capabilities.

⁠Getting Started

To ensure a successful deployment and avoid configuration conflicts, please follow these guidelines:

  • Primary Documentation: The documentation offers detailed instructions for configuring and gathering the necessary data for the integration. We strongly recommend following the official documentation⁠ to successfully deploy the Cloudflare One integration.
  • Management Snippet: Lumu provides a dedicated management script (manage.sh), which is the only recommended method to configure, start, and monitor this integration.
⁠Requirements

Before proceeding, ensure you have:

  • Docker-enabled host: Required for deploying the integration components.
  • Cloudflare One Access: You must have your Cloudflare Account ID and an API Token with permissions to manage Zero Trust Reusable Lists.
  • Lumu Credentials: Your Lumu Company UUID and Defender API Key.
  • Network Connectivity: The host must communicate with defender.lumu.io and Cloudflare APIs.

⁠Deployment Steps

The following steps only describe the deployment process; refer to the official documentation⁠ to ensure all system prerequisites and configuration requirements are met.

⁠1. Set up the Management Script

Create a file named manage.sh on your integration host and paste the following snippet:

#!/usr/bin/env bash

RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
BOLD='\033[1m'
RESET='\033[0m'

info()    { echo -e "${CYAN}[INFO]${RESET}  $*"; }
success() { echo -e "${GREEN}[OK]${RESET}    $*"; }
warn()    { echo -e "${YELLOW}[WARN]${RESET}  $*"; }
error()   { echo -e "${RED}[ERROR]${RESET} $*" >&2; }
prompt()  { echo -e "${BOLD}${YELLOW}$*${RESET}"; }

IMG=lumutools/cloudflare-one-threat-feeder:latest
INTEGRATION_NAME=lumu-cloudflare-one-response
INTEGRATION_NAME_IOC=lumu-cloudflare-one-response-ioc
INTEGRATION_DIR=${HOME}/CloudflareOneResponse
VOLUME_DATA=${INTEGRATION_DIR}/data:/app/data
VOLUME_CONFIG=${INTEGRATION_DIR}/data/.config.toml:/app/.config.toml:ro
VOLUME_IOC=${INTEGRATION_DIR}/data/ioc.db:/app/data/ioc.db:ro

mkdir -p "${INTEGRATION_DIR}/data"
chmod -R o+w "${INTEGRATION_DIR}/data" > /dev/null 2>&1 

run_config() {
    info "Running configuration script ..."
    if docker run --rm -it -v "${INTEGRATION_DIR}/data:/app/data" "${IMG}" bash run_config; then
        success "Configuration completed."
    else
        error "Configuration script failed."; return 1
    fi
}

start_integration() {
    info "Setting up IOC integration '${INTEGRATION_NAME_IOC}' ..."
    if [[ ! -f "${INTEGRATION_DIR}/data/.config.toml" ]]; then
        error "Please configure the integration first."; return 1
    fi
    if ! docker container inspect "${INTEGRATION_NAME_IOC}" &>/dev/null; then
        info "Integration '${INTEGRATION_NAME_IOC}' does not exist. Creating it ..."
        if ! docker create \
            -v "${VOLUME_DATA}" \
            -v "${VOLUME_CONFIG}" \
            --restart unless-stopped \
            --log-driver json-file \
            --log-opt max-size=30m \
            --log-opt max-file=3 \
            --name "${INTEGRATION_NAME_IOC}" \
            "${IMG}" bash run_ioc; then
            error "Failed to create IOC integration."
            return 1
        fi
    else
        warn "Integration '${INTEGRATION_NAME_IOC}' already exists. Skipping its creation."
    fi
    if docker start "${INTEGRATION_NAME_IOC}"; then
        success "IOC integration started."; sleep 5
    else
        error "Failed to start IOC integration."; return 1
    fi

    info "Setting up main integration '${INTEGRATION_NAME}' ..."
    if ! docker container inspect "${INTEGRATION_NAME}" &>/dev/null; then
        info "Integration '${INTEGRATION_NAME}' does not exist. Creating ..."
        if ! docker create \
            -v "${VOLUME_DATA}" \
            -v "${VOLUME_CONFIG}" \
            -v "${VOLUME_IOC}" \
            --restart unless-stopped \
            --log-driver json-file \
            --log-opt max-size=30m \
            --log-opt max-file=3 \
            --name "${INTEGRATION_NAME}" \
            "${IMG}" bash run_component; then
            error "Failed to create main integration."; return 1
        fi
    else
        warn "Integration '${INTEGRATION_NAME}' already exists. Skipping create."
    fi
    if docker start "${INTEGRATION_NAME}"; then
        success "Main integration started."
    else
        error "Failed to start main integration."; return 1
    fi
}

check_status() {
    info "Checking status of integrations ..."
    if [[ ! -f "${INTEGRATION_DIR}/data/.status.ndjson" ]]; then
        error "Status check failed. Verify if your integration has been deployed."; return 1
    fi
    if docker run --rm -it -v "${VOLUME_DATA}":ro "${IMG}" bash run_status; then
        success "Status check completed."
    else
        error "Status check failed."; return 1
    fi
}

show_logs() {
    echo ""
    prompt "Select which logs to view:"
    echo -e "  ${CYAN}1${RESET}) IOC integration  (${INTEGRATION_NAME_IOC})"
    echo -e "  ${CYAN}2${RESET}) Main integration  (${INTEGRATION_NAME})"
    echo ""
    read -rp "$(prompt 'Enter option [1/2]: ')" choice
    case "${choice}" in
        1)
            info "Showing logs for '${INTEGRATION_NAME_IOC}' ..."
            docker logs --tail 100 -f "${INTEGRATION_NAME_IOC}"
            ;;
        2)
            info "Showing logs for '${INTEGRATION_NAME}' ..."
            docker logs --tail 100 -f "${INTEGRATION_NAME}"
            ;;
        *)
            error "Invalid option '${choice}'."
            return 1
            ;;
    esac
}

usage() {
    echo ""
    prompt "  CLOUDFLARE ONE RESPONSE INTEGRATION MANAGEMENT"
    echo -e "  ${BOLD}Usage:${RESET} $0 <command>"
    echo ""
    echo -e "  ${CYAN}config${RESET}   Run configuration"
    echo -e "  ${CYAN}start${RESET}    Start integration"
    echo -e "  ${CYAN}status${RESET}   Check integration status"
    echo -e "  ${CYAN}logs${RESET}     Show integration logs"
    echo ""
}

case "${1}" in
    config) run_config ;;
    start)  start_integration ;;
    status) check_status ;;
    logs)   show_logs ;;
    *)      usage
            [[ -n "${1}" ]] && error "Unknown command '${1}'."
            exit 1 ;;
esac
⁠2. Configure and Run

Execute the following commands in order using the script created above:

  1. Run Configuration: Follow the wizard prompts to input your Lumu and Cloudflare credentials.
    Bash
bash manage.sh config
  1. Start Integration: This deploys the integration.
bash manage.sh start
  1. Verify Status: Ensure everything is running correctly.
bash manage.sh status
  1. Check logs: Collect the integration logs.
bash manage.sh logs

⁠General Recommendations

Follow these recommendations to ensure the integration works correctly:

  • The integration between Lumu and Cloudflare One is carried out using Zero Trust Reusable Lists.
  • Cloudflare caps Reusable Lists at 1,000 entries. Lumu ensures these 1,000 slots are always filled with the most recent and active IoCs.
  • Reusable Lists are actively used and updated by this integration; therefore, they must not be modified manually while managed by this integration.
  • Do not stop the integration. Stopping it will stop the synchronization process.
  • The integration operates with Docker. Ensure your Docker daemon works properly.

⁠Find out more about us

Tag summary

Content type

Image

Digest

sha256:b6f5b83b4…

Size

84.7 MB

Last updated

4 months ago

docker pull lumutools/cloudflare-one-threat-feeder