Lumu Defender offers a framework to help you leverage Lumu's integrations with your existing cybersecurity stack, including Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Endpoint Detection and Response (EDR), incident response systems, and more.
The integration between Cloudflare One and Lumu allows you to leverage the Zero Trust Reusable Lists to receive and respond to adversaries by updating the Reusable Lists (URLs, hostnames, and IP addresses), improving your organization's detection and response capabilities.
To ensure a successful deployment and avoid configuration conflicts, please follow these guidelines:
manage.sh), which is the only recommended method to configure, start, and monitor this integration.Before proceeding, ensure you have:
defender.lumu.io and Cloudflare APIs.The following steps only describe the deployment process; refer to the official documentation to ensure all system prerequisites and configuration requirements are met.
Create a file named manage.sh on your integration host and paste the following snippet:
#!/usr/bin/env bash
RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
BOLD='\033[1m'
RESET='\033[0m'
info() { echo -e "${CYAN}[INFO]${RESET} $*"; }
success() { echo -e "${GREEN}[OK]${RESET} $*"; }
warn() { echo -e "${YELLOW}[WARN]${RESET} $*"; }
error() { echo -e "${RED}[ERROR]${RESET} $*" >&2; }
prompt() { echo -e "${BOLD}${YELLOW}$*${RESET}"; }
IMG=lumutools/cloudflare-one-threat-feeder:latest
INTEGRATION_NAME=lumu-cloudflare-one-response
INTEGRATION_NAME_IOC=lumu-cloudflare-one-response-ioc
INTEGRATION_DIR=${HOME}/CloudflareOneResponse
VOLUME_DATA=${INTEGRATION_DIR}/data:/app/data
VOLUME_CONFIG=${INTEGRATION_DIR}/data/.config.toml:/app/.config.toml:ro
VOLUME_IOC=${INTEGRATION_DIR}/data/ioc.db:/app/data/ioc.db:ro
mkdir -p "${INTEGRATION_DIR}/data"
chmod -R o+w "${INTEGRATION_DIR}/data" > /dev/null 2>&1
run_config() {
info "Running configuration script ..."
if docker run --rm -it -v "${INTEGRATION_DIR}/data:/app/data" "${IMG}" bash run_config; then
success "Configuration completed."
else
error "Configuration script failed."; return 1
fi
}
start_integration() {
info "Setting up IOC integration '${INTEGRATION_NAME_IOC}' ..."
if [[ ! -f "${INTEGRATION_DIR}/data/.config.toml" ]]; then
error "Please configure the integration first."; return 1
fi
if ! docker container inspect "${INTEGRATION_NAME_IOC}" &>/dev/null; then
info "Integration '${INTEGRATION_NAME_IOC}' does not exist. Creating it ..."
if ! docker create \
-v "${VOLUME_DATA}" \
-v "${VOLUME_CONFIG}" \
--restart unless-stopped \
--log-driver json-file \
--log-opt max-size=30m \
--log-opt max-file=3 \
--name "${INTEGRATION_NAME_IOC}" \
"${IMG}" bash run_ioc; then
error "Failed to create IOC integration."
return 1
fi
else
warn "Integration '${INTEGRATION_NAME_IOC}' already exists. Skipping its creation."
fi
if docker start "${INTEGRATION_NAME_IOC}"; then
success "IOC integration started."; sleep 5
else
error "Failed to start IOC integration."; return 1
fi
info "Setting up main integration '${INTEGRATION_NAME}' ..."
if ! docker container inspect "${INTEGRATION_NAME}" &>/dev/null; then
info "Integration '${INTEGRATION_NAME}' does not exist. Creating ..."
if ! docker create \
-v "${VOLUME_DATA}" \
-v "${VOLUME_CONFIG}" \
-v "${VOLUME_IOC}" \
--restart unless-stopped \
--log-driver json-file \
--log-opt max-size=30m \
--log-opt max-file=3 \
--name "${INTEGRATION_NAME}" \
"${IMG}" bash run_component; then
error "Failed to create main integration."; return 1
fi
else
warn "Integration '${INTEGRATION_NAME}' already exists. Skipping create."
fi
if docker start "${INTEGRATION_NAME}"; then
success "Main integration started."
else
error "Failed to start main integration."; return 1
fi
}
check_status() {
info "Checking status of integrations ..."
if [[ ! -f "${INTEGRATION_DIR}/data/.status.ndjson" ]]; then
error "Status check failed. Verify if your integration has been deployed."; return 1
fi
if docker run --rm -it -v "${VOLUME_DATA}":ro "${IMG}" bash run_status; then
success "Status check completed."
else
error "Status check failed."; return 1
fi
}
show_logs() {
echo ""
prompt "Select which logs to view:"
echo -e " ${CYAN}1${RESET}) IOC integration (${INTEGRATION_NAME_IOC})"
echo -e " ${CYAN}2${RESET}) Main integration (${INTEGRATION_NAME})"
echo ""
read -rp "$(prompt 'Enter option [1/2]: ')" choice
case "${choice}" in
1)
info "Showing logs for '${INTEGRATION_NAME_IOC}' ..."
docker logs --tail 100 -f "${INTEGRATION_NAME_IOC}"
;;
2)
info "Showing logs for '${INTEGRATION_NAME}' ..."
docker logs --tail 100 -f "${INTEGRATION_NAME}"
;;
*)
error "Invalid option '${choice}'."
return 1
;;
esac
}
usage() {
echo ""
prompt " CLOUDFLARE ONE RESPONSE INTEGRATION MANAGEMENT"
echo -e " ${BOLD}Usage:${RESET} $0 <command>"
echo ""
echo -e " ${CYAN}config${RESET} Run configuration"
echo -e " ${CYAN}start${RESET} Start integration"
echo -e " ${CYAN}status${RESET} Check integration status"
echo -e " ${CYAN}logs${RESET} Show integration logs"
echo ""
}
case "${1}" in
config) run_config ;;
start) start_integration ;;
status) check_status ;;
logs) show_logs ;;
*) usage
[[ -n "${1}" ]] && error "Unknown command '${1}'."
exit 1 ;;
esac
Execute the following commands in order using the script created above:
bash manage.sh config
bash manage.sh start
bash manage.sh status
bash manage.sh logs
Follow these recommendations to ensure the integration works correctly:
Content type
Image
Digest
sha256:b6f5b83b4…
Size
84.7 MB
Last updated
4 months ago
docker pull lumutools/cloudflare-one-threat-feeder