Cloudflare One Web Session Parser

.script/tests/KqlvalidationsTests/CustomTables/CloudflareV2_CL.json

@@ -1984,6 +1984,14 @@
         {
             "name": "ZoneName",
             "type": "string"
-        }
+        },
+        {
+            "Name": "Type",
+            "Type": "String"
+        },
+        {
+            "Name": "_ItemId",
+            "Type": "String"
+        }     
     ]
 }

Parsers/ASimWebSession/ARM/ASimWebSession/ASimWebSession.json

@@ -27,7 +27,7 @@
         "displayName": "Web Session ASIM parser",
         "category": "ASIM",
         "FunctionAlias": "ASimWebSession",
-        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimWebSession') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimWebSession' in (DisabledParsers) or 'Any' in (DisabledParsers));\nlet parser=(pack:bool=false){\nunion isfuzzy=true\n  vimWebSessionEmpty,\n  ASimWebSessionSquidProxy (ASimBuiltInDisabled or ('ExcludeASimWebSessionSquidProxy' in (DisabledParsers))),\n  ASimWebSessionZscalerZIA (ASimBuiltInDisabled or ('ExcludeASimWebSessionZscalerZIA' in (DisabledParsers))),\n  ASimWebSessionNative (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionNative' in (DisabledParsers)))),\n  ASimWebSessionVectraAI (pack=pack, disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionVectraAI' in (DisabledParsers)))),\n  ASimWebSessionIIS (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionIIS' in (DisabledParsers)))),\n  ASimWebSessionPaloAltoCEF (ASimBuiltInDisabled or ('ExcludeASimWebSessionPaloAltoCEF' in (DisabledParsers))),\n  ASimWebSessionApacheHTTPServer (ASimBuiltInDisabled or ('ExcludeASimWebSessionApacheHTTPServer' in (DisabledParsers))),\n  ASimWebSessionFortinetFortiGate (ASimBuiltInDisabled or ('ExcludeASimWebSessionFortinetFortiGate' in (DisabledParsers))),\n  ASimWebSessionCiscoMeraki (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoMeraki' in (DisabledParsers))),\n  ASimWebSessionBarracudaWAF (ASimBuiltInDisabled or ('ExcludeASimWebSessionBarracudaWAF' in (DisabledParsers))),\n  ASimWebSessionBarracudaCEF (ASimBuiltInDisabled or ('ExcludeASimWebSessionBarracudaCEF' in (DisabledParsers))),\n  ASimWebSessionCitrixNetScaler (ASimBuiltInDisabled or ('ExcludeASimWebSessionCitrixNetScaler' in (DisabledParsers))),\n  ASimWebSessionCiscoFirepower (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoFirepower' in (DisabledParsers))),\n  ASimWebSessionF5ASM (ASimBuiltInDisabled or ('ExcludeASimWebSessionF5ASM' in (DisabledParsers))),\n  ASimWebSessionPaloAltoCortexDataLake (ASimBuiltInDisabled or ('ExcludeASimWebSessionPaloAltoCortexDataLake' in (DisabledParsers))),\n  ASimWebSessionSonicWallFirewall (ASimBuiltInDisabled or ('ExcludeASimWebSessionSonicWallFirewall' in (DisabledParsers))),\n  ASimWebSessionAzureFirewall (ASimBuiltInDisabled or ('ExcludeASimWebSessionAzureFirewall' in (DisabledParsers))),\n  ASimWebSessionCiscoUmbrella (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoUmbrella' in (DisabledParsers)),pack=pack),\n  ASimWebSessionSalesforceServiceCloudV2 (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionSalesforceServiceCloudV2' in (DisabledParsers))), pack=pack),\n  ASimWebSessionAWSWAF (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionAWSWAF' in (DisabledParsers))), pack=pack)\n};\nparser(pack=pack)\n",
+        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimWebSession') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimWebSession' in (DisabledParsers) or 'Any' in (DisabledParsers));\nlet parser=(pack:bool=false){\nunion isfuzzy=true\n  vimWebSessionEmpty,\n  ASimWebSessionSquidProxy (ASimBuiltInDisabled or ('ExcludeASimWebSessionSquidProxy' in (DisabledParsers))),\n  ASimWebSessionZscalerZIA (ASimBuiltInDisabled or ('ExcludeASimWebSessionZscalerZIA' in (DisabledParsers))),\n  ASimWebSessionNative (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionNative' in (DisabledParsers)))),\n  ASimWebSessionVectraAI (pack=pack, disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionVectraAI' in (DisabledParsers)))),\n  ASimWebSessionIIS (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionIIS' in (DisabledParsers)))),\n  ASimWebSessionPaloAltoCEF (ASimBuiltInDisabled or ('ExcludeASimWebSessionPaloAltoCEF' in (DisabledParsers))),\n  ASimWebSessionApacheHTTPServer (ASimBuiltInDisabled or ('ExcludeASimWebSessionApacheHTTPServer' in (DisabledParsers))),\n  ASimWebSessionFortinetFortiGate (ASimBuiltInDisabled or ('ExcludeASimWebSessionFortinetFortiGate' in (DisabledParsers))),\n  ASimWebSessionCiscoMeraki (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoMeraki' in (DisabledParsers))),\n  ASimWebSessionBarracudaWAF (ASimBuiltInDisabled or ('ExcludeASimWebSessionBarracudaWAF' in (DisabledParsers))),\n  ASimWebSessionBarracudaCEF (ASimBuiltInDisabled or ('ExcludeASimWebSessionBarracudaCEF' in (DisabledParsers))),\n  ASimWebSessionCitrixNetScaler (ASimBuiltInDisabled or ('ExcludeASimWebSessionCitrixNetScaler' in (DisabledParsers))),\n  ASimWebSessionCiscoFirepower (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoFirepower' in (DisabledParsers))),\n  ASimWebSessionF5ASM (ASimBuiltInDisabled or ('ExcludeASimWebSessionF5ASM' in (DisabledParsers))),\n  ASimWebSessionPaloAltoCortexDataLake (ASimBuiltInDisabled or ('ExcludeASimWebSessionPaloAltoCortexDataLake' in (DisabledParsers))),\n  ASimWebSessionSonicWallFirewall (ASimBuiltInDisabled or ('ExcludeASimWebSessionSonicWallFirewall' in (DisabledParsers))),\n  ASimWebSessionAzureFirewall (ASimBuiltInDisabled or ('ExcludeASimWebSessionAzureFirewall' in (DisabledParsers))),\n  ASimWebSessionCiscoUmbrella (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoUmbrella' in (DisabledParsers)),pack=pack),\n  ASimWebSessionSalesforceServiceCloudV2 (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionSalesforceServiceCloudV2' in (DisabledParsers))), pack=pack),\n  ASimWebSessionAWSWAF (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionAWSWAF' in (DisabledParsers))), pack=pack),\n  ASimWebSessionCloudflareOne (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionCloudflareOne' in (DisabledParsers))), pack=pack)\n};\nparser(pack=pack)\n",
         "version": 1,
         "functionParameters": "pack:bool=False"
       }

Parsers/ASimWebSession/ARM/ASimWebSessionCloudflareOne/README.md

@@ -0,0 +1,21 @@
+# Cloudflare One ASIM WebSession Normalization Parser
+
+ARM template for ASIM WebSession schema parser for Cloudflare One.
+
+This ASIM parser supports normalizing the Cloudflare One Web Session activities ingested in 'CloudflareV2_CL' table to the ASIM Web Session normalized schema. We only support the schema of the table updated on Apr 22, 2026.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM WebSession normalization schema reference](https://aka.ms/ASimWebSessionDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimWebSession/CHANGELOG/ASimWebSessionCloudflareOne.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimWebSession%2FARM%2FASimWebSessionCloudflareOne%2FASimWebSessionCloudflareOne.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimWebSession%2FARM%2FASimWebSessionCloudflareOne%2FASimWebSessionCloudflareOne.json)

Parsers/ASimWebSession/ARM/FullDeploymentWebSession.json

@@ -218,6 +218,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedASimWebSessionCloudflareOne",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimWebSession/ARM/ASimWebSessionCloudflareOne/ASimWebSessionCloudflareOne.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",
@@ -638,6 +658,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedvimWebSessionCloudflareOne",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimWebSession/ARM/vimWebSessionCloudflareOne/vimWebSessionCloudflareOne.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",

Parsers/ASimWebSession/ARM/vimWebSessionCloudflareOne/README.md

@@ -0,0 +1,21 @@
+# Cloudflare One ASIM WebSession Normalization Parser
+
+ARM template for ASIM WebSession schema parser for Cloudflare One.
+
+This ASIM filtering parser supports normalizing and filtering Cloudflare One Web Session activities ingested in the 'CloudflareV2_CL' table. We only support the schema of the table updated on Apr 22, 2026. 
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM WebSession normalization schema reference](https://aka.ms/ASimWebSessionDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimWebSession/CHANGELOG/vimWebSessionCloudflareOne.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimWebSession%2FARM%2FvimWebSessionCloudflareOne%2FvimWebSessionCloudflareOne.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimWebSession%2FARM%2FvimWebSessionCloudflareOne%2FvimWebSessionCloudflareOne.json)

Parsers/ASimWebSession/CHANGELOG/ASimWebSession.md

@@ -1,5 +1,9 @@
 # Changelog for ASimWebSession.yaml
 
+## Version 0.5.8
+
+- (2026-08-26) Add parser for Cloudflare One logs - [PR #14982](https://github.com/Azure/Azure-Sentinel/pull/14982)
+
 ## Version 0.5.7
 
 - (2026-06-11) Add parser for AWS Web Application Firewall (WAF) logs - [PR #14496](https://github.com/Azure/Azure-Sentinel/pull/14496)

Parsers/ASimWebSession/CHANGELOG/ASimWebSessionCloudflareOne.md

@@ -0,0 +1,6 @@
+# Changelog for ASimWebSessionCloudflareOne.yaml
+
+## Version 0.1.0
+
+- (2026-08-26) Cloudflare One Web Session Parser - [PR #14982](https://github.com/Azure/Azure-Sentinel/pull/14982)
+

Parsers/ASimWebSession/CHANGELOG/imWebSession.md

@@ -1,5 +1,9 @@
 # Changelog for imWebSession.yaml
 
+## Version 0.6.6
+
+- (2026-08-26) Add parser for Cloudflare One logs. - [PR #14982](https://github.com/Azure/Azure-Sentinel/pull/14982)
+
 ## Version 0.6.5
 
 - (2026-06-11) Add parser for AWS Web Application Firewall (WAF) logs. - [PR #14496](https://github.com/Azure/Azure-Sentinel/pull/14496)

Parsers/ASimWebSession/CHANGELOG/vimWebSessionCloudflareOne.md

@@ -0,0 +1,6 @@
+# Changelog for vimWebSessionCloudflareOne.yaml
+
+## Version 0.1.0
+
+- (2026-08-26) Cloudflare One Web Session Parser - [PR #14982](https://github.com/Azure/Azure-Sentinel/pull/14982)
+

Parsers/ASimWebSession/Parsers/ASimWebSession.yaml

@@ -1,6 +1,6 @@
 Parser:
   Title: Web Session ASIM parser
-  Version: '0.5.7'
+  Version: '0.5.8'
   LastUpdated: Jun 16, 2026
 Product:
   Name: Source agnostic
@@ -42,7 +42,8 @@ ParserQuery: |
     ASimWebSessionAzureFirewall (ASimBuiltInDisabled or ('ExcludeASimWebSessionAzureFirewall' in (DisabledParsers))),
     ASimWebSessionCiscoUmbrella (ASimBuiltInDisabled or ('ExcludeASimWebSessionCiscoUmbrella' in (DisabledParsers)),pack=pack),
     ASimWebSessionSalesforceServiceCloudV2 (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionSalesforceServiceCloudV2' in (DisabledParsers))), pack=pack),
-    ASimWebSessionAWSWAF (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionAWSWAF' in (DisabledParsers))), pack=pack)
+    ASimWebSessionAWSWAF (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionAWSWAF' in (DisabledParsers))), pack=pack),
+    ASimWebSessionCloudflareOne (disabled=(ASimBuiltInDisabled or ('ExcludeASimWebSessionCloudflareOne' in (DisabledParsers))), pack=pack)
   };
   parser(pack=pack)
 
@@ -72,4 +73,5 @@ Parsers:
   - _ASim_WebSession_AzureFirewall
   - _ASim_WebSession_CiscoUmbrella
   - _ASim_WebSession_SalesforceServiceCloudV2
-  - _ASim_WebSession_AWSWAF
+  - _ASim_WebSession_AWSWAF
+  - _ASim_WebSession_CloudflareOne