Cloudflare WAF Capture Guide For Unified aiFObserve

Best Capture Source

Export Elastic Security events that preserve Elastic Common Schema fields.

Basic Logging

• @timestamp
• source.ip, destination.ip
• source.port, destination.port
• network.protocol, network.transport
• event.action, event.outcome, event.category, event.type
• url.full, url.domain, url.path
• http.request.method, http.response.status_code
• user.name, user.email, user.id
• user_agent.original
• network.bytes, source.bytes, destination.bytes

Extended Logging

• event.dataset, event.module, event.provider
• rule.name, rule.id, rule.category, rule.ruleset
• threat.tactic.*, threat.technique.*
• cloud.provider, cloud.account.id, cloud.region
• observer.vendor, observer.product, observer.type
• host.name, agent.id
• labels.*
• event.original
• geo fields for source, destination, and client

User And App Identity

• ECS user.*
• client.user.*, source.user.*, or destination.user.*
• url.domain, url.full
• application labels or service fields
• cloud account and region fields

OTLP Mapping Notes

Keep ECS names in OTLP attributes. The converter can map common ECS fields into the unified aiFObserve session schema and preserve confidence metadata.

Source

• OpenTelemetry Logs Data Model