What Changed

Fixed workbook queries in the Cloudflare CCF solution to reference the correct normalized field names from the CCF connector’s ASIM parser, resolving visualization failures from legacy field references.

Workbook Impact

  • Field mappings corrected: Updated queries to use normalized ASIM fields (SrcIpAddr, HttpUserAgentOriginal, HttpReferrerOriginal, HttpRequestMethod, SrcGeoCountry) instead of legacy Cloudflare-specific field names (ClientIP, ClientRequestUserAgent, ClientRequestReferer, ClientRequestMethod, ClientCountry)
  • Data visualization restored: Workbook charts and tables will now display data correctly for deployments using the Cloudflare CCF connector
  • Deployment guidance added: Connector description now explicitly warns that the CCF connector requires the Azure Blob Storage account and Microsoft Sentinel workspace to be in the same subscription and resource group

The field mapping corrections address a data fidelity issue where workbook queries returned null results due to referencing non-existent field names in the CCF connector’s normalized output schema.

Deployment Prerequisites

Added critical deployment constraint documentation: the Cloudflare CCF connector requires Azure Blob Storage and the Microsoft Sentinel workspace to be co-located in the same Azure subscription and resource group. Cross-subscription deployments will fail with CreateDataFlowResources not defined errors during connector configuration.

Affected Files

Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_ConnectorDefinition.json
Solutions/Cloudflare CCF/Package/testParameters.json
Solutions/Cloudflare CCF/Workbooks/CloudflareCCF.json
Solutions/Cloudflare CCF/Workbooks/Images/Logo/cloudflare.svg
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.0.3.zip, ReleaseNotes.md, Solution_Cloudflare.json, createUiDefinition.json, mainTemplate.json)