Cloudflare 3.0.3 - Modified workbook file, fixed workbook metadata to reference Cloudflare parser and CCF connector; added deployment prerequisites note to connector description

[rohan-sacumen]

PR Summary

This PR focuses on Fixing workbooks, workbook metadata to correctly reference the Cloudflare Parser and Cloudflare CCF connector, along with adding deployment prerequisite notes to the connector UI page.

What’s included in this PR:
Change(s):

• Updated the queries in the workbook file (CloudflareCCF.json)
• Updated the workbook metadata to correctly reference the Cloudflare Parser and Cloudflare CCF connector
• Added the Cloudflare image to the Logo folder
• Added deployment prerequisite notes for the Cloudflare CCF connector in the connector description section

Reason for Change(s):

• See guidance below

Version Updated:

• 3.0.3

Testing Completed:

• Tested log ingestion to Log Analytics Workspace table.
• Verified end-to-end log ingestion; data ingestion has been tested and confirmed working.
• Workbook testing has been completed successfully.

Pending / Follow-ups:

• aka.ms short link (https://aka.ms/sentinel-CloudflareDefinition-parser) needs to be generated for final Marketplace/Solution readiness.

[rohan-sacumen]

Workbooks screenshots

[rohan-sacumen]

This PR is a follow-up to the previous PR #14115

[rohan-sacumen]

Hi @v-maheshbh,

I do not have access to the aka.ms portal to create the required short link referenced in the Workbooks file (CloudflareCCF.json). Could you please help create the following short link?

https://aka.ms/sentinel-CloudflareDefinition-parser

The previous aka.ms short link (https://aka.ms/sentinel-CloudflareDataConnector-parser) was pointing to the parser for the deprecated Cloudflare Solution instead of the new Cloudflare CCF solution.

Thank you.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR updates the Cloudflare CCF solution workbook and metadata to align with the Cloudflare parser/connector identifiers, and adds a prerequisite notice to the connector UI text.

Changes:

• Updated Cloudflare CCF workbook queries/fields and parser reference link.
• Updated workbook metadata dependencies and workbook template path.
• Bumped solution version to 3.0.3 and updated package UI/test parameters.

Reviewed changes

Copilot reviewed 7 out of 10 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Updates Cloudflare workbook metadata dependencies and template filename reference.
Solutions/Cloudflare CCF/Workbooks/CloudflareCCF.json	Updates workbook parser note/link and multiple queries to new field names; updates fromTemplateId.
Solutions/Cloudflare CCF/ReleaseNotes.md	Adds 3.0.3 release notes entry.
Solutions/Cloudflare CCF/Package/testParameters.json	Updates workbook display name default value used by deployment parameters.
Solutions/Cloudflare CCF/Package/createUiDefinition.json	Updates workbook label/text shown during solution deployment.
Solutions/Cloudflare CCF/Data/Solution_Cloudflare.json	Updates workbook path and bumps solution version to 3.0.3.
Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_ConnectorDefinition.json	Adds deployment prerequisite note to connector descriptionMarkdown.

[v-maheshbh]

Hi @rohan-sacumen

Kindly review above PR comments.

Thanks!

[rohan-sacumen]

Hi @v-maheshbh,

I have gone through the GitHub copilot comments and will update the changes accordingly wherever required.

Thank you

[rohan-sacumen]

Hi @v-maheshbh,

I have reviewed and addressed all the GitHub co-pilot comments on this PR. Kindly review the changes and let me know if any further updates are required.

Thank you

[rohan-sacumen]

Hi @v-maheshbh,

Could you please confirm whether the aka.ms short link (https://aka.ms/sentinel-CloudflareDefinition-parser) will be created before merging the PR or after the PR has been merged?

Thank you

[v-maheshbh]

Hi @v-maheshbh,

Could you please confirm whether the aka.ms short link (https://aka.ms/sentinel-CloudflareDefinition-parser) will be created before merging the PR or after the PR has been merged?

Thank you

once the PR has been merged.

Thanks!

[rohan-sacumen]

Hi @v-maheshbh,

Thank you for the confirmation. Please let me know once the aka.ms link is created.

Thank you

[v-maheshbh]

Hi @rohan-sacumen
Kindly review the validation failure below encountered during custom deployment of the main template.

Thanks!

[rohan-sacumen]

Hi @v-maheshbh,

I will try to reproduce the validation failure on my end by performing custom deployment of the main template.

Thank you

[rohan-sacumen]

Hi @v-maheshbh,

I was able to reproduce the validation failure encountered during the custom deployment of the main template.

Root Cause:
The error — Metadata already exists with the same parentId: Parser-Cloudflare (Code: BadRequestException) — occurs when a metadata entry with the same parentId already exists in the target workspace, typically from a prior deployment or an existing Cloudflare solution installed via Content Hub.

Resolution:
The conflicting metadata entry can be removed using the Microsoft Sentinel REST API before redeployment:

az rest --method DELETE
--url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/Parser-Cloudflare?api-version=2025-09-01"

After deleting the existing metadata, the custom deployment of the main template completes successfully without the BadRequestException.

Reference: https://learn.microsoft.com/en-us/rest/api/securityinsights/metadata/delete?view=rest-securityinsights-2025-09-01&tabs=HTTP

Thank you

[rohan-sacumen]

Hi @v-maheshbh,

I wanted to follow up on my previous comment regarding the metadata validation failure (Metadata already exists with the same parentId: Parser-Cloudflare).

I have provided the root cause and resolution details approximately a day ago. Could you please review the comment and let me know if any further changes or clarifications are needed on my end to proceed with the merge?

Thank you

[rohan-sacumen]

Hi @v-maheshbh,

Just following up again regarding the metadata validation failure issue:
Metadata already exists with the same parentId: Parser-Cloudflare

I had shared the root cause and proposed resolution earlier, but I have not yet received a response. Could you please review the previous comment and let me know if any additional changes or clarifications are required from my end?

Looking forward to your guidance

Thank you

[v-maheshbh]

Hi @v-maheshbh,

Just following up again regarding the metadata validation failure issue: Metadata already exists with the same parentId: Parser-Cloudflare

I had shared the root cause and proposed resolution earlier, but I have not yet received a response. Could you please review the previous comment and let me know if any additional changes or clarifications are required from my end?

Looking forward to your guidance

Thank you

I will validate this by deploying the solution in a different workspace.

Thanks!

[rohan-sacumen]

Hi @v-maheshbh,

Thank you for the update! Please let me know if you need any additional details or run into any issues during the validation. I am happy to assist.

Looking forward to your findings.

Thank you

[v-maheshbh]

The solution deployment to Content Hub is successful. However, it is observed that version 3.0.2 is not live in Content Hub, and this PR has been packaged with version 3.0.3.

Thanks!

[rohan-sacumen]

Hi @v-maheshbh,

Thank you for the update and for confirming the successful deployment!

Regarding version 3.0.2 not being live in Content Hub — this was due to a broken aka.ms link (https://aka.ms/sentinel-CloudflareDataConnector-parse) that caused the solution to fail the best practices tests validation during Content Hub publishing as shown in the screenshot. As a result, version 3.0.2 was never published live.

This PR (version 3.0.3) includes the fix for the broken link (i.e creating a new aka.ms link https://aka.ms/sentinel-CloudflareDefinition-parser which points to the Parser of the new Cloudflare CCF solution) along with the other changes, and is intended to be the version that goes live in Content Hub.

Please let me know if any further clarification or changes are needed to proceed with the merge.

Thank you

[v-maheshbh]

Hi @v-maheshbh,

Thank you for the update and for confirming the successful deployment!

Regarding version 3.0.2 not being live in Content Hub — this was due to a broken aka.ms link (https://aka.ms/sentinel-CloudflareDataConnector-parse) that caused the solution to fail the best practices tests validation during Content Hub publishing as shown in the screenshot. As a result, version 3.0.2 was never published live.

This PR (version 3.0.3) includes the fix for the broken link (i.e creating a new aka.ms link https://aka.ms/sentinel-CloudflareDefinition-parser which points to the Parser of the new Cloudflare CCF solution) along with the other changes, and is intended to be the version that goes live in Content Hub.

Please let me know if any further clarification or changes are needed to proceed with the merge.

Thank you

Can these changes be packaged under version 3.0.2?

Thanks!

[rohan-sacumen]

Hi @v-maheshbh,

Thank you for raising this. However, based on the official Microsoft Sentinel solution packaging guidelines, these changes cannot be packaged under version 3.0.2.

The official documentation states:

• "For every new modification to the files after the initial version of package, a new zip file should be created with an updated version name (3.0.0, 3.0.1 etc.) containing modified createUIDefinition.json and mainTemplate.json files."
• "When updating your package, make sure to increase the version value, regardless of how small or trivial the change is, including typo fixes in content or solution definition files."

Since version 3.0.2 was already created (even though it did not go live in Content Hub), reusing it would not align with the versioning guidelines. Hence, version 3.0.3 is the correct version for this package.

References:

• https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md
• https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/README.md#updating-your-solution

Please let me know if you need any further clarification.

Thank you

[v-maheshbh]

Hi @rohan-sacumen

https://aka.ms/sentinel-CloudflareDefinition-parser

The short link has been created. Thanks!