Skip to content

Catching a dangling DNS record with a Cloudflare-to-Sentinel pipeline

Cloudflare already knew about the dangling record; the fix was getting its security insights into the SIEM where someone would act on them.

Date

The finding

Cloudflare’s security insights had flagged a DNS record pointing at a resource that no longer existed. That is the setup for a subdomain takeover: anyone who claims the abandoned target gets to serve content under the organization’s name. The insight had been sitting in the Cloudflare dashboard. Nobody was looking there, because nobody looks at 51 categories of findings across a dashboard they do not live in.

Context

The security team’s day runs through Microsoft Sentinel. Cloudflare’s security center produces useful findings, but they lived in a separate console with no alerting into the SIEM. The goal was to make Cloudflare’s findings show up where the analysts already were.

What was built

  • An Azure Function App with an HTTP trigger that receives Cloudflare webhook notifications.
  • The function normalizes each insight into a flat record and posts it to the Azure Monitor Logs Ingestion API.
  • A custom data collection rule and data collection endpoint that map the payload into a custom table in the Sentinel workspace.
  • Coverage for all 51 insight classes Cloudflare exposes, so new finding types land in the same table without code changes.
  • Analytics rules on the table for the classes that warrant a ticket, dangling records among them.

Evidence

A rule in the shape of the one that surfaced the record, with the table and column names generalized:

CloudflareInsights_CL
| where TimeGenerated > ago(1d)
| where InsightClass has "dangling"
| project TimeGenerated, InsightClass, Severity, Zone, Subject
| order by TimeGenerated desc

What it means

The record was removed the same day it surfaced in Sentinel. The larger point is that the control already existed; the gap was that its output did not reach anyone. Wiring an existing signal into the place people work is cheaper than buying a new signal, and it is the kind of gap worth looking for in every console the team does not open daily.