Cloudflare

One integration covers two things:

Part	What it does
Response actions	Block or challenge addresses in your Cloudflare zone from the console, policy rules and Pallas; the Cloudflare page
Events	Pulls Cloudflare firewall and WAF events into the console, where Theseus rules raise alerts

Set up

1. In Cloudflare, create an API token with Zone: Read, Zone: Firewall Services: Edit and Zone: Analytics: Read on your zone. Note the zone ID and account ID.
2. In the console, Admin → Integrations → Cloudflare: fill in API token, Zone id and Account id, then Test connection and Save.

The change is applied within a minute. The token is stored encrypted and never shown again.

On a stack without the console, sudo ./theseus connectors enable cloudflare on the server sets up the events part instead.

Response actions

Cloud → Cloudflare has tabs Overview, Traffic, Firewall & WAF, DNS and Actions. Actions → Quick IP response applies to an IP or CIDR one of: Block, Managed challenge, Interactive challenge, JS challenge, with a note.

Events

Events are pulled every 30 minutes. Theseus rules 101300 to 101353 classify them.

Using Cloudflare in front of the stack

Cloudflare Tunnel as the stack's gateway is a different topic: see Cloud gateways.