R2 monitoring on wazuh

[Asmit Desai]

Hi team 

I wanted to check how could I monitor R2 cloudflare buckets on wazuh . I already have a script that captures audit firewall and dns logs but i am unable to find a suitable solution to monitor the R2 Buckets. Could I please get some help for the same.

Regards 

Asmit 

[Olamilekan Abdullateef Ajani]

Hi Asmit,

There is no native Wazuh integration for Cloudflare R2 buckets like there is for some AWS services.

Depending on what you want to monitor, options are:

- Bucket configuration changes
For changes like bucket creation/deletion, custom domain changes, public access changes, CORS, lifecycle rules, etc., use Cloudflare Audit Logs. R2 audit logs cover bucket configuration activity, but not object reads/writes.

You can pull those audit logs with your existing Cloudflare script, write them as JSON to a file, and let the Wazuh agent read the file:

<localfile>
  <location>/var/log/cloudflare/r2_audit.json</location>
  <log_format>json</log_format>
</localfile>

- Object create/delete events
For object uploads or deletes, use R2 Event Notifications with Cloudflare Queues. Those events can be consumed by a worker or pulled over HTTP from outside Cloudflare, then written to a JSON log file for the Wazuh agent to read from.
https://developers.cloudflare.com/r2/buckets/event-notifications/

- Public object access
If the bucket is exposed through a public hostname or custom domain, use Cloudflare HTTP requests Logpush for that hostname. Cloudflare states that HTTP request logs should be used for requests to public R2 buckets.
https://developers.cloudflare.com/r2/platform/audit-logs/

You should avoid trying to point the aws-s3 wodle directly at R2. It is designed around AWS S3/STS behavior.
https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-s3.html

Another thing to mention is that Cloudflare audit logs do not include GetObject and PutObject, so you may not get full object-level access visibility unless you front the bucket through Cloudflare HTTP/Workers and log from there.

Regards,