Connecting Cloudflare Security Insights to Wazuh: building my own webhook bridge
Every security tool speaks its own language, and getting them to talk to each other is often the hardest part of running a home lab or a small security stack. That was exactly the challenge I ran into with Cloudflare and Wazuh.
The problem
Cloudflare has a great feature called Security Insights. It periodically scans your domains and flags risky configurations, things like DNS records pointing to servers that no longer exist, or origin IPs that are accidentally exposed to the internet. Left unnoticed, issues like these are exactly what attackers look for.
The catch is that Cloudflare has no built-in way to send these alerts into Wazuh, the open-source security monitoring platform I use to keep an eye on my infrastructure. Cloudflare can send a generic webhook notification, but there's no ready-made connector on the Wazuh side to receive and understand it. So I decided to build the bridge myself.
The idea
The plan was simple in concept: set up a small, lightweight service that can receive Cloudflare's webhook notifications, make sure it only accepts requests genuinely coming from Cloudflare, save each alert in a clean structured format, and have Wazuh watch that file and turn the alerts into proper security events on my dashboard.
The trickiest part wasn't the logic, it was making sure this little service could safely receive traffic from the internet without opening up my server to it directly. For that, I used a Cloudflare Tunnel, which lets Cloudflare securely forward traffic to a service running on my server without me ever having to open a firewall port to the outside world.
How it works, end to end
Here's the journey an alert takes today: Cloudflare's Security Insights feature detects something worth flagging, say, a DNS record pointing to nothing. Cloudflare sends a notification out to a secure address, protected by a private key only my server and Cloudflare know. That notification travels through the Cloudflare Tunnel, straight to the small listener service running quietly on my Linux server. The listener double-checks the notification is legitimate, then writes it neatly into a log file. Wazuh, which is already watching that log file, picks up the new entry, processes it, and raises it as an alert I can see and act on.
No open ports, no exposed servers, and no manual checking of Cloudflare's dashboard, the alerts now just show up where all my other security monitoring already lives.
Why this matters
This project turned a manual, easy-to-forget task, periodically remembering to check Cloudflare for new security insights, into an automated one that fits naturally into my existing monitoring setup. It's a small piece of infrastructure, but it closes a real gap: Cloudflare's own scans are only useful if someone actually sees the results in time to act.
It's also a good example of something I like about running your own security stack: when two tools don't talk to each other out of the box, you don't have to wait for a vendor to build that integration. Sometimes a few hours with a lightweight script and the right connective glue, like a Cloudflare Tunnel, gets you there yourself.
What's next
The listener is live and reliably passing alerts through to Wazuh. The next step is refining how those alerts are categorized once they land, so that a genuinely dangerous misconfiguration, like an exposed origin server, stands out clearly from lower-priority notices, instead of everything landing at the same level of urgency.