Update Sentinel and Splunk analytics integrations

[ngayerie]

Summary

What: Expand analytics/analytics-integrations/sentinel and analytics/analytics-integrations/splunk with the setup and operations details customers have been asking for.

Sentinel:

• Detailed prerequisites: ADLS Gen2, RBAC roles, Event Grid resource provider, DCR/DCE, network access rules, and required storage/Sentinel co-location.
• Refreshed Content hub and CCF connector-field walkthrough.
• Log Analytics KQL verification query and expected ingestion window.
• Troubleshooting entry for the InvalidTemplate: CreateDataFlowResources ARM error.
• Deprecation notice for the legacy Azure Function-based solution.

Splunk:

• HEC Global Settings guidance (enable All Tokens, Enable SSL).
• Dataset-to-sourcetype mapping (cloudflare:json, cloudflare:dns, cloudflare:audit, cloudflare:access).
• Confirmation-events note when validating a new Logpush job.

Why: Customers deploying these integrations were missing prerequisites, connector-field detail, and the troubleshooting path for the most common ARM template failure. No screenshots are added; steps link out to the relevant Microsoft and Splunk docs.

DEE-3779

Documentation checklist

• Is there a changelog entry — not applicable, this is a docs enhancement to existing pages.
• The change adheres to the documentation style guide.
• No file has been renamed or relocated, so no redirects are needed.

[cloudflare-docs-bot]

Review

⚠️ 4 warnings, 💡 1 suggestion found in commit 5fcfa3d.

👉 Fix in your agent 👈

Fix the following review findings in PR #33059 (https://github.com/cloudflare/cloudflare-docs/pull/33059).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.

The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.

---

## Code Review

### Warnings (3)

#### CR-3138e225a15c · Wrong Splunk CIM field name for referrer
- **File:** `src/content/docs/analytics/analytics-integrations/splunk.mdx` line 221
- **Issue:** The HTTP requests table maps `ClientRequestReferer` to `http_referer`, but the Splunk CIM Web data model normalizes this value as `http_referrer` (two r's).
- **Fix:** Change the Splunk CIM field from `http_referer` to `http_referrer` so the mapping aligns with the standard CIM Web field.

#### CR-1025419467c2 · Semantic mismatch for DNS query size mapping
- **File:** `src/content/docs/analytics/analytics-integrations/splunk.mdx` line 252
- **Issue:** The DNS logs table maps `QuerySize` to `query_count`. In the Cloudflare gateway_dns schema `QuerySize` is the DNS request size in bytes, while Splunk CIM DNS uses `query_count` to mean the number of queries in a transaction.
- **Fix:** Remove or remap `QuerySize` to a field that represents payload size, and avoid conflating byte size with query count.

#### CR-15e6a491a88d · Wrong Splunk CIM field name for session identifier
- **File:** `src/content/docs/analytics/analytics-integrations/splunk.mdx` line 306
- **Issue:** The Zero Trust Gateway Network table maps `SessionID` to `ssid`. In Splunk CIM Network Traffic, the session identifier field is `session_id`; `ssid` is the wireless service-set identifier field.
- **Fix:** Change the CIM mapping for `SessionID` from `ssid` to `session_id`.

### Suggestions (1)

#### CR-a506e8058cfe · Ambiguous DNS dataset heading
- **File:** `src/content/docs/analytics/analytics-integrations/splunk.mdx` line 244
- **Issue:** The 'DNS logs' mapping lists fields (`DstIP`, `DstPort`, `Protocol`, `QuerySize`, `QueryTypeName`, `RCode`, `SrcPort`) that match the account-scoped `gateway_dns` dataset instead of the zone-scoped `dns_logs` dataset documented elsewhere, which lacks those fields and uses `ResponseCode` rather than `RCode`.
- **Fix:** Rename the section to 'Gateway DNS' or otherwise disambiguate which Cloudflare Logpush dataset the DNS mapping applies to, and verify the field list matches that dataset.

---

## Style Guide Review

### Warnings (1)

#### SG-9389419bc184 · Avoid directional words
- **File:** `src/content/docs/analytics/analytics-integrations/sentinel.mdx` line 164
- **Issue:** Line contains "the tables below"
- **Fix:** Replace "the tables below" with a direct reference such as "the following tables" or "the tables in this section"

Code Review

This code review is in beta and may not always be helpful — use your judgment.

Warnings (3)

File	Issue
analytics/analytics-integrations/splunk.mdx line 221	Wrong Splunk CIM field name for referrer — The HTTP requests table maps ClientRequestReferer to http_referer, but the Splunk CIM Web data model normalizes this value as http_referrer (two r's). Fix: Change the Splunk CIM field from http_referer to http_referrer so the mapping aligns with the standard CIM Web field.
analytics/analytics-integrations/splunk.mdx line 252	Semantic mismatch for DNS query size mapping — The DNS logs table maps QuerySize to query_count. In the Cloudflare gateway_dns schema QuerySize is the DNS request size in bytes, while Splunk CIM DNS uses query_count to mean the number of queries in a transaction. Fix: Remove or remap QuerySize to a field that represents payload size, and avoid conflating byte size with query count.
analytics/analytics-integrations/splunk.mdx line 306	Wrong Splunk CIM field name for session identifier — The Zero Trust Gateway Network table maps SessionID to ssid. In Splunk CIM Network Traffic, the session identifier field is session_id; ssid is the wireless service-set identifier field. Fix: Change the CIM mapping for SessionID from ssid to session_id.

Suggestions (1)

File

Issue

analytics/analytics-integrations/splunk.mdx line 244

Ambiguous DNS dataset heading — The 'DNS logs' mapping lists fields (DstIP, DstPort, Protocol, QuerySize, QueryTypeName, RCode, SrcPort) that match the account-scoped gateway_dns dataset instead of the zone-scoped dns_logs dataset documented elsewhere, which lacks those fields and uses ResponseCode rather than RCode. Fix: Rename the section to 'Gateway DNS' or otherwise disambiguate which Cloudflare Logpush dataset the DNS mapping applies to, and verify the field list matches that dataset.

Conventions

_{No convention issues found.}

Style Guide Review

Warnings (1)

File	Issue
analytics/analytics-integrations/sentinel.mdx line 164	Avoid directional words — Line contains "the tables below" Fix: Replace "the tables below" with a direct reference such as "the following tables" or "the tables in this section"

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[ngayerie]

[AI] Triage of the code-review bot findings on 0560d03 — all 6 look legitimate, none require clarification:

ID	File / line	Agree?	Plan
CR-e7252f2c3d02	sentinel.mdx L40, L109	✅ Agree	Reword to "Cloudflare CCF connector service principal / application" and drop the Microsoft-Sentinel ownership phrasing.
SG-2d8ad00db9da	sentinel.mdx L21	✅ Agree	Replace "documented below" with "documented in this guide".
SG-e13d4b76765b	splunk.mdx L60	✅ Agree	"turned on" instead of "set to Enabled".
SG-5a06a4ee4266	splunk.mdx L106	✅ Agree	"turn on" instead of "enable".
SG-6d5acda3ec8a	splunk.mdx L108	✅ Agree	Drop "below", keep the anchor link.
SG-c30ba167399b	splunk.mdx L52	✅ Agree	"Select" instead of "Click" for the line I touched. Other pre-existing "Click" usages left as-is to keep scope tight.

Applying fixes now.

[ngayerie]

[AI] Triage of the flue review on 9ee874c — both findings are legitimate:

ID	File / line	Agree?	Plan
SG-e900072a2c83	sentinel.mdx L20	✅ Agree	Drop the date from the admonition title; use "Legacy connector deprecation".
SG-e053572c78cc	sentinel.mdx L21	✅ Agree	Remove the hard date from the body text; the linked changelog entry is the canonical source for the end-of-support date.

Applying now.