QUESTION

I can see a Cloudflare.ZeroTrust.RData schema referenced in Panther, but I can't find any documentation for it. Is it a supported log type?

ANSWER

Yes, Cloudflare.ZeroTrust.RData is a valid Panther schema used to ingest Cloudflare Zero Trust RData logs. This schema is not listed with other Cloudflare schemas because RData represents DNS resource record data, which differs from traditional log event data.

Feel free to check the schema:

schema: Cloudflare.ZeroTrust.RData
description: Cloudflare Zero Trust Rdata schema
referenceURL: https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/rdata/
fields:
    - name: QueryName
      description: The Query Name
      type: string
    - name: QueryType
      description: The Query Type
      type: string
    - name: QueryClass
      description: The Query Class. Represented in numbers
      type: int
    - name: ResponseTTL
      description: The Response TTL
      type: bigint
    - name: ResponseData
      description: The Response Data
      type: string
    - name: type
      description: The Cloudflare Type outside the ZeroTrust RData envelope
      type: string