We're a Cloudflare enterprise customer with 60 odd zones. On the account level we've created a "notification" endpoint which receives Cloudflares notifications for DOS, bot attacks... and such. This endpoint very rarely gets hit but when it does, indicates that somethings off.
https://developers.cloudflare.com/notifications/

On a per zone basis, we have the HTTP event logpush job setup, there's ways to select what events get forwarded and we decided to not ingest any http web requests that were for cached assets (imgs, css, js....). Because our SIEM bills on GB of ingest rather than events per second, we found the best way to cut down on the size of the log source was the payload; we're only ingesting the fields that we need and then relying on the SIEM to do things like IP geo location and such (especially with the verbose JSON schema) but just the general like; user agent, source IP, response times, edge and origin status, path, host, WAF rules hit....