# NG SIEM - Cloudflare Integration

#### **<span style="color: rgb(53, 152, 219);">Introduction</span>**

<span style="color: rgb(0, 0, 0);">Cloudflare logs provide detailed insights into client connections, request paths through the Cloudflare network, and origin server responses. These logs help track activity, identify issues, and support security and performance analysis.</span>

---

#### <span style="color: rgb(53, 152, 219);">**Authentication Options**</span>

<span style="color: rgb(0, 0, 0);">You can configure log retrieval using the following authentication methods:</span>

1. <span style="color: rgb(0, 0, 0);">**Auth Email and Auth Key(Depreciated)**</span>
2. <span style="color: rgb(0, 0, 0);">**API Token**</span>

<span style="color: rgb(0, 0, 0);">For detailed information on authentication, refer to the<span style="color: rgb(132, 63, 161);"> **[Cloudflare API documentation](https://developers.cloudflare.com/api/)**</span>.</span>

---

#### <span style="color: rgb(53, 152, 219);">**1. Configure Using Auth Email and Auth Key**</span>

<span style="color: rgb(0, 0, 0);">To set up using this method, you need:</span>

- <span style="color: rgb(0, 0, 0);">**Auth Email**: The email address associated with your Cloudflare account.</span>
- <span style="color: rgb(0, 0, 0);">**Auth Key**: Your global API key, available on the <a class="cursor-pointer" data-end="1015" data-start="955" rel="noopener" style="color: rgb(0, 0, 0);" target="_new">My Profile</a> page.</span>
- <span style="color: rgb(0, 0, 0);">**Zone ID**: The unique identifier of your **<span style="color: rgb(132, 63, 161);">[Cloudflare zone](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/)</span>**, available in the zone's dashboard.</span>

<span style="color: rgb(0, 0, 0);">These credentials must be included in the request headers:</span>

- <span style="color: rgb(0, 0, 0);">`X-Auth-Email`: Your account email.</span>
- <span style="color: rgb(0, 0, 0);">`X-Auth-Key`: Your global API key.</span>

<span style="color: rgb(0, 0, 0);">For more details, refer to Cloudflare’s <a class="cursor-pointer" data-end="1381" data-start="1297" rel="noopener" style="color: rgb(0, 0, 0);" target="_new">authentication headers guide</a>.</span>

---

#### <span style="color: rgb(53, 152, 219);">**2. Configure Using API Token**</span>

<span style="color: rgb(0, 0, 0);">To set up using an API token, you need:</span>

- <span style="color: rgb(0, 0, 0);">**API Token**: A token with appropriate permissions.</span>
- <span style="color: rgb(0, 0, 0);">**Zone ID**: As noted above, can be found in your Cloudflare zone dashboard.</span>

<span style="color: rgb(0, 0, 0);">**Minimum Required Permissions for the API Token**:</span>

- <span style="color: rgb(0, 0, 0);">`Account.Access:Audit Logs:Read`</span>
- <span style="color: rgb(0, 0, 0);">`Account.Account:Settings:Read`</span>

<span style="color: rgb(0, 0, 0);">API Tokens are preferred for security as they support fine-grained access control. Create and manage tokens via the <a class="cursor-pointer" data-end="1877" data-start="1807" rel="noopener" style="color: rgb(0, 0, 0);" target="_new">API Tokens dashboard</a>.</span>

<span style="color: rgb(0, 0, 0);">Manage Account&gt;Account API Tokens&gt;Custom Token&gt;Get Started</span>

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/scaled-1680-/JtkhHwPR53u18MYN-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/JtkhHwPR53u18MYN-image.png)

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/scaled-1680-/ZmQwl21RBq8SR7QU-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/ZmQwl21RBq8SR7QU-image.png)

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/scaled-1680-/VDSOq15OcoEmSVPu-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/VDSOq15OcoEmSVPu-image.png)

```python
curl -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json"

```

[![image.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/scaled-1680-/ATiOTiGP9Lom8Psr-image.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-07/ATiOTiGP9Lom8Psr-image.png)

---

#### <span style="color: rgb(53, 152, 219);">**Audit Logs**</span>

<span style="color: rgb(0, 0, 0);">Audit logs provide a record of configuration changes within your Cloudflare account, including:</span>

- <span style="color: rgb(0, 0, 0);">Logins/logouts</span>
- <span style="color: rgb(0, 0, 0);">DNS setting changes</span>
- <span style="color: rgb(0, 0, 0);">Modifications to Firewall, Caching, Page Rules, Speed, Network, and Traffic features</span>

<span style="color: rgb(0, 0, 0);">These logs are essential for tracking administrative activity and detecting unusual behavior.</span>

---

<p class="callout warning"><span style="color: rgb(0, 0, 0);">To enable log collection from the Cloudflare API token, provide the following information to **CyTech Support**:</span></p>

- **<span style="color: rgb(0, 0, 0);">Account ID</span>**
- **<span style="color: rgb(0, 0, 0);">API Token</span>**

<span style="color: rgb(0, 0, 0);">*<span class="TextRun SCXW71272603 BCX0" data-contrast="auto" lang="EN-US" xml:lang="EN-US"><span class="NormalTextRun SCXW71272603 BCX0">If you need further </span><span class="NormalTextRun SCXW71272603 BCX0">assistance</span><span class="NormalTextRun SCXW71272603 BCX0">, kindly contact </span></span><span style="color: rgb(53, 152, 219);">**<span class="TextRun SCXW71272603 BCX0" data-contrast="none" lang="EN-US" xml:lang="EN-US"><span class="NormalTextRun SCXW71272603 BCX0">support@cytechint.com</span></span>**</span><span class="TextRun SCXW71272603 BCX0" data-contrast="auto" lang="EN-US" xml:lang="EN-US"><span class="NormalTextRun SCXW71272603 BCX0"> for prompt </span><span class="NormalTextRun SCXW71272603 BCX0">assistance</span><span class="NormalTextRun SCXW71272603 BCX0"> and guidance.</span></span><span class="EOP SCXW71272603 BCX0" data-ccp-props="{}"></span>*</span>