Cloudflare

Turngate ingests audit logs from your Cloudflare account so you can investigate account- and zone-level activity alongside the rest of your SaaS audit data.

Setting Up

Preparing your Cloudflare Account

To set up the Cloudflare integration you need to be a Super Administrator on the Cloudflare account you want to connect. Audit logs are pulled at the account level, so a single Data Source will cover every zone in that account.

1

Log in to Cloudflare

Log in to the Cloudflare dashboard and select the account you want to connect.

2

Open API Tokens

From the account home, open Manage Account → API Tokens.

3

Create a custom token

Click Create Token and choose Create Custom Token.

4

Configure token permissions

Give the token a descriptive name (e.g. Turngate Audit Log Reader) and grant the following permissions:

• Account → Account Settings → Read

• Account → Audit Logs → Read

• Account → Access: Organizations, Identity Providers, and Groups → Read (only required if you use Cloudflare Access and want those events included)

5

Scope the token to your account

Under Account Resources, scope the token to the specific account you want Turngate to monitor.

6

Set token restrictions

Leave Client IP Address Filtering blank and set a TTL that matches your internal token-rotation policy.

7

Create and copy the token

Click Continue to summary, then Create Token, and copy the token value. You will not be able to view it again.

You will also need your Account ID, which is shown on the right-hand sidebar of any zone's Overview page in the Cloudflare dashboard.

We recommend creating the token under a service account or shared admin identity rather than a personal login so that audit collection isn't interrupted if an individual leaves your organization.

Setting up the Cloudflare Data Source in the Turngate App

Once you have your API token and Account ID, head back to the Turngate App.

1

Open Data Sources

Click Data Sources in the navigation bar on the left.

2

Install Cloudflare

Click Install on the Cloudflare selection.

3

Name the Data Source

Give the Data Source a name for your own reference.

4

Add credentials

Paste in the Account ID and API Token you generated above.

5

Install the Data Source

Click Install.

Turngate will validate the credentials and begin pulling audit logs. Up to 30 days of historical logs will be backfilled where available.

Scopes Requested

• Account Settings — Read

• Audit Logs — Read

• Access: Organizations, Identity Providers, and Groups — Read (optional, only if Cloudflare Access events are desired)

Other Resources

• Cloudflare Audit Logs documentation

• Creating API tokens

• Audit log event reference