> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/a-c-integrations/cloudflare/cloudflare-zero-trust-network-access-via-webhook-setup-for-workbench.md).

# Cloudflare Zero Trust Network Access (via Webhook) Setup for Workbench

This topic helps you set up your Cloudflare ZTNA (via Webhook) integration with Workbench.

## Prerequisites

1. You must have admin access in Workbench to set up this integration.
2. You must have a Cloudflare Enterprise account with Zero Trust enabled.
3. You must have administrator access in Cloudflare, and be able to create new users.

## Before You Begin

**You must create a new user and mailbox at your organization to associate with Expel's access to Cloudflare.**

When you create the new user:

1. Use this format for the email address: `<Your_Workbench_GUID>@yourorganization.com`

{% hint style="info" %}
To find your GUID, go to **Organization Settings > My Organization** and look for the Organization GUID.&#x20;

Email example: If your organization were Acme Corp, the email address would be `a123b456-7c89-0def-g1hi-2j3k45l6mn7o@acmecorp.com`.
{% endhint %}

2. Make sure to save the new user's console login credentials, as they will be needed when you configure the security device in Workbench.&#x20;

## Step 1: Generate Cloudflare Credentials

In this step, you will create a new user for Expel console access and generate an API token for integration with Workbench.\
\
Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech. For more information, see [Why Expel Asks for Console Access](/connect-your-technology/about-integrations/why-expel-asks-for-console-access.md).

1. Log in to the [Cloudflare Dashboard](https://dash.cloudflare.com/) as an administrator.
2. Select the Cloudflare account you will be using to integrate with Workbench.
3. Select the vertical dots menu next to your account name and choose **Copy account ID. Save this ID in a safe place for use in a later step.**<br>

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FpXTDsBv2KK4DLzOBrDYC%2Funknown.png?alt=media&amp;token=224913be-f5ad-474c-927c-f50fa79142a1" alt="Copy account ID option in the kebab menu." width="301"><figcaption></figcaption></figure></div>
4. In the left sidebar, select **Manage account > Members**.
5. Select **Invite Members**.
6. On the Invite Members screen, use the `<Your_Workbench_GUID>@yourorganization.com` email address [you set up for Expel's access](#before-you-begin).
7. In the Add permission policies section, select **Create a policy**.
8. Configure the policy as follows:
   * **Define scope** - select the account you are integrating with Workbench. ("Applies to: Entire account" will automatically be selected.)
   * **Assign roles** - select **Cloudflare Zero Trust Read Only**.
9. Select **Create policy**.<br>

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2F9bwWU1PHUlazhPbxm9wh%2Fcloudflare-ztna-scope-and-roles.png?alt=media&amp;token=9b1fe12e-2a57-4a56-afc6-d6d07b9a15af" alt="Policy configuration has the Expel account selected as the scope, the roles assigned, and Zero Trust Read Only role toggled on." width="563"><figcaption></figcaption></figure></div>
10. Select **Invite members**. This triggers an email invitation to the new user account.
11. In the left sidebar, select **Manage account > Account API Tokens**.&#x20;
12. Select **Create token**.&#x20;
13. For the new token:&#x20;
    * Name it "Expel API token" or similar.&#x20;
    * Use the dropdown menu under "Edit policy" to scope the key to **Entire Account**.&#x20;
14. For the token permissions, apply all of the following:&#x20;
    * Access: SCIM Logs > Read&#x20;
    * Account Analytics > Read&#x20;
    * Zero Trust > Read&#x20;
    * Zero Trust: PII > Read (*optional* - for query\_user\_risk\_events) &#x20;
15. Set the token expiration to 1 year.&#x20;
16. Select **Review token > Create token**.
17. The token displays. **Copy and save it in a safe place for later use**.

## Step 2: Add Cloudflare ZTNA as a Security Device in Workbench

The next step is to add a Cloudflare ZTNA security device in Workbench so that you can generate and copy the necessary webhook credentials, which you will need later in the guide. **Before you begin, make sure you have the email address, account ID, and API key you saved in Step 1**.

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**. If you have multiple organizations, you must select the appropriate organization name from the list.
3. Select **Add Security Device**.
4. In the search box, type “Cloudflare” and then select the **Cloudflare ZTNA (via Webhook)** integration.
5. Complete the fields as follows:
   * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Cloudflare ZTNA”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   * **Location** - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   * **Webhook fields** - can be ignored for now.
   * **Cloudflare email** - enter the `<Your_Workbench_GUID>@yourorganization.com` email you used in the previous step.
   * **Account ID of user** - enter the account ID you saved in the previous step.
   * **API token** - enter the token you saved in the previous step.
6. Select **Save**.
7. On the console access screen, select **Set up now (recommended)**.
8. Enter the login credentials for the user [you set up for Expel's access](#before-you-begin).
9. Select **Save**.
10. Select **Done**.
11. Locate your new device in the list of security devices.
12. Use the menu beside the device name to [edit the device details](/connect-your-technology/security-devices/manage-security-devices.md#edit-a-security-device).
13. **Copy and save the Webhook URL, username, and password** in a safe place for use in the next step.

## Step 3: Configure Cloudflare Logpush

This step establishes the direct, automated connection between your Cloudflare account and the Workbench platform using the Cloudflare Logpush service. This ensures immediate, continuous data delivery for security and performance analysis.

You will forward the following log types from Logpush to Workbench:

* Access Request Logs&#x20;
* Gateway HTTP Logs &#x20;
* Gateway Network Logs&#x20;

### Generate Your Token

The webhook is authenticated using the webhook username and password provided in Workbench. These credentials must be Base64-encoded and appended to the Logpush URL. This combination (**username:password** pair) will form the `BASE64_TOKEN`. Follow the instructions for your respective operating system to Base64-encode your credentials via command line, substituting the Webhook username and password in the command:

{% tabs %}
{% tab title="Windows" %}
`[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("username:password"))`
{% endtab %}

{% tab title="Unix-Like Systems" %}
`echo -n "username:password" | base64`
{% endtab %}
{% endtabs %}

**Copy and save the token in a safe place for use in a later step.**

### Create Logpush Jobs in Cloudflare

1. From within your account in Cloudflare, use the left sidebar to select **Analytics & Logs > Logpush**.
2. Select **Create a Logpush job**.
3. On the Select Destination page, choose **HTTP destination**.
4. On the Enter destination details page, enter the **HTTP endpoint** using the following format, substituting the webhook URL from Workbench and the base64-encoded token you generated in the string:\
   \
   **`<WEBHOOK_URL>`**`?header_Content-Type=application%2Fjson&header_Authorization=Basic%20`**`<BASE64_TOKEN>`**<br>

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FOcs2iQaqodF1OxYCIHyE%2Funknown.png?alt=media&amp;token=cb7a9576-51af-4613-936e-c33cb21a139b" alt="Example shows the HTTP endpoint string with the substituted values entered into the HTTP endpoint field of Cloudflare." width="563"><figcaption></figcaption></figure></div>
5. Select **Continue**.
6. On the Select dataset page, select **Access requests**.
7. Select **Continue**.
8. On the Configure logpush job page, configure as follows:
   * **Name** - enter a unique name for the Logpush job. For example, ”logpush-job-access-requests”.&#x20;
   * **If logs match**… - select **All logs**.
   * **Send the following fields**… - choose **Select All**.<br>

     <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2Fsk2TuTNkFFBbXflbDZty%2Funknown.png?alt=media&amp;token=735d4f4d-cdc6-4ef5-b514-851da5ec796b" alt="Logpush job configuration is set as instructed." width="375"><figcaption></figcaption></figure></div>
9. Select **Submit**.
10. Repeat steps 2-9 two more times, selecting **Gateway HTTP** and **Gateway Network** as datasets for the additional jobs. **You will create three Logpush jobs in total**.

With the three logpush jobs created, setup is now complete.

To check if alerts are coming through in Workbench, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).

To check on the status of the device in Workbench, navigate to **Organization Settings > Security Devices**. Select the downward arrow for your device in the first column and choose **View details**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/connect-your-technology/a-c-integrations/cloudflare/cloudflare-zero-trust-network-access-via-webhook-setup-for-workbench.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.