> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/a-c-integrations/cloudflare/cloudflare-zero-trust-network-access-via-webhook-setup-for-workbench.md).

# Cloudflare Zero Trust Network Access (via Webhook) Setup for Workbench

## Prerequisites

1. You must have admin access in Workbench to set up this integration.
2. You must have a Cloudflare Enterprise account with Zero Trust enabled.

## Step 1: Generate Cloudflare Credentials

In this step, you will create a new user for Expel console access and generate an API token for integration with Workbench.\
\
Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech. For more information, see [Why Expel Asks for Console Access](/connect-your-technology/about-integrations/why-expel-asks-for-console-access.md).

1. Log in to the [Cloudflare Dashboard](https://dash.cloudflare.com/).
2. Select the Cloudflare account you will be using to integrate with Workbench.
3. Select the vertical dots menu next to your account name and choose **Copy account ID. Save this ID in a safe place for use in a later step.**<br>

   <div align="left"><figure><img src="/files/JWPBOrSir3YCe1J40WbW" alt="Copy account ID option in the kebab menu." width="301"><figcaption></figcaption></figure></div>
4. In the left sidebar, select **Manage account > Members**.
5. Select **Invite Members**.
6. On the Invite Members screen, for the Email address, enter `<Your_Workbench_GUID>@yourorganization.com`.
   * For example, if your organization were Acme Corp, the format would be `a123b456-7c89-0def-g1hi-2j3k45l6mn7o@acmecorp.com`.

{% hint style="info" %}
To find your GUID, go to **Organization Settings > My Organization** and look for the Organization GUID.&#x20;

If you have multiple organizations, you must first select the organization name that will be associated with your integration to access the page with the Copy button. Or, you can stay on the page and highlight then copy the GUID shown for that organization in the GUID column.
{% endhint %}

7. In the Add permission policies section, select **Create a policy**.
8. Configure the policy as follows:
   * **Define scope** - select the account you are integrating with Workbench. ("Applies to: Entire account" will automatically be selected.)
   * **Assign roles** - select **Cloudflare Zero Trust Read Only**.
9. Select **Create policy**.<br>

   <div align="left"><figure><img src="/files/mjHxl5UbbH2a6e6ieZ6A" alt="Policy configuration has the Expel account selected as the scope, the roles assigned, and Zero Trust Read Only role toggled on." width="563"><figcaption></figcaption></figure></div>
10. Select **Invite members**. This triggers an email invitation allowing the Expel SOC to create an account and complete console access configuration in Workbench on your behalf.
11. Next, in the top right, select your profile icon and choose **Profile**.
12. Save the **Email** address in a safe place for use in a later step.
13. In the left sidebar, select **API Tokens**.
14. In the API Keys section, locate the **Global API Key** and select **View**.
15. A pop-up displays asking to send a verification code.&#x20;
16. Select **Send Verification** Code. The code will be sent to the email address associated with your Cloudflare profile.
17. Enter the code received in the email and select **View**.
18. The API key displays. **Copy and save it in a safe place for later use**.

## Step 2: Add Cloudflare ZTNA as a Security Device in Workbench

The next step is to add a Cloudflare ZTNA security device in Workbench so that you can generate and copy the necessary webhook credentials, which you will need later in the guide. **Before you begin, make sure you have the email address, account ID, and API key you saved in Step 1**.

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**. If you have multiple organizations, you must select the appropriate organization name from the list.
3. Select **Add Security Device**.
4. In the search box, type “Cloudflare” and then select the **Cloudflare ZTNA (via Webhook)** integration.<br>

   <div align="left"><figure><img src="/files/Vtx0fRYsYg1DgqtLBJN1" alt="Cloudflare ZTNA Add Security Device screen." width="375"><figcaption></figcaption></figure></div>
5. Complete the fields as follows:
   * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Cloudflare ZTNA”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   * **Location** - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   * **Webhook fields** - can be ignored for now.
   * **Cloudflare email** - enter the email you saved in [Step 1](#step-1-generate-cloudflare-credentials).
   * **Account ID of user** - enter the account ID you saved in [Step 1](#step-1-generate-cloudflare-credentials).
   * **API key for Cloudflare email** - enter the API key you saved in [Step 1](#step-1-generate-cloudflare-credentials).
6. Select **Save**.
7. On the console access screen, select **Set up later**.
8. Select **Save**.
9. Select **Done**.
10. Locate your new device in the list of security devices.
11. Use the menu beside the device name to [edit the device details](/connect-your-technology/security-devices/manage-security-devices.md#edit-a-security-device).
12. **Copy and save the Webhook URL, username, and password** in a safe place for use in the next step.

## Step 3: Configure Cloudflare Logpush

This step establishes the direct, automated connection between your Cloudflare account and the Workbench platform using the Cloudflare Logpush service. This ensures immediate, continuous data delivery for security and performance analysis.

You will forward the following log types from Logpush to Workbench:

* Access Request Logs&#x20;
* Gateway HTTP Logs &#x20;
* Gateway Network Logs&#x20;

### Generate Your Token

The webhook is authenticated using the webhook username and password provided in Workbench. These credentials must be Base64-encoded and appended to the Logpush URL. This combination (**username:password** pair) will form the `BASE64_TOKEN`. Follow the instructions for your respective operating system to Base64-encode your credentials via command line, substituting the Webhook username and password in the command:

{% tabs %}
{% tab title="Windows" %}
`[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("username:password"))`
{% endtab %}

{% tab title="Unix-Like Systems" %}
`echo -n "username:password" | base64`
{% endtab %}
{% endtabs %}

**Copy and save the token in a safe place for use in a later step.**

### Create Logpush Jobs in Cloudflare

1. From within your account in Cloudflare, use the left sidebar to select **Analytics & Logs > Logpush**.
2. Select **Create a Logpush job**.
3. On the Select Destination page, choose **HTTP destination**.
4. On the Enter destination details page, enter the **HTTP endpoint** using the following format, substituting the webhook URL from Workbench and the base64-encoded token you generated in the string:\
   \
   **`<WEBHOOK_URL>`**`?header_Content-Type=application%2Fjson&header_Authorization=Basic%20`**`<BASE64_TOKEN>`**<br>

   <div align="left"><figure><img src="/files/jr5lrrOFSDspFOjVYWrx" alt="Example shows the HTTP endpoint string with the substituted values entered into the HTTP endpoint field of Cloudflare." width="563"><figcaption></figcaption></figure></div>
5. Select **Continue**.
6. On the Select dataset page, select **Access requests**.
7. Select **Continue**.
8. On the Configure logpush job page, configure as follows:
   * **Name** - enter a unique name for the Logpush job. For example, ”logpush-job-access-requests”.&#x20;
   * **If logs match**… - select **All logs**.
   * **Send the following fields**… - choose **Select All**.<br>

     <div align="left"><figure><img src="/files/JF5EWc8jeeXqGWGkq1vV" alt="Logpush job configuration is set as instructed." width="375"><figcaption></figcaption></figure></div>
9. Select **Submit**.
10. Repeat steps 2-9 two more times, selecting **Gateway HTTP** and **Gateway Network** as datasets for the additional jobs. **You will create three Logpush jobs in total**.

With the three logpush jobs created, setup is now complete.

To check if alerts are coming through in Workbench, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).

To check on the status of the device in Workbench, navigate to **Organization Settings > Security Devices**. Select the downward arrow for your device in the first column and choose **View details**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/a-c-integrations/cloudflare/cloudflare-zero-trust-network-access-via-webhook-setup-for-workbench.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.