​
Overview

The Cloudflare integration uses the Cloudflare API to ingest:
  • Audit logs: account and zone-level changes (DNS, page rules, certificates, members)
  • Firewall events: WAF, rate limiting, bot management, and custom rule actions
  • Workers and Access activity (where enabled)
For high-volume HTTP and Spectrum data, configure Logpush to push to S3/GCS/Azure and connect Atatus to that bucket instead.

​
Prerequisites

  • A Cloudflare account.
  • Account or zone admin permission to create API tokens.
  • The Account ID (and Zone ID if scoping to a single zone), visible on the right pane of the Cloudflare dashboard.

​
Step 1: Create an API token in Cloudflare

  1. Sign in to the Cloudflare dashboard.
  2. Go to My Profile → API Tokens → Create Token.
  3. Click Get started under Create Custom Token and grant:
    • Account → Audit Logs → Read
    • Zone → Firewall Services → Read (per zone)
    • Zone → Analytics → Read (per zone)
  4. Restrict the token to the specific account/zones you want Atatus to read.
  5. Click Continue to summary, then Create Token, and copy the token value immediately.

​
Step 2: Connect Cloudflare in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Cloudflare card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The Cloudflare card shows Configured.
  • Audit and firewall events appear in Security → Cloud SIEM → Audit Logs → Events with source cloudflare.