> For the complete documentation index, see [llms.txt](https://cybrhawksoc.gitbook.io/cybrhawk-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybrhawksoc.gitbook.io/cybrhawk-docs/siem-integrations/software-as-a-service/confluence-cloud.md).

# Confluence Cloud

#### Before you begin:

* Only users with **site admin** or **organization admin** privileges can access audit logs via the Confluence Cloud API.
* This email address is required ad a deliverable.

***

#### Step 1: Generate API Token

1. **Log in to Atlassian Account**
   * Go to <https://id.atlassian.com/manage-profile/security>
   * Sign in with your Atlassian account credentials.
   * Note down the \***Atlassian domain** (e.g., "id.atlassian.com") ![Image 1: Log in](/files/1PYRzD67PxLgW5z7vOjX)
2. **Create an API Token**
   * Locate the ***API Token*** section.
   * Click ***Create API*** token.
   * Enter a label (e.g., "Confluence Audit Logs").
   * Select the app ***Confluence***
   * Select confluence scope: ***read:audit-log:confluence***.
   * Click ***Create*** and then Copy the ***API token***.

     <figure><img src="/files/LgoIXzSYTDtNxuyWILL0" alt=""><figcaption></figcaption></figure>
3. **Get Cloud ID for Atlassian Cloud instance**
   1. **Via admin.atlassian.com**:
      * Go to admin.atlassian.com.
      * Select your organization and site.
      * The Cloud ID appears after `/s/` in the browser URL (e.g., `https://admin.atlassian.com/s/<your_cloud_id>/access-requests`)
   2. **Via API endpoint**:
      * Use the `tenant_info` endpoint:\
        `https://<your-site-name>.atlassian.net/_edge/tenant_info`\
        Replace `<your-site-name>` with your actual site name (e.g., `mycompany`).
      * This returns a JSON response:\
        `{"cloudId":"<your_cloud_id>"}`

***

#### Deliverables

Please email them to <socv2@cybrhawk.com>

1. **Application Credentials**:
   * Please make sure the following credentials are noted in the email.
     * Atlassian domain
     * Email address
     * API Token
     * Cloud ID