test customer

1. Create Logpush jobs for Access, Gateway DNS, Gateway HTTP, Audit, WARP, and DNS Firewall (as applicable) to the target SIEM.
2. Trigger representative events: successful login, denied login, blocked URL, policy change.
3. Confirm events arrive in the SIEM within the documented delivery window and parse against the published schema.
4. Confirm admin-change events appear in the Audit stream.
5. Validate retention matches customer policy (Logpush supplies the events; retention is configured in the SIEM side).

Pass threshold: All enabled event types arrive in the SIEM with expected fields parsed; admin-change events are present; delivery meets Cloudflare's documented timing.

1. In Notifications, create policies for at least three critical event types: tunnel health, WARP client health / posture, Access policy changes, certificate expiry.
2. Route each policy to the chosen channel (email / webhook / PagerDuty).
3. Trigger each event (stop a tunnel replica for tunnel-health, change a policy to test admin-change).
4. Confirm each notification arrives on the expected channel within the vendor's documented timing.
5. Adjust filters to reduce noise; confirm only intended events still alert.

Pass threshold: Each configured alert fires on the correct event, reaches the target channel within documented SLA, and can be tuned without losing signal.