Cloudflare Security Audit

Workflow skill for auditing the security posture of Cloudflare zones. Reviews active threats, WAF configuration, security events, IP access rules, and DDoS analytics. Produces a structured audit report with findings and recommendations.

Workflow: Run Security Audit

Phase 1 — Gather Security Data in Parallel

For each zone, fire all of these tool calls simultaneously:

• cloudflare_under_attack_status — current security level and Under Attack Mode state
• cloudflare_security_events — security events from the last 24 hours
• cloudflare_ddos_analytics — DDoS analytics from the last 24 hours
• cloudflare_waf_list_rulesets — configured WAF rulesets (managed + custom)
• cloudflare_waf_list_custom_rules — all custom WAF rules (expressions, actions)
• cloudflare_ip_access_list — IP access rules (blocked IPs, challenged ranges, allowed ranges)

Phase 2 — Analyze Security Data

Process the collected data and produce an analysis per zone:

Active Attack Status:

• Is Under Attack Mode currently enabled? Note start time if known.
• Current security level (off, essentially_off, low, medium, high, under_attack).
• Any active DDoS mitigations in effect.

Security Events Summary (Last 24h):

• Total event count by action type: blocked, challenged, jschallenge, managed_challenge, log.
• Top 10 source IPs by event count.
• Top 5 source countries by event count.
• Top 5 source ASNs by event count.
• Top attack vectors (URI paths, user agents, rule IDs triggered).

DDoS Analytics Summary (Last 24h):

• Peak request rate during any attack windows.
• Attack types detected (volumetric L3/L4, L7 HTTP flood, application-layer).
• Duration and mitigation effectiveness.

WAF Configuration Audit:

• Number of managed rulesets enabled and their sensitivity levels.
• Number of custom rules and their actions (block, challenge, log, bypass).
• Any rules in "log only" mode that should be set to block.
• WAF coverage gaps: zones with no managed ruleset configured.

IP Access Rules Audit:

• Total IP access rules count.
• Rules older than 30 days — flag as potentially stale.
• Temporary blocks that may be overdue for review.
• Overly broad rules (e.g., /8 CIDR blocks or full country blocks).

Phase 3 — Format Audit Report

Produce a structured report:

Security Audit Report — [Zone Name] — [Timestamp]

Overall Severity: 🟢/🟡/🔴

Attack Status:

• Security level: [current level]
• Under Attack Mode: ON/OFF
• Active DDoS mitigations: [count]

Security Events (Last 24h):

• Total events: [count]
• Blocked: [count] | Challenged: [count] | Logged: [count]
• Top source IP: [IP] ([count] events)
• Top source country: [country] ([count] events)

DDoS Analytics (Last 24h):

• Attack windows: [count]
• Peak rate: [req/s]
• Attack types: [types]

WAF Coverage:

• Managed rulesets: [count] enabled
• Custom rules: [count] ([count] blocking, [count] challenging, [count] logging)
• ⚠️ Rules in log-only mode: [count] — consider switching to block

IP Access Rules:

• Total rules: [count]
• Rules >30 days old: [count] — review for staleness
• Broad CIDR blocks: [count] — review scope

Findings:

1. [Finding 1]
2. [Finding 2]

...

Recommendations:

1. [Recommendation 1]
2. [Recommendation 2]

...

Phase 4 — Severity Assessment

🟢 HEALTHY — All of the following are true:

• No active attacks or Under Attack Mode is OFF with no recent events
• WAF has at least one managed ruleset configured per zone
• Zero security events in the last 24 hours, OR events are low-volume and all blocked
• No IP access rules older than 30 days flagged as stale
• Security level is "medium" or higher

🟡 WARNING — Any of the following:

• Recent DDoS activity in the last 24 hours (mitigated)
• Under Attack Mode was triggered recently (now off)
• WAF rules in "log only" mode with significant event volume (should be blocking)
• IP access rules older than 30 days that may be stale
• Security level is "low" or "essentially_off"
• Unusually high security event volume (>1000 events/24h for a typical zone)

🔴 CRITICAL — Any of the following:

• Active attack in progress (Under Attack Mode active with ongoing events)
• WAF completely disabled (no rulesets configured, security level "off")
• Sustained high-volume security events with no blocking in effect
• IP access rules containing contradictory or broken entries

Rules

• This skill is read-only — it audits but does not modify any configuration.
• If an active attack is detected (CRITICAL), immediately recommend activating the cloudflare-incident-response skill.
• Flag "log only" WAF rules clearly — they observe but do not block threats.
• Always include timestamps on all event data to make findings actionable.
• Stale IP access rules (>30 days) should be reviewed, not automatically deleted.
• Scheduled security audit agents must not make changes — report and route via Slack severity routing.

Key Tools

• cloudflare_under_attack_status — current security level and Under Attack Mode
• cloudflare_security_events — security event log (last 24h)
• cloudflare_ddos_analytics — DDoS analytics data (last 24h)
• cloudflare_waf_list_rulesets — list all WAF rulesets per zone
• cloudflare_waf_list_custom_rules — list custom WAF rules with expressions
• cloudflare_ip_access_list — list IP access rules (blocks, challenges, allows)