Demo library › Chapter 15
Show the auditor what happened
Every decision from the other chapters in the logs, the matched data and prompts decrypted with the company's own key, and a user risk score.
The problem
Afterwards, someone asks what happened: who reached what, what was stopped, and what was in it. They want the record.
Lands with: security operations, audit and compliance
Before you start
- Run at least one other chapter first, so there is something to find.
- The DLP key from the keys page.
Run it
Who got in, and who did not
| Do | Say |
|---|---|
Insights → Logs → Access authentication, filtered to | Every sign-in and refusal, with the application and the policy that decided it. |
What was stopped, and what was in it
| Do | Say |
|---|---|
| Logs → Gateway → HTTP, filtered to blocked requests. | Each block names the policy and the DLP profile that matched. |
| Expand a block → Decrypt payload log, and paste the key. | The value that matched, masked, with a little context. Only the company's key can read it. |
| Decrypt a blocked ChatGPT prompt the same way. | The prompt Alice typed, and what the model would have answered. |
Paste a request_id from a blocked agent tool call into the log search. | From what the agent showed on screen to the record, on one identifier. |
Whybackground, if you are asked
A security team will not take a demo's word for it, and will want to know Cloudflare cannot read the sensitive parts of the record either. The payload is encrypted with a public key the account holds; only the private half reads it, and Cloudflare never had that half.
Who is now a risk
| Do | Say |
|---|---|
Team & Resources → Users → Risk score → | Each block counted against her, and her score rose on its own. Policies can act on that score. |
Whybackground, if you are asked
Nobody wrote a rule about Alice. Her score rose from her own blocks, and a policy can act on it - step up authentication, or isolate her browsing.
What the audience should see
- Alice's refusals in the Access log.
- A decrypted payload and a decrypted prompt.
- Alice's risk score.
Where the evidence is
This chapter is the evidence.
Known limitations
- Risk scores update on Cloudflare's schedule, so run other chapters a while before this one.
- Sending logs to a SIEM (Logpush) is not set up in the lab.
Part of: The whole of Cloudflare One · Safe AI Adoption walkthrough · The full tour