JA EN
shiichan

Cloudflare DLP now lets you choose how sensitive data shows up in payload logs!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shii-chan! Today I found a small but nice improvement for the security folks, so let me share it with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced that you can now choose how sensitive data shows up in your DLP (Data Loss Prevention) payload logs. You set it from the Cloudflare dashboard under Zero Trust > Data loss prevention > DLP settings, in the "Payload log masking" card.

The story so far

Until now there was only one masking mode, and it fully hid every matched value - and even hid the character count. That made it hard to tell "is this the real thing I wanted to catch, or a false positive?" During incident response, having so few clues could be a real pain.

What changes

Now your team can decide the balance between the context you need for an investigation and the security you want to keep. Lock it all down when you want, or reveal just a little to quickly tell whether something is a false positive - you choose.

Dive Deep

There are three masking options:

  • Full Mask (default): hides the match but keeps the character count and formatting, like ***-**-****.
  • Partial Mask: reveals 25% of the matched content, like ***-**-6789.
  • Clear Text: stores the violation exactly, unmasked, like 123-45-6789.

One important point: the masking level is applied at detection time - before the payload is encrypted. So you can't go back and "show more" later.

One more thing to watch: if you pick anything other than Full Mask, the masking applies to every sensitive data match within that payload window, not just the match that triggered the rule. So be careful when you reach for Clear Text.

For the finer details, check the DLP logging options docs, and if you use Data Loss Prevention, give it a look.

Wrap-up

  • You can now choose how sensitive data appears in DLP payload logs.
  • The options are Full Mask (default), Partial Mask (25% shown), and Clear Text.
  • Masking is applied at detection time, before encryption. Anything other than Full Mask affects every match in the payload.

This one is for incident response teams running DLP on Cloudflare Zero Trust who have been struggling to sort out false positives.

Related posts