Audit Logs v2 Now Records View Actions, Not Just Changes!
Hi, it's Shii-chan! Today I have news for everyone who loves security: you can now see who looked at what!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
In the Cloudflare Changelog, Cloudflare announced that Audit Logs v2 now records view actions.
This covers read activity on supported endpoints. These actions correspond to GET requests, so you get visibility into read activity across Cloudflare products.
The story so far
When we think of audit logs, we usually think of writes: creating, changing, or deleting settings.
But in security investigations, you sometimes need to know who was viewing a setting, or where a suspicious account was reading around. Without read records, that was a blind spot.
What changes
With view actions, you get extra clues for security investigations and forensic analysis.
- In an incident, you can trace what a compromised account viewed
- You can keep a more complete history of activity, including reads
Dive Deep
The dashboard and the API/Logpush behave differently, so keep this in mind:
- Dashboard: view actions are excluded by default to reduce noise. Remove the default "Action type is not view" filter to include them, or set Action type to view to show only view actions
- API and Logpush: view actions are always available, regardless of the dashboard filter
One caution: GET requests can generate a high volume of audit logs. When you use the API or Logpush, apply appropriate filters to limit the volume of delivered logs, as the Changelog advises.
Wrap-up
- Audit Logs v2 now records view actions, which correspond to GET requests
- In the dashboard they're hidden by default, and you can show them by removing the filter
- In the API and Logpush, view actions are always available
- Volume can get large, so filter when using the API or Logpush
This one is great for security and operations teams who handle incident response and audits!
