JA EN
shiichan

Account Abuse Protection gets a dedicated dashboard for login and sign-up activity

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#web

Hi, it's Shiichan! Here's news that makes investigating account takeover and fake sign-ups easier.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, Account Abuse Protection customers in Early Access can now investigate login and sign-up activity in a dedicated dashboard.

You'll find it under Security > Account Abuse Protection.

Why it matters

With login and sign-up abuse, you need to see both the overall trend and what individual accounts are doing to find the cause.

The nice part here is that you can see both in one place and go straight to mitigation.

What changes

The dashboard offers two views:

  • Population overview: see total login and sign-up events, unique accounts, IPs and devices, top countries and ASNs, and leaked credential check results. You can filter accounts by signals such as leaked credential events and unique IPs to find the ones that need review
  • Individual Account overview: review a single Hashed User ID's activity, including top networks, locations and devices, plus an event log with the Ray ID for each event. You can mitigate the account with a Security Rule on its Hashed User ID

Dive Deep

Two new roles control access:

  • Account Abuse Protection role: grants access to the dashboard
  • Account Abuse Protection PII role: grants dashboard access plus account-level PII such as email addresses, and is required to create or edit Logpush jobs that include PII

The dashboard includes all login and sign-up events from the date the feature was enabled. See the Account Abuse Protection docs for details.

Wrap-up

  • A dedicated Account Abuse Protection dashboard now lives under Security (Early Access)
  • You can investigate at the population and per-account level, and mitigate with a Security Rule on the Hashed User ID
  • Two new roles control access, including one for PII
  • Data starts from the date the feature was enabled

This is for security and SRE folks who handle login abuse!

Related posts