Demo library › Chapter 10
10 Show the auditor what happened.
Every decision from the earlier chapters, in the logs that recorded it - including the exact matched value and the full prompt, decrypted with a key Cloudflare does not hold.
The problem
Afterwards, someone asks what happened: who reached what, what was stopped, and what exactly was in it. A security team will not take a demo's word for it. It wants the record - and it wants to know Cloudflare cannot read the sensitive parts of that record either.
Lands with: security operations, audit and compliance - the people who sign off
Before you start
- Run at least one earlier chapter first, so there is something to find - chapter 8 or 9 is best.
- The DLP private key from the DLP key page.
Run it
Who got in, and who did not
| Do | Say |
|---|---|
Zero Trust → Insights → Logs → Access authentication, filtered to
| Every sign-in and every refusal, with the application and the policy that decided it - including Ledger refusing her in chapter 1, and pgAdmin refusing her in chapter 3. |
What was stopped, and what was in it
| Do | Say |
|---|---|
| Logs → Gateway → HTTP, filtered to blocked requests. | Each block names the policy and the DLP profile that matched. |
| Expand a block and choose Decrypt payload log, pasting the private key. | The exact value that matched, redacted to the masking level, with a little context either side. It was encrypted with a public key this account holds; only the private half reads it, and Cloudflare never had that half. |
| Decrypt the blocked ChatGPT prompt from chapter 8 the same way. | Not just which profile matched - the prompt Alice typed, and what the model would have answered. |
Paste a request_id from a blocked agent tool call in chapter 9 into the log search. | From what the agent saw on screen, to the authoritative record, on one identifier. |
What the audience should see
- Alice's refusals in the Access log, each with its policy.
- A decrypted payload showing the matched value, and a decrypted prompt.
Where the evidence is
This chapter is the evidence.
Known limitations
- Partial. User risk scoring is not configured yet, so the step where Alice's risk score rises after the blocks in chapters 6 and 8 is missing.
- Logpush to a SIEM is the production path for these logs and is not provisioned in the lab.
Part of: The whole of Cloudflare One · AI security · The full tour