Implementing Cloudflare Zero Trust: Complete Enterprise Security Guide#

1
organization:
2
  users: 500-5000
3
  locations:
4
    - headquarters
5
    - branch-offices
6
    - remote-workers
7

8
infrastructure:
9
  identity_provider:
10
    - Azure AD
11
    - Okta
12
    - Google Workspace
13
  applications:
14
    - web-based: 50+
15
    - client-server: 20+
16
    - saas: 30+
17

18
compliance:
19
  requirements:
20
    - SOC2
21
    - ISO27001
22
    - GDPR
23
    - HIPAA

1
<EntityDescriptor entityID="https://your-team.cloudflareaccess.com">
2
    <SPSSODescriptor AuthnRequestsSigned="false"
3
                     WantAssertionsSigned="true"
4
                     protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
5
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
6
                           Location="https://your-team.cloudflareaccess.com/cdn-cgi/access/slo"/>
7
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
8
                                Location="https://your-team.cloudflareaccess.com/cdn-cgi/access/callback"
9
                                index="1" isDefault="true"/>
10
    </SPSSODescriptor>
11
</EntityDescriptor>

1
const oktaConfig = {
2
  issuer: 'https://yourcompany.okta.com/oauth2/default',
3
  clientId: 'your-client-id',
4
  clientSecret: process.env.OKTA_CLIENT_SECRET,
5
  redirectUri: 'https://your-team.cloudflareaccess.com/cdn-cgi/access/callback',
6
  scope: ['openid', 'profile', 'email', 'groups'],
7
  responseType: 'code',
8
  grantType: 'authorization_code',
9

10
  // Custom claims mapping
11
  claimsMapping: {
12
    email: 'email',
13
    name: 'name',
14
    groups: 'groups',
15
    department: 'department',
16
    manager: 'manager'
17
  }
18
};

1
interface AccessPolicy {
2
  name: string;
3
  decision: 'allow' | 'deny' | 'bypass';
4
  includes: PolicyRule[];
5
  excludes?: PolicyRule[];
6
  requires?: PolicyRule[];
7
}
8

9
const internalAppPolicy: AccessPolicy = {
10
  name: "Internal Dashboard Access",
11
  decision: "allow",
12
  includes: [
13
    {
14
      type: "group",
15
      value: ["Engineering", "DevOps", "Security"]
16
    }
17
  ],
18
  requires: [
19
    {
20
      type: "device_posture",
21
      value: ["corporate_device", "compliant"]
22
    },
23
    {
24
      type: "geo",
25
      value: ["US", "UK", "IN"]
26
    }
27
  ],
28
  excludes: [
29
    {
30
      type: "ip",
31
      value: ["suspicious_ips_list"]
32
    }
33
  ]
34
};
35

36
// Apply policy via API
37
async function createAccessPolicy(policy: AccessPolicy) {
38
  const response = await fetch(
39
    `https://api.cloudflare.com/client/v4/accounts/${accountId}/access/apps/${appId}/policies`,
40
    {
41
      method: 'POST',
42
      headers: {
43
        'Authorization': `Bearer ${apiToken}`,
44
        'Content-Type': 'application/json'
45
      },
46
      body: JSON.stringify(policy)
47
    }
48
  );
49
  return response.json();
50
}

1
import requests
2
import jwt
3
from datetime import datetime, timedelta
4

5
class CloudflareServiceAuth:
6
    def __init__(self, client_id, client_secret, account_id):
7
        self.client_id = client_id
8
        self.client_secret = client_secret
9
        self.account_id = account_id
10
        self.base_url = f"https://api.cloudflare.com/client/v4/accounts/{account_id}"
11

12
    def generate_service_token(self, service_name, duration_hours=24):
13
        """Generate a service token for API access"""
14
        payload = {
15
            'service': service_name,
16
            'iat': datetime.utcnow(),
17
            'exp': datetime.utcnow() + timedelta(hours=duration_hours),
18
            'account_id': self.account_id
19
        }
20

21
        token = jwt.encode(
22
            payload,
23
            self.client_secret,
24
            algorithm='HS256'
25
        )
26

27
        return {
28
            'CF-Access-Client-Id': self.client_id,
29
            'CF-Access-Client-Secret': token
30
        }
31

32
    def validate_request(self, request_headers):
33
        """Validate incoming service requests"""
34
        client_id = request_headers.get('CF-Access-Client-Id')
35
        client_secret = request_headers.get('CF-Access-Client-Secret')
36

37
        if not client_id or not client_secret:
38
            return False
39

40
        try:
41
            payload = jwt.decode(
42
                client_secret,
43
                self.client_secret,
44
                algorithms=['HS256']
45
            )
46
            return payload['account_id'] == self.account_id
47
        except jwt.InvalidTokenError:
48
            return False

1
dns_policies:
2
  - name: "Block Malware Domains"
3
    priority: 1
4
    enabled: true
5
    action: block
6
    filters:
7
      - type: security_category
8
        value:
9
          - malware
10
          - phishing
11
          - cryptomining
12
          - botnet
13

14
  - name: "Block Social Media"
15
    priority: 2
16
    enabled: true
17
    schedule: "business_hours"
18
    action: block
19
    filters:
20
      - type: content_category
21
        value:
22
          - social_networking
23
          - instant_messaging
24
    exclusions:
25
      - groups: ["Marketing", "HR"]
26

27
  - name: "Allow Security Tools"
28
    priority: 3
29
    enabled: true
30
    action: allow
31
    filters:
32
      - type: domain
33
        value:
34
          - "*.virustotal.com"
35
          - "*.malwarebytes.com"
36
          - "*.crowdstrike.com"
37

38
  - name: "DGA Detection"
39
    priority: 4
40
    enabled: true
41
    action: isolate
42
    filters:
43
      - type: dga_detection
44
        threshold: high
45
    notifications:
46
      - email: security@company.com
47
      - webhook: https://siem.company.com/webhook

1
use serde::{Deserialize, Serialize};
2

3
#[derive(Debug, Serialize, Deserialize)]
4
struct HttpPolicy {
5
    name: String,
6
    enabled: bool,
7
    action: Action,
8
    filters: Vec<Filter>,
9
    data_loss_prevention: Option<DlpConfig>,
10
}
11

12
#[derive(Debug, Serialize, Deserialize)]
13
enum Action {
14
    Allow,
15
    Block,
16
    Isolate,
17
    Log,
18
    Challenge,
19
}
20

21
#[derive(Debug, Serialize, Deserialize)]
22
struct Filter {
23
    filter_type: FilterType,
24
    operator: Operator,
25
    value: String,
26
}
27

28
#[derive(Debug, Serialize, Deserialize)]
29
enum FilterType {
30
    Url,
31
    Domain,
32
    HttpMethod,
33
    HttpHeader,
34
    FileType,
35
    FileSize,
36
    ContentType,
37
}
38

39
impl HttpPolicy {
40
    fn create_file_upload_policy() -> Self {
41
        HttpPolicy {
42
            name: "Restrict File Uploads".to_string(),
43
            enabled: true,
44
            action: Action::Block,
45
            filters: vec![
46
                Filter {
47
                    filter_type: FilterType::HttpMethod,
48
                    operator: Operator::Equals,
49
                    value: "POST".to_string(),
50
                },
51
                Filter {
52
                    filter_type: FilterType::FileType,
53
                    operator: Operator::In,
54
                    value: "exe,dll,scr,bat,cmd,com".to_string(),
55
                },
56
            ],
57
            data_loss_prevention: Some(DlpConfig {
58
                enabled: true,
59
                profiles: vec!["credit_cards", "ssn", "api_keys"],
60
            }),
61
        }
62
    }
63

64
    fn create_shadow_it_detection() -> Self {
65
        HttpPolicy {
66
            name: "Detect Shadow IT".to_string(),
67
            enabled: true,
68
            action: Action::Log,
69
            filters: vec![
70
                Filter {
71
                    filter_type: FilterType::Domain,
72
                    operator: Operator::NotIn,
73
                    value: "approved_saas_list.txt".to_string(),
74
                },
75
                Filter {
76
                    filter_type: FilterType::ContentType,
77
                    operator: Operator::Contains,
78
                    value: "application".to_string(),
79
                },
80
            ],
81
            data_loss_prevention: None,
82
        }
83
    }
84
}

1
[CmdletBinding()]
2
param(
3
    [Parameter(Mandatory=$true)]
4
    [string]$OrganizationId,
5

6
    [Parameter(Mandatory=$true)]
7
    [string]$AuthToken,
8

9
    [Parameter(Mandatory=$false)]
10
    [string]$GpoName = "Cloudflare WARP Deployment"
11
)
12

13
function Deploy-WARPClient {
14
    # Create GPO for WARP deployment
15
    $gpo = New-GPO -Name $GpoName -Comment "Deploys Cloudflare WARP client"
16

17
    # Configure WARP MSI deployment
18
    $warpMsi = "\\domain\sysvol\domain\software\Cloudflare_WARP.msi"
19

20
    # Create MST transform file with configuration
21
    $mstContent = @"
22
ORGANIZATION_ID=$OrganizationId
23
AUTH_TOKEN=$AuthToken
24
ENABLE_AUTOUPDATE=1
25
GATEWAY_UNIQUE_ID=auto
26
SERVICE_MODE=warp
27
SUPPORT_URL=https://helpdesk.company.com
28
"@
29

30
    $mstPath = "\\domain\sysvol\domain\software\WARP_Config.mst"
31
    $mstContent | Out-File -FilePath $mstPath
32

33
    # Add software installation policy
34
    Set-GPRegistryValue -Name $GpoName -Key "HKLM\Software\Policies\Cloudflare\WARP" `
35
        -ValueName "OrganizationID" -Type String -Value $OrganizationId
36

37
    # Configure automatic connection
38
    Set-GPRegistryValue -Name $GpoName -Key "HKLM\Software\Policies\Cloudflare\WARP" `
39
        -ValueName "AutoConnect" -Type DWord -Value 1
40

41
    # Set switch lock to prevent users from disabling
42
    Set-GPRegistryValue -Name $GpoName -Key "HKLM\Software\Policies\Cloudflare\WARP" `
43
        -ValueName "SwitchLocked" -Type DWord -Value 1
44

45
    # Link GPO to domain
46
    New-GPLink -Name $GpoName -Target "OU=Computers,DC=company,DC=com" -LinkEnabled Yes
47

48
    Write-Host "WARP deployment GPO created and linked successfully"
49
}
50

51
# Execute deployment
52
Deploy-WARPClient

1
#!/bin/bash
2
set -euo pipefail
3

4
# Configuration
5
ORG_ID="${CLOUDFLARE_ORG_ID}"
6
AUTH_TOKEN="${CLOUDFLARE_AUTH_TOKEN}"
7
WARP_VERSION="2024.1.0"
8

9
# Color codes for output
10
RED='\033[0;31m'
11
GREEN='\033[0;32m'
12
YELLOW='\033[1;33m'
13
NC='\033[0m' # No Color
14

15
log_info() {
16
    echo -e "${GREEN}[INFO]${NC} $1"
17
}
18

19
log_error() {
20
    echo -e "${RED}[ERROR]${NC} $1"
21
}
22

23
log_warning() {
24
    echo -e "${YELLOW}[WARNING]${NC} $1"
25
}
26

27
# Detect Linux distribution
28
detect_distro() {
29
    if [ -f /etc/os-release ]; then
30
        . /etc/os-release
31
        OS=$ID
32
        VER=$VERSION_ID
33
    else
34
        log_error "Cannot detect Linux distribution"
35
        exit 1
36
    fi
37
}
38

39
# Install WARP client
40
install_warp() {
41
    detect_distro
42

43
    case $OS in
44
        ubuntu|debian)
45
            log_info "Installing WARP on Debian/Ubuntu"
46
            curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
47
            echo "deb [arch=amd64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list
48
            sudo apt-get update
49
            sudo apt-get install -y cloudflare-warp
50
            ;;
51

52
        rhel|centos|fedora|rocky|alma)
53
            log_info "Installing WARP on RHEL/CentOS/Fedora"
54
            sudo rpm -ivh https://pkg.cloudflareclient.com/cloudflare-release-el$(rpm -E %{rhel}).rpm
55
            sudo yum install -y cloudflare-warp
56
            ;;
57

58
        arch|manjaro)
59
            log_info "Installing WARP on Arch Linux"
60
            yay -S cloudflare-warp-bin --noconfirm
61
            ;;
62

63
        *)
64
            log_error "Unsupported distribution: $OS"
65
            exit 1
66
            ;;
67
    esac
68
}
69

70
# Configure WARP
71
configure_warp() {
72
    log_info "Configuring WARP client"
73

74
    # Register with organization
75
    warp-cli register --accept-tos
76
    warp-cli set-teams-auth-token "${AUTH_TOKEN}"
77

78
    # Configure settings
79
    warp-cli set-mode warp
80
    warp-cli set-families-mode full
81
    warp-cli set-custom-endpoint "${ORG_ID}.cloudflareclient.com:2408"
82

83
    # Enable always-on
84
    warp-cli set-always-on true
85

86
    # Start and enable service
87
    sudo systemctl enable --now warp-svc
88

89
    # Connect
90
    warp-cli connect
91

92
    # Verify connection
93
    sleep 5
94
    if warp-cli status | grep -q "Connected"; then
95
        log_info "WARP successfully connected"
96
    else
97
        log_error "WARP connection failed"
98
        exit 1
99
    fi
100
}
101

102
# Create systemd service for auto-reconnect
103
create_auto_reconnect_service() {
104
    log_info "Creating auto-reconnect service"
105

106
    cat << 'EOF' | sudo tee /etc/systemd/system/warp-reconnect.service
107
[Unit]
108
Description=Cloudflare WARP Auto-Reconnect
109
After=network-online.target
110
Wants=network-online.target
111

112
[Service]
113
Type=simple
114
ExecStart=/usr/local/bin/warp-reconnect.sh
115
Restart=always
116
RestartSec=30
117

118
[Install]
119
WantedBy=multi-user.target
120
EOF
121

122
    cat << 'EOF' | sudo tee /usr/local/bin/warp-reconnect.sh
123
#!/bin/bash
124
while true; do
125
    if ! warp-cli status | grep -q "Connected"; then
126
        warp-cli connect
127
    fi
128
    sleep 60
129
done
130
EOF
131

132
    sudo chmod +x /usr/local/bin/warp-reconnect.sh
133
    sudo systemctl daemon-reload
134
    sudo systemctl enable --now warp-reconnect.service
135
}
136

137
# Main execution
138
main() {
139
    log_info "Starting Cloudflare WARP deployment"
140

141
    # Check if running as root
142
    if [[ $EUID -eq 0 ]]; then
143
        log_error "This script should not be run as root"
144
        exit 1
145
    fi
146

147
    # Install WARP
148
    install_warp
149

150
    # Configure WARP
151
    configure_warp
152

153
    # Setup auto-reconnect
154
    create_auto_reconnect_service
155

156
    log_info "WARP deployment completed successfully"
157
}
158

159
main "$@"

1
interface DevicePostureRule {
2
  name: string;
3
  type: PostureType;
4
  schedule?: string;
5
  platforms: Platform[];
6
  checks: PostureCheck[];
7
  remediation?: RemediationAction;
8
}
9

10
enum PostureType {
11
  FILE = 'file',
12
  PROCESS = 'process',
13
  REGISTRY = 'registry',
14
  CERTIFICATE = 'certificate',
15
  OS_VERSION = 'os_version',
16
  DISK_ENCRYPTION = 'disk_encryption',
17
  FIREWALL = 'firewall',
18
  ANTIVIRUS = 'antivirus',
19
  PATCH_LEVEL = 'patch_level'
20
}
21

22
const enterprisePostureRules: DevicePostureRule[] = [
23
  {
24
    name: "Endpoint Protection",
25
    type: PostureType.PROCESS,
26
    platforms: [Platform.WINDOWS, Platform.MAC],
27
    checks: [
28
      {
29
        windows: {
30
          process: "CrowdStrike Windows Sensor",
31
          running: true
32
        },
33
        mac: {
34
          process: "com.crowdstrike.falcon",
35
          running: true
36
        }
37
      }
38
    ],
39
    remediation: {
40
      message: "CrowdStrike Falcon must be installed and running",
41
      url: "https://helpdesk.company.com/install-crowdstrike"
42
    }
43
  },
44
  {
45
    name: "Disk Encryption",
46
    type: PostureType.DISK_ENCRYPTION,
47
    platforms: [Platform.ALL],
48
    checks: [
49
      {
50
        windows: {
51
          bitlocker: true,
52
          min_version: "2.0"
53
        },
54
        mac: {
55
          filevault: true
56
        },
57
        linux: {
58
          luks: true
59
        }
60
      }
61
    ]
62
  },
63
  {
64
    name: "OS Security Patches",
65
    type: PostureType.PATCH_LEVEL,
66
    platforms: [Platform.ALL],
67
    checks: [
68
      {
69
        max_days_since_last_update: 30,
70
        critical_updates_required: true
71
      }
72
    ]
73
  },
74
  {
75
    name: "Corporate Certificate",
76
    type: PostureType.CERTIFICATE,
77
    platforms: [Platform.ALL],
78
    checks: [
79
      {
80
        certificate_authority: "CN=Company Root CA, O=Company Inc",
81
        valid: true,
82
        not_expired: true
83
      }
84
    ]
85
  }
86
];

1
tunnel: your-tunnel-id
2
credentials-file: /etc/cloudflared/credentials.json
3

4
ingress:
5
  # Internal dashboard with device posture check
6
  - hostname: dashboard.company.com
7
    service: http://internal-dashboard:8080
8
    originRequest:
9
      noTLSVerify: false
10
      caPool: /etc/ssl/certs/company-ca.crt
11
      clientCert:
12
        cert: /etc/cloudflared/client.crt
13
        key: /etc/cloudflared/client.key
14
      connectTimeout: 30s
15
      tcpKeepAlive: 30s
16

17
  # API with mTLS
18
  - hostname: api.company.com
19
    service: https://api-gateway:443
20
    originRequest:
21
      http2Origin: true
22
      originServerName: api.internal.company.com
23

24
  # WebSocket application
25
  - hostname: realtime.company.com
26
    service: ws://websocket-server:8080
27
    originRequest:
28
      noTLSVerify: true
29

30
  # SSH bastion via browser
31
  - hostname: ssh.company.com
32
    service: ssh://bastion.internal:22
33

34
  # Catch-all rule
35
  - service: http_status:404

1
#!/bin/bash
2
# Deploy primary tunnel
3
docker run -d \
4
  --name cloudflared-primary \
5
  --restart unless-stopped \
6
  -v /etc/cloudflared:/etc/cloudflared \
7
  cloudflare/cloudflared:latest \
8
  tunnel --config /etc/cloudflared/config-primary.yaml run
9

10
# Deploy secondary tunnel
11
docker run -d \
12
  --name cloudflared-secondary \
13
  --restart unless-stopped \
14
  -v /etc/cloudflared:/etc/cloudflared \
15
  cloudflare/cloudflared:latest \
16
  tunnel --config /etc/cloudflared/config-secondary.yaml run
17

18
# Health check monitoring
19
cat << 'EOF' > /usr/local/bin/tunnel-health-check.sh
20
#!/bin/bash
21
PRIMARY_STATUS=$(docker inspect cloudflared-primary --format='{{.State.Status}}')
22
SECONDARY_STATUS=$(docker inspect cloudflared-secondary --format='{{.State.Status}}')
23

24
if [[ "$PRIMARY_STATUS" != "running" ]]; then
25
    echo "Primary tunnel down, attempting restart"
26
    docker restart cloudflared-primary
27
    # Send alert
28
    curl -X POST https://alerts.company.com/webhook \
29
      -H "Content-Type: application/json" \
30
      -d '{"alert": "Cloudflare primary tunnel restarted"}'
31
fi
32

33
if [[ "$SECONDARY_STATUS" != "running" ]]; then
34
    echo "Secondary tunnel down, attempting restart"
35
    docker restart cloudflared-secondary
36
    # Send alert
37
    curl -X POST https://alerts.company.com/webhook \
38
      -H "Content-Type: application/json" \
39
      -d '{"alert": "Cloudflare secondary tunnel restarted"}'
40
fi
41
EOF
42

43
chmod +x /usr/local/bin/tunnel-health-check.sh
44

45
# Add to crontab
46
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/local/bin/tunnel-health-check.sh") | crontab -

1
const isolationPolicies = [
2
  {
3
    name: "Isolate Uncategorized Sites",
4
    enabled: true,
5
    action: "isolate",
6
    filters: {
7
      content_categories: ["uncategorized", "newly_registered_domains"],
8
      risk_score: {
9
        min: 70
10
      }
11
    },
12
    isolation_settings: {
13
      disable_copy_paste: false,
14
      disable_printing: true,
15
      disable_keyboard: false,
16
      disable_upload: true,
17
      disable_download: false
18
    }
19
  },
20
  {
21
    name: "Isolate External File Sharing",
22
    enabled: true,
23
    action: "isolate",
24
    filters: {
25
      domains: [
26
        "*.wetransfer.com",
27
        "*.dropbox.com",
28
        "*.box.com",
29
        "*.mega.nz"
30
      ]
31
    },
32
    isolation_settings: {
33
      disable_copy_paste: true,
34
      disable_upload: false,
35
      disable_download: false,
36
      log_keystrokes: true
37
    }
38
  },
39
  {
40
    name: "Isolate Personal Email",
41
    enabled: true,
42
    action: "isolate",
43
    filters: {
44
      domains: [
45
        "*.gmail.com",
46
        "*.yahoo.com",
47
        "*.outlook.com",
48
        "*.protonmail.com"
49
      ]
50
    },
51
    exclusions: {
52
      groups: ["HR", "Legal"]
53
    }
54
  }
55
];

1
from dataclasses import dataclass
2
from typing import List, Dict, Optional
3
from enum import Enum
4

5
class DLPAction(Enum):
6
    ALLOW = "allow"
7
    BLOCK = "block"
8
    LOG = "log"
9
    REDACT = "redact"
10
    ENCRYPT = "encrypt"
11

12
@dataclass
13
class DLPProfile:
14
    name: str
15
    enabled: bool
16
    patterns: List[Dict]
17
    action: DLPAction
18
    severity: str
19
    notification: Optional[Dict]
20

21
class DLPEngine:
22
    def __init__(self):
23
        self.profiles = []
24

25
    def create_credit_card_profile(self):
26
        return DLPProfile(
27
            name="Credit Card Protection",
28
            enabled=True,
29
            patterns=[
30
                {
31
                    "type": "regex",
32
                    "pattern": r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\b",
33
                    "validation": "luhn_check"
34
                }
35
            ],
36
            action=DLPAction.BLOCK,
37
            severity="critical",
38
            notification={
39
                "email": ["security@company.com", "compliance@company.com"],
40
                "siem": "https://siem.company.com/api/dlp-alert"
41
            }
42
        )
43

44
    def create_pii_profile(self):
45
        return DLPProfile(
46
            name="PII Protection",
47
            enabled=True,
48
            patterns=[
49
                {
50
                    "type": "regex",
51
                    "pattern": r"\b\d{3}-\d{2}-\d{4}\b",  # SSN
52
                    "context": ["ssn", "social security", "tax id"]
53
                },
54
                {
55
                    "type": "regex",
56
                    "pattern": r"\b[A-Z]{1,2}[0-9]{6}[A-Z]?\b",  # UK National Insurance
57
                    "context": ["ni number", "national insurance"]
58
                },
59
                {
60
                    "type": "keyword_proximity",
61
                    "keywords": ["passport", "license", "dl", "driver"],
62
                    "pattern": r"\b[A-Z0-9]{6,9}\b",
63
                    "distance": 10
64
                }
65
            ],
66
            action=DLPAction.REDACT,
67
            severity="high",
68
            notification={
69
                "email": ["privacy@company.com"],
70
                "webhook": "https://privacy.company.com/webhook"
71
            }
72
        )
73

74
    def create_source_code_profile(self):
75
        return DLPProfile(
76
            name="Source Code Protection",
77
            enabled=True,
78
            patterns=[
79
                {
80
                    "type": "file_fingerprint",
81
                    "extensions": [".py", ".js", ".ts", ".java", ".go", ".rs"],
82
                    "min_lines": 50
83
                },
84
                {
85
                    "type": "entropy",
86
                    "threshold": 4.5,
87
                    "min_length": 20,
88
                    "context": ["api", "key", "token", "secret", "password"]
89
                },
90
                {
91
                    "type": "regex",
92
                    "pattern": r"(?i)(api[_-]?key|api[_-]?secret|access[_-]?token|private[_-]?key|client[_-]?secret)[\s]*[:=][\s]*['\"]?([a-zA-Z0-9_\-]+)['\"]?",
93
                    "capture_group": 2
94
                }
95
            ],
96
            action=DLPAction.BLOCK,
97
            severity="critical",
98
            notification={
99
                "email": ["security@company.com", "engineering@company.com"],
100
                "slack": "#security-alerts"
101
            }
102
        )

1
import { CloudflareAPI } from '@cloudflare/client';
2

3
class SecurityAnalytics {
4
  private api: CloudflareAPI;
5
  private metrics: Map<string, any>;
6

7
  constructor(apiToken: string, accountId: string) {
8
    this.api = new CloudflareAPI({ token: apiToken, accountId });
9
    this.metrics = new Map();
10
  }
11

12
  async collectSecurityMetrics(): Promise<SecurityMetrics> {
13
    const [
14
      accessLogs,
15
      gatewayLogs,
16
      dlpEvents,
17
      devicePosture,
18
      threatIntel
19
    ] = await Promise.all([
20
      this.getAccessLogs(),
21
      this.getGatewayLogs(),
22
      this.getDLPEvents(),
23
      this.getDevicePostureStatus(),
24
      this.getThreatIntelligence()
25
    ]);
26

27
    return {
28
      timestamp: new Date(),
29
      access: {
30
        total_requests: accessLogs.total,
31
        blocked_requests: accessLogs.blocked,
32
        unique_users: accessLogs.unique_users,
33
        failed_auth: accessLogs.failed_auth,
34
        top_applications: accessLogs.top_apps
35
      },
36
      gateway: {
37
        total_requests: gatewayLogs.total,
38
        blocked_domains: gatewayLogs.blocked,
39
        malware_detected: gatewayLogs.malware,
40
        categories_blocked: gatewayLogs.categories,
41
        isolated_sessions: gatewayLogs.isolated
42
      },
43
      dlp: {
44
        incidents: dlpEvents.total,
45
        critical: dlpEvents.critical,
46
        files_blocked: dlpEvents.files_blocked,
47
        data_exfiltration_attempts: dlpEvents.exfil_attempts
48
      },
49
      devices: {
50
        total: devicePosture.total,
51
        compliant: devicePosture.compliant,
52
        non_compliant: devicePosture.non_compliant,
53
        pending_remediation: devicePosture.pending
54
      },
55
      threats: {
56
        high_risk_users: threatIntel.users,
57
        suspicious_activities: threatIntel.activities,
58
        zero_day_blocks: threatIntel.zero_days
59
      }
60
    };
61
  }
62

63
  async generateExecutiveReport(): Promise<ExecutiveReport> {
64
    const metrics = await this.collectSecurityMetrics();
65

66
    return {
67
      executive_summary: {
68
        risk_score: this.calculateRiskScore(metrics),
69
        compliance_status: this.assessCompliance(metrics),
70
        roi_metrics: this.calculateROI(metrics),
71
        recommendations: this.generateRecommendations(metrics)
72
      },
73
      detailed_findings: {
74
        top_threats: this.identifyTopThreats(metrics),
75
        user_behavior: this.analyzeUserBehavior(metrics),
76
        security_posture: this.assessSecurityPosture(metrics)
77
      }
78
    };
79
  }
80
}