Cloudflare

The Cloudflare integration connects one instance per account. Zones, Tunnels, load balancers, and Workers are discovered into the estate; Cloudflare’s own notification alerts arrive as signals; DNS, firewall, and analytics data is available as evidence on demand; and a tightly-scoped write catalogue covers the edge controls an incident actually needs — DNS record updates, access rules, security level, cache, and pool toggling.

Capabilities

Discovery. Zones, Cloudflare Tunnels, load balancers (with their pools), and Workers/Pages projects are enumerated into the estate with account-scoped identity. DNS records are deliberately evidence-only — they are queried when needed, never synced as state.

Alerts. ISE polls the account’s notification alert history and forwards alerts as signals exactly as Cloudflare raised them. Note the presence model: an alert older than the polled window is considered cleared — and if no notification policies are configured in Cloudflare, there is nothing to ingest.

Evidence. On demand during an investigation: list_dns_records, security_events (firewall events), zone_analytics, audit_log, and tunnel_connections.

Actions. The governed catalogue, each through the tiered approval pipeline:

Action	Tier	Notes
purge_cache_urls	T1	Purge specific URLs only.
purge_cache_everything	T2	Whole-zone purge — an origin-load event; requires approval.
update_dns_record	T2	Updates existing records only; no create or delete.
set_ip_access_rule	T2	Block/challenge/allow a single IP or range.
set_security_level	T2	Including Under Attack mode.
set_pool_enabled	T2	Enable/disable a load-balancer pool.

Deliberate absences: no freeform WAF rule editing, no tunnel actions, no DNS create/delete. The catalogue changes existing, reversible edge state; it does not author new configuration.

Setup

1. In the Cloudflare dashboard, create an account-owned API token (not a user token) with read-only permission groups: Account Settings, Cloudflare Tunnel, Workers Scripts, Cloudflare Pages, Load Balancing, Notifications, Account Analytics, and Audit Logs at account scope, plus Zone, DNS, Firewall Services, Analytics, and Load Balancing read on all account zones.
2. In ISE, add a Cloudflare integration (Settings → Integrations) with the token and your account ID. The token is encrypted at rest and redacted from logs.
3. The health check verifies the token immediately; the System card shows the account, status, and last sync.
4. To enable actions, create a second, write-capable account token scoped to the catalogue above and grant it via the integration’s Grant write flow. Reads and writes never share a token.

For signals to flow, make sure notification policies are configured in Cloudflare for the events you care about — ISE ingests the alert history those policies produce.

Examples

An origin problem, seen from the edge. A Cloudflare health-check notification fires for a load-balancer pool. The signal lands on the zone’s entity graph alongside what the cloud integrations know about the origin hosts, and the incident opens with both views.

Governed mitigation. During an attack, set_security_level to Under Attack mode (T2) is proposed, approved, and executed — and later reverted the same governed way. A stale cached asset after a bad deploy is a purge_cache_urls (T1) targeting just the affected URLs; purging everything would escalate to T2.

Evidence pull. Firewall events and zone analytics are queried on demand to confirm whether a traffic spike is an attack or a legitimate surge, with the results recorded on the incident.