Skip to main content
Turn Cloudflare’s audit log firehose into a weekly security briefing. This automation runs on a schedule, pulls the Cloudflare audit logs, surfaces configuration drift (WAF rule changes, DNS record modifications, new API tokens, disabled features), and posts a structured security report to your team.

Use this template

Open Cloudflare Security Audit in Devin and create the automation with the default configuration. You can customize it before saving.

​
What this automation does

Cloudflare sits at the perimeter of your infrastructure, which means Cloudflare changes can silently shift your security posture. The Cloudflare Audit Logs MCP gives Devin read access to the full change history — who changed what, when, and from where — so you get a human-readable weekly summary instead of a 10,000-line JSON dump.

​
How it works

Trigger: Schedule event — recurring
  • Event: schedule:recurring
    • Conditions:
      • rrule matches FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0
What Devin does: Starts a session with full event context, executes the prompt below, and (optionally) notifies you on failure.

​
Prerequisites

​
Example prompt

The template ships with this prompt. You can edit it after clicking Use template, or leave it as-is.

​
Setting it up

  1. Open Automations → Templates in Devin.
  2. Click Cloudflare Security Audit. The create page opens with this template pre-filled.
  3. Connect any required integrations and install MCP servers if you haven’t already.
  4. Replace any placeholder values in the trigger conditions (for example, swap your-org/your-repo for your actual repo).
  5. Review the prompt and adjust it for your team’s language, conventions, and guardrails.
  6. Click Create automation.
Most automation templates include suggested ACU and invocation limits to bound cost during early rollout. Keep them as-is until you’re confident in the automation’s behavior, then raise them to fit your workload.

​
When to use this template

  • Security teams maintaining compliance posture across Cloudflare accounts
  • Platform teams preventing accidental misconfiguration
  • Detecting insider threat or credential compromise
  • SOC 2 / ISO 27001 evidence generation for Cloudflare changes

​
Customization ideas

  • Change the cadence (daily, weekly, monthly)
  • Scope to specific accounts, zones, or rule sets
  • Cross-reference with identity provider audit logs
  • Escalate high-severity findings to PagerDuty or Opsgenie

​
See also