Building a security overview dashboard for actionable insights
Cloudflare’s revamped Security Overview dashboard is designed to turn overwhelming security data into prioritized, actionable work. It combines ranked Security Action Items, security-tool status, and deep links into Security Analytics so teams can identify and investigate risks without switching between tools. Behind it is a checker-based system that processes more than 10 million insights daily through scheduled scans and real-time event handlers. ## From Visibility to Action - Security Action Items focus analysts on what needs to be fixed now rather than displaying every available event. - Issues are ranked by severity: - **Critical:** Immediate risks that could be exploited. - **Moderate:** Issues requiring attention to maintain security posture. - **Low:** Hardening recommendations and best-practice improvements. - Analysts can filter items by insight type, including suspicious activity and insecure configuration. ## Closing Configuration Gaps - The Detection Tools module shows whether Cloudflare protections are actively operating. - It highlights issues such as: - Security tools running in “Log Only” mode instead of blocking threats. - Shadow API discovery being disabled or unavailable. - This shifts the focus from whether a security feature exists to whether it is correctly configured and protecting traffic. ## Connected Investigation Workflows - Suspicious Activity cards appear both on the Security Overview and Security Analytics pages. - Selecting a card deep-links into Analytics with relevant filters already applied. - This removes repetitive navigation and filter recreation, helping teams investigate incidents faster. ## Checker-Based Insight Generation - Cloudflare generates and refreshes more than 10 million actionable insights each day. - Specialized microservices called **checkers** handle different areas, such as DNS, SSL certificates, and AI bot configurations. - Checkers can scale independently and operate through: - **Scheduled checks** for comprehensive configuration inspections. - **Real-time listeners** that respond immediately to control-plane events. ## Scheduled Checks and Insight Lifecycles - A scheduler distributes inspection tasks across checkers, such as scanning all DNS records for a zone. - A checker: - Receives a task. - Collects relevant assets and configurations. - Applies specialized validation rules. - Creates an insight when a configuration fails its required threshold. - Updates the insight timestamp if the issue persists. - Removes the insight once the issue is fixed. ## Real-Time Ruleset Handlers - Event handlers listen continuously for configuration changes. - For example, when a WAF ruleset is changed, a handler can immediately detect that it is enabled only in “Log Only” mode. - The handler determines that attacks are being recorded but not blocked, registers an insight, and displays it on the dashboard. - Once the configuration is secured, the insight is cleared automatically. The dashboard’s main benefit is its combination of prioritization, configuration awareness, and immediate investigation paths. By pairing scheduled validation with real-time detection, it helps security teams move from passive monitoring to faster, more proactive remediation.
Read original(opens in new tab)