Slack alerts for risky Cloudflare changes

Every 15 minutes, watch our Cloudflare account audit log for risky changes and post severity-tagged alerts to a Slack channel for security.

Trigger: cron, every 15 minutes.

Each run, call Cloudflare's List Audit Logs operation with a since-timestamp filter that pulls every entry created since the previous run finished (store and reuse that timestamp between runs; on the first run, look back 15 minutes). Page through results until the audit log is fully drained for the window.

Then reason over the entries and classify each one as high-risk or low-risk. Treat the following as high-risk by default:

- DNS record deletions, and any create/update/delete that touches an apex (root) record - Firewall and ruleset changes: Create/Update/Delete IP Access Rule, Create/Update Ruleset, Update Bot Management Settings, Lockdown rule changes - DNSSEC enable/disable or key changes - Zone deletion or transfer - API token creation - Account member added, role changed, or 2FA disabled

Treat low-noise items like DNS proxy toggles, analytics views, login events, and read-only API calls as low-risk.

For each high-risk entry, draft a short, human-readable summary that includes: the actor (email or token name), the action, the resource (zone, record, ruleset, token name), before/after values when the audit entry carries them, the timestamp, and a deep link back to the Cloudflare dashboard for that resource. Tag each one with a severity emoji: 🚨 for destructive or auth-changing actions (deletions, DNSSEC off, new API token, member added), ⚠️ for edits to firewall/WAF/bot management.

Post the alerts to the #cloudflare-audit Slack channel using Slack's Send a Message operation. Use Slack mrkdwn formatting (single asterisks for bold, <url|text> for links). Send one Slack message per run that contains all the high-risk entries as a list. If there were also low-risk entries in the same window, append a single trailing line at the bottom: 'and N other low-risk changes' so the channel stays signal-heavy. If there were zero high-risk entries and zero low-risk entries, do not post anything.

This addresses the recurring community ask for Slack notifications on Cloudflare audit log activity, which Cloudflare does not ship natively. The agent's judgement on what counts as high-risk vs noise is the key piece, so keep that classification step explicit and easy to tweak.