Separate Access authentication evidence from HTTP activity evidence

A successful login record does not list every action taken inside an application.

Source facts

Cloudflare Access distinguishes authentication audit logs from per-request audit logs. Authentication logs describe login attempts and their outcomes; they do not capture the user’s actions during a self-hosted or SaaS application session. Per-request records can describe HTTP requests to protected paths, but interactions entirely within the browser produce no new server request to record. The documentation also separates identity-based and non-identity authentication logs, with different retrieval methods. Detailed HTTP logging and export features have their own availability requirements.

Source: Cloudflare — Access logs.

Applicability

This concerns evidence available from Cloudflare Access and associated request logging. Application database changes, browser-only interactions, and business approvals may require separate application audit records.

DSE recommendation

DSE recommends writing the investigation question before choosing a log source. For “who signed in,” preserve the authentication decision and application identifier. For “what was requested,” review the available request dataset and correlate timestamps and request identifiers. For “what changed,” obtain the application’s own audit trail. Document plan, retention, and export constraints before an incident, and protect any exported user or IP information. Do not describe a login-only export as a complete record of a user’s application activity.

Verification

With a controlled test account, sign in and perform an approved server-backed action plus a browser-only interaction. Compare the authentication, request, and application records. Document expected gaps and confirm that the evidence collection procedure can retrieve the relevant period without assuming all events share one dashboard.

Official reference

Cloudflare — Access logs. Reviewed October 15, 2026.