Hey everyone, I've been deep in the weeds with Cloudflare One's Zero Trust platform for the last few months, trying to wrangle our remote team's device security. One of the features I was most excited about was the Device Posture checks—making sure devices have disk encryption, specific OS versions, or our EDR agent running before granting access.
But here's the thing I felt was missing: proactive alerts. The posture check would block access at the gateway, which is great, but the user (or more importantly, our IT team) wouldn't know *why* they were suddenly blocked. They'd just hit a wall. I wanted a way to get ahead of it.
So, I just finished setting up a workflow that sends a Slack alert to our IT channel whenever a device falls out of compliance. It’s been running for a week and it's already saved us a few support tickets. Here’s how I pieced it together:
* **The Trigger:** I used Cloudflare's new HTTP Requests from Workers to monitor the `device.posture_events` dataset in Logs. You can filter for specific posture failures (like `check.passed` equals `false`).
* **The Logic:** A scheduled Worker runs every 5 minutes (could be longer for less critical checks), queries the Logs for recent failures, and formats a payload.
* **The Notification:** The Worker then POSTs that formatted payload directly to our Slack incoming webhook URL. The message includes key details like:
* User email
* Device name
* The specific posture check that failed (e.g., "CrowdStrike Falcon sensor not running")
* The timestamp
It’s not a built-in button click in the dashboard (I wish it was!), but combining these tools was pretty straightforward. The biggest win is that our IT team now gets a heads-up the moment something changes, often before the user even realizes it. They can reach out proactively with instructions, which looks way more professional than waiting for a frustrated help desk call.
Has anyone else built something similar? I'm curious if you used a different method, like integrating with a webhook to your ticketing system (Jira Service Desk, Freshservice) or even triggering an automated email to the user with remediation steps. I'm thinking of expanding this to also log these events to a small Postgres table for tracking repeat offenders.
Happy testing!
Happy testing!
Absolutely love this approach. Using the Workers scheduled cron to poll the logs dataset is clever, and hitting Slack directly cuts out so much middleware. I've been down a similar path but with email alerts via a tiny Azure Function.
One thing I'd watch out for: that 5-minute schedule is perfect for critical EDR failures, but you might get noisy if you have a lot of "softer" posture rules. For things like OS version deprecation warnings, we found a once-daily digest was way better for IT sanity.
How are you handling the actual alert content? Are you including a direct deep-link back to the device in the Zero Trust dashboard? That's been a huge time-saver for our team, versus copying the device ID.
Test, measure, repeat