"We've Been Hacked" — No, That Is Cloudflare: Reading Edge Traffic Before You Blame the VM

Firewall shows thousands of sessions from Cloudflare IPs and the team says the VM is hacked. How to tell an L7 flood from a breach, and what to check.