AI AGENTS
WAF rule change as a reviewed GitHub pull request
An agent turns approved false-positive findings into a pull request against your Terraform/Cloudflare-as-code repo, with the rule diff, rationale, and a rollback note.
How it runs
The automated pipeline, trigger to output.
- TriggerApproved rule proposal received
- ActionRead current WAF ruleset file from repoGitHub
- LogicCompose rule diff, rationale, and rollback note
- ActionOpen pull request on new branchGitHub
- OutputPost PR link to SlackSlack
What it does
For teams that manage Cloudflare WAF as code, this takes a proposed skip-rule change and opens a GitHub pull request that edits the ruleset definition file. The PR body documents which false-positive cluster motivated the change, the exact expression added, and how to roll back. Your existing branch protections and reviewers stay in control.
When to use it
When WAF config is version-controlled (Terraform, Wrangler, or a custom rules JSON) and every change must land through PR review rather than a live API edit. Pairs well with the false-positive tuner feeding it candidates.
How it works
- 1An approved rule proposal (from Slack or an upstream workflow) triggers the run.
- 2The agent reads the current ruleset file from the GitHub repo to find the right insertion point.
- 3It edits the file to add the scoped skip rule and writes a clear commit message plus PR description with rationale and rollback steps.
- 4It opens a pull request on a new branch and requests the security team as reviewers.
- 5It posts the PR link to Slack so the requester knows it's ready for code review.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect SlackChannels, DMs, threads, mentions.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More AI Agents workflows
Stale Doc-PR Chaser for Runbook Gaps
On a daily schedule the agent finds runbook doc PRs that were opened from resolved incidents but never reviewed, summarizes what each one fixes.
On-Call Runbook Gap Closer: Resolved Sentry Issues to Doc PRs
An agent reads each newly resolved Sentry issue, compares the actual fix against your existing runbook, and opens a GitHub PR adding the missing remediation steps.
Datadog Bill Spike Attribution Agent
When a daily Datadog cost check detects a spend jump, an agent attributes the increase to the specific services and metric types driving it and posts a ranked breakdown to Slack.
Sentry-to-Confluence Runbook Updater
When a Sentry issue is resolved, the agent finds the matching Confluence runbook page and proposes an inline update with the verified fix.
Custom Metrics Cardinality Spike Pager
A webhook from a Datadog monitor fires when custom-metric cardinality jumps; an agent pinpoints the offending metric and tag, estimates the added cost.
Resolved Incident to Public Troubleshooting Doc
For customer-facing errors resolved in Sentry, the agent drafts a sanitized troubleshooting entry and opens a PR to your ReadMe documentation.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.