AI AGENTS
Daily staged-WAF-rule impact report
Each morning an agent reviews WAF rules that were staged in log-only mode, measures how much traffic each would have blocked or skipped.
How it runs
The automated pipeline, trigger to output.
- TriggerDaily schedule starts the run
- ActionList staged rules and fetch matching eventsCloudflare
- LogicCompute per-rule impact and recommendation
- ActionWrite per-rule scorecard to NotionNotion
- OutputPost digest summary to SlackSlack
What it does
Closes the loop after a rule is staged. It pulls a day of firewall events, isolates requests that matched each staged (log-only) rule, and quantifies real-world impact: how many legit-looking requests a skip rule would have unblocked, or how many genuine threats a new block rule would have caught versus false hits. It then recommends enforce, hold, or revise.
When to use it
After proposing WAF changes you want evidence before flipping them live. Run it daily so staged rules don't sit untested and risky ones never get promoted on a hunch.
How it works
- 1A daily schedule starts the run.
- 2The agent lists currently staged log-only WAF rules from Cloudflare and fetches the day's matching firewall events.
- 3It computes per-rule impact metrics — match volume, distinct sources, and an estimate of false-positive versus true-positive matches.
- 4It classifies each rule as safe-to-enforce, needs-tightening, or too-broad.
- 5It writes a Notion page with a per-rule scorecard and recommendation, and posts a digest summary to Slack linking the report.
Set it up
What you configure once, before turning it on.
- 1Connect CloudflareWorkers, Pages, R2, KV — the edge stack.
- 2Connect NotionPages, databases, comments.
- 3Connect SlackChannels, DMs, threads, mentions.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More AI Agents workflows
Custom Metrics Cardinality Spike Pager
A webhook from a Datadog monitor fires when custom-metric cardinality jumps; an agent pinpoints the offending metric and tag, estimates the added cost.
Sentry-to-Confluence Runbook Updater
When a Sentry issue is resolved, the agent finds the matching Confluence runbook page and proposes an inline update with the verified fix.
Stale Doc-PR Chaser for Runbook Gaps
On a daily schedule the agent finds runbook doc PRs that were opened from resolved incidents but never reviewed, summarizes what each one fixes.
Resolved Incident to Public Troubleshooting Doc
For customer-facing errors resolved in Sentry, the agent drafts a sanitized troubleshooting entry and opens a PR to your ReadMe documentation.
On-Call Runbook Gap Closer: Resolved Sentry Issues to Doc PRs
An agent reads each newly resolved Sentry issue, compares the actual fix against your existing runbook, and opens a GitHub PR adding the missing remediation steps.
Weekly On-Call Doc-Gap Digest
Each week the agent reviews every Sentry issue resolved in the last 7 days, ranks the ones whose runbook coverage is missing or thin.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.