IT OPS
Cloudflare WAF Drift Detector with GitHub Baseline Review
Pulls live Cloudflare WAF rules on a schedule, diffs them against an approved baseline stored in GitHub, and opens a pull request to review any drift before it goes unnoticed.
How it runs
The automated pipeline, trigger to output.
- TriggerDaily schedule fires the drift check
- ActionFetch live WAF rules from Cloudflare zoneCloudflare
- ActionLoad approved waf-baseline.json from GitHubGitHub
- LogicDiff live config vs baseline; exit if identical
- OutputOpen GitHub PR with the drift for security reviewGitHub
What it does
Keeps your Cloudflare Web Application Firewall honest. On a schedule it fetches the current WAF ruleset for a zone, compares it field by field against the last approved baseline committed in your GitHub repo, and turns any difference into a reviewable pull request instead of a silent production change.
When to use it
Run this when your WAF config is supposed to be change-controlled but people still edit rules in the Cloudflare dashboard during incidents. It catches out-of-band edits, gives security a paper trail, and forces every rule change through code review.
How it works
- 1A daily schedule fires the workflow.
- 2Cloudflare returns the live WAF custom rules and managed-rule overrides for the target zone.
- 3The workflow loads the committed `waf-baseline.json` from GitHub and computes a structured diff.
- 4A logic step checks whether the diff is empty; if nothing changed it exits quietly.
- 5When drift exists it writes the new live config to a branch and opens a GitHub pull request showing added, removed, and modified rules.
- 6The PR description tags the security reviewers so an approved merge becomes the new baseline.
Set it up
What you configure once, before turning it on.
- 1Connect CloudflareWorkers, Pages, R2, KV — the edge stack.
- 2Connect GitHubRepos, issues, pull requests, actions.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More IT Ops workflows
Daily Building Anomaly Digest to MS Teams
Each morning queries BigQuery for the prior day's flagged sensor anomalies, summarizes them by site and system into a ranked briefing.
Indoor Air Quality Breach to Tenant Notice and Work Order
Listens for CO2, VOC, or humidity sensor alerts via webhook, and when a zone exceeds occupant-safety limits it emails affected tenants, opens a Monday remediation task.
Self-Service Reclaim Email for Idle Users
Detects users idle in a SaaS app past the threshold and emails each one a keep-or-release link; unanswered seats after the deadline are auto-flagged for removal.
Outlook Room Conflict Resolver with Approval Gate in Teams
When an Outlook room clashes, proposes a rebooking and asks the bumped meeting's organizer to approve the move in Microsoft Teams before any change is made.
Outlook Room Double-Booking Resolver with Auto-Rebook
Detects when two meetings claim the same Outlook room resource and automatically relocates the lower-priority meeting to a comparable free room.
Monthly Wasted-License Cost Report
Aggregates inactive-seat data across all tracked SaaS apps each month, computes total reclaimable spend, and delivers a ranked cost report to leadership in Notion and Slack.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.