Cloudflare Egress Anomaly to SOC Investigation Dossier

Turns a raw Cloudflare egress alert into a ready-to-work SOC investigation. When outbound bytes from a source IP or worker exceed the rolling baseline, it enriches the destination, assigns a severity score, and spins up a Notion investigation dossier pre-filled with the triggering event and an empty IOC ledger.

Use it when your team triages data-exfiltration signals by hand and wants every Cloudflare egress spike to land as a consistent, deduplicated case instead of a noisy log line. Best for SOCs that run investigations in Notion.

1. 1Cloudflare Logpush delivers an egress event flagging unusual outbound volume.
2. 2A logic step compares bytes-out against the source's rolling baseline and drops anything within normal range.
3. 3An enrichment action resolves the destination IP/ASN reputation and geo via threat-intel lookup.
4. 4A scoring logic step combines volume delta, destination reputation, and asset criticality into a severity tier.
5. 5A Notion action creates an investigation dossier seeded with the event, enrichment, score, and an empty IOC ledger table.
6. 6The dossier link is posted to the SOC channel as the final handoff.