SECOPS
Route blocked WAF events to Slack for one-click allowlist approval
On each Cloudflare firewall webhook, evaluates whether a blocked request looks like a legitimate false positive and posts an interactive Slack approval card.
How it runs
The automated pipeline, trigger to output.
- TriggerCloudflare firewall-event webhook receivedCloudflare
- LogicScore event benign vs attack; drop obvious attacks
- ActionPost interactive approval cardSlack
- ActionOn approve, draft scoped allowlist expressionOpenAI
- OutputCommit exception to config repo with approverGitHub
What it does
Turns individual Cloudflare WAF block notifications into actionable Slack approvals. When a block trips on traffic that scores as likely-benign, it posts a card with the request details and an Approve button; approving drafts and commits a narrowly-scoped allowlist rule to your config repo.
When to use it
When a small team wants a human in the loop for WAF tuning but doesn't want to leave Slack — ideal for low-to-moderate event volume where each false positive deserves a quick yes/no rather than batch processing.
How it works
- 1Cloudflare sends a firewall-event webhook for a blocked request.
- 2A logic step scores it: known partner ASN, expected path, and clean payload push it toward benign; obvious attack signatures are dropped.
- 3Likely-benign events post an interactive approval card to the secops Slack channel.
- 4On approval, an OpenAI step generates a minimal allowlist expression scoped to that pattern.
- 5The exception is committed to the WAF config repo on GitHub with the approver recorded in the commit.
Set it up
What you configure once, before turning it on.
- 1Connect CloudflareWorkers, Pages, R2, KV — the edge stack.
- 2Connect SlackChannels, DMs, threads, mentions.
- 3Connect OpenAIModels, embeddings, files.
- 4Connect GitHubRepos, issues, pull requests, actions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Scheduled AWS Access-Key Age Sweep and Forced Rotation
Runs daily to find IAM access keys older than your policy threshold, deactivates the stale key, issues a fresh pair, and notifies the key owner with their replacement instructions.
Correlate Datadog WAF anomaly alert with Cloudflare evidence
When Datadog fires a WAF block-rate anomaly monitor, it pulls the matching Cloudflare firewall events, builds an evidence pack of top rules and ASNs.
Exposed-Secret Incident Triage and Remediation Agent
An agent-driven workflow that investigates a reported leaked secret end to end, decides revoke-versus-escalate, executes the rotation.
Non-Rotatable Leaked Secret to PagerDuty Escalation
Catches secret-scan hits for credentials that cannot be auto-rotated, gathers blast-radius context, and pages the on-call engineer with a step-by-step manual rotation runbook.
GitHub Secret-Scan Hit to Auto-Revoke and Rotate
When GitHub secret scanning flags a leaked credential in a repo, it auto-classifies the secret type, revokes the live key at the provider, mints a replacement.
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.