Weekly Cloudflare WAF and traffic security digest in Slack
Every Monday morning, get a plain English summary of what Cloudflare blocked last week, posted to Slack with a Linear ticket auto-filed when something looks unusual.
Integrations
Cloudflare
Slack
Linear
Type
Categories
- Engineering
- Operations
Every Monday at 8am Eastern, build me a weekly Cloudflare attack and traffic security digest for my engineering and security team. Use a cron trigger on that weekly schedule.
Step 1: Use the Cloudflare Query GraphQL Analytics operation to pull last seven days of zone metrics across all my Cloudflare zones. I want total requests, cached vs uncached share, requests blocked or challenged by WAF custom rules and managed rules, top source countries and ASNs for blocked traffic, and top targeted hostnames and URI paths. Then pull the same numbers for the prior seven days so we can compute week over week deltas.
Step 2: Have the agent write a concise executive summary in plain English. Cover how much traffic we saw, what share was blocked, the biggest movers versus the previous week, the top three attack categories or rule IDs that fired, and the top three offending source ASNs or countries.
Step 3: Post the summary to a configured Slack channel using Slack Send a Message. Format it with section headings and inline week over week percentage deltas so it reads cleanly in the channel.
Step 4: Check anomaly thresholds. If any of these conditions hit, also file a Linear issue using Linear Create Issue in a configurable team, priority High, with a title naming the anomaly and a description that includes the relevant numbers plus a link back to the Slack post so the on call security engineer can pick it up:
1) Total blocked requests jumped more than 50 percent week over week. 2) A single source ASN accounts for more than 25 percent of blocked traffic. 3) A brand new attack category appears that did not fire at all the prior week.
The goal is to give the team a regular signal of what Cloudflare is actually catching at the edge without anyone having to log into the dashboard, and to auto-escalate when something looks unusual.
What it does
- Pulls last week's request, cache, and WAF block numbers across all your Cloudflare zones, then compares them to the prior week so you see week over week movement.
- Writes a short executive summary covering total traffic, the blocked share, the biggest movers, the top attack categories that fired, and the worst offending countries or networks.
- Posts the digest to a Slack channel with section headings and clean percentage deltas, so the team can read it in the channel without opening the Cloudflare dashboard.
- If a single signal looks unusual (a sharp jump in blocks, one network dominating blocked traffic, or a brand new attack category appearing), files a high priority Linear ticket for on call to triage.
What you’ll need
- A Cloudflare account with access to the zones you want covered in the digest.
- A Slack workspace and the channel where the weekly digest should land.
- A Linear workspace and the team where escalation tickets should be filed when anomalies hit.
How to customize it
- Change the cadence. The default runs every Monday at 8am Eastern, but any weekly schedule works.
- Pick the Slack channel that receives the digest and the Linear team that receives the escalation tickets.
- Tune the attention thresholds. Defaults are a 50 percent week over week jump in blocked traffic, any single network responsible for over 25 percent of blocks, or a brand new attack category.
Use cases
- Daily Digests
- Notifications & Alerts
- AI Reports
