Cloudflare Alert Triage Agent with Codex

The run branches on the kind of alert and then goes and gets numbers: probe results across locations for a health check, requests with the cached and uncached split plus 5xx and blocked traffic for anything traffic shaped, expiry date and days remaining for a certificate. It is API and data work ending in a short note, which is the shape Codex is most dependable on.
Loading preview…
Free to start · guided setup · switch agents any time.

Live demo

Watch it work before it's live

Run a staged conversation — no account needed. The agent handles it for real while a simulated world answers its tool calls; nothing touches real accounts, and nothing is actually sent.

HTTP DDoS attack detected and mitigated

tienda.bellavia.mxBellavia Retail, account a91c4

Managed rule 6a2f began mitigating at 03:14 UTC. Peak 412,000 requests per second against /checkout/session, 94 percent from three autonomous systems. Mitigation is still active. Nothing in the payload about origin status.

What you'll need

Set up in minutes

Using this template drops you into a guided setup. It asks exactly this, nothing else:

  1. Connect Cloudflare

    One sign-in. The agent acts through your account, scoped to what this template uses.

  2. Connect Slack

    One sign-in. The agent acts through your account, scoped to what this template uses.

  3. Alert rules

    Which Cloudflare alerts deserve a channel post and what each kind means for you - your zones and who owns them, how seriously you take an attack alert next to a health check flip, and where somebody should look first when your origin throws errors or a certificate stops renewing.

  4. Runs on Codex

    Preselected for this page — connect your Codex account during setup, or switch to NoClick's built-in models with one click.

  5. Watch it handle a test run

    A staged conversation against a simulated world — then it’s live.

A considered pairing

Why Codex for this agent

Different alert, different evidence

A health check flip and a request spike need entirely different fetches, and the payload already says which one arrived. Branching correctly on that is the first thing the run gets right.

The numbers come from the zone

Cached against uncached is what says whether origin load actually moved or the edge absorbed the whole thing. Both figures are pulled rather than characterised.

Good to know

Before you fork

What Cloudflare permissions does the token need?

Read on zone analytics and health checks for the zones you point it at. Nothing in the template writes, so a token with no edit permission covers the entire job and removes any question of a firewall rule changing by accident. The notification policies themselves stay configured in Cloudflare and are routed into the workflow.

Other editions

Run it with a different agent

claude-codeClaude CodeopencodeopenclawhermesMore Codex agents

Make it yours

Put Cloudflare Alert Triage Agent to work on Codex.

Free to start. Guided setup, a staged test run, and a workflow you can change at every step.