Cloudflare Alert Triage Agent with Hermes
Four headings, shorter than a phone screen, no raw analytics rows pasted in, and a start here line that comes from your own rules rather than being a step it takes itself. The discipline lives in the refusals: no security mode switched on, no rate limiting rule written, no DNS record changed, no cache purged, no notification silenced. Hermes reasons well enough for the read and stays inside those rails.
Watch it work before it's live
Run a staged conversation — no account needed. The agent handles it for real while a simulated world answers its tool calls; nothing touches real accounts, and nothing is actually sent.
HTTP DDoS attack detected and mitigated
Managed rule 6a2f began mitigating at 03:14 UTC. Peak 412,000 requests per second against /checkout/session, 94 percent from three autonomous systems. Mitigation is still active. Nothing in the payload about origin status.
Set up in minutes
Using this template drops you into a guided setup. It asks exactly this, nothing else:
Connect Cloudflare
One sign-in. The agent acts through your account, scoped to what this template uses.
Connect Slack
One sign-in. The agent acts through your account, scoped to what this template uses.
Alert rules
Which Cloudflare alerts deserve a channel post and what each kind means for you - your zones and who owns them, how seriously you take an attack alert next to a health check flip, and where somebody should look first when your origin throws errors or a certificate stops renewing.
Runs on Hermes
Preselected for this page — connect your Hermes account during setup, or switch to NoClick's built-in models with one click.
Watch it handle a test run
A staged conversation against a simulated world — then it’s live.
Why Hermes for this agent
Start here is for a person
The last heading names the first check your rules prescribe for this alert type. It is a handover to somebody with authority, not a preview of something the agent already went and did.
Dates printed, never called soon
A certificate expiring on 18 August with six days left reads as a decision. The word soon reads as an errand somebody else will pick up.
Before you fork
How do we know it will not paste a wall of analytics?
The instructions cap the note at four short headings and forbid raw rows outright, and the way to confirm it against your own zones is the Test Run, which replays staged alerts including the certificate on a hostname nobody owns. If the notes still read long for your taste, the alert rules variable is where you say so.
Run it with a different agent
Put Cloudflare Alert Triage Agent to work on Hermes
Free to start. Guided setup, a test run against staged conversations, and it's live.