Weekly Cloudflare WAF and traffic security digest in Slack
Every Monday morning, get a plain English summary of what Cloudflare blocked last week, posted to Slack with a Linear ticket auto-filed when something looks unusual.
Cloudflare
Slack
LinearEngineeringOperationsDaily DigestsNotifications & AlertsAI ReportsEvery Monday at 8am Eastern, build me a weekly Cloudflare attack and traffic security digest for my engineering and security team. Use a cron trigger on that weekly schedule.
Step 1: Use the Cloudflare Query GraphQL Analytics operation to pull last seven days of zone metrics across all my Cloudflare zones. I want total requests, cached vs uncached share, requests blocked or challenged by WAF custom rules and managed rules, top source countries and ASNs for blocked traffic, and top targeted hostnames and URI paths. Then pull the same numbers for the prior seven days so we can compute week over week deltas.
Step 2: Have the agent write a concise executive summary in plain English. Cover how much traffic we saw, what share was blocked, the biggest movers versus the previous week, the top three attack categories or rule IDs that fired, and the top three offending source ASNs or countries.
Step 3: Post the summary to a configured Slack channel using Slack Send a Message. Format it with section headings and inline week over week percentage deltas so it reads cleanly in the channel.
Step 4: Check anomaly thresholds. If any of these conditions hit, also file a Linear issue using Linear Create Issue in a configurable team, priority High, with a title naming the anomaly and a description that includes the relevant numbers plus a link back to the Slack post so the on call security engineer can pick it up:
1) Total blocked requests jumped more than 50 percent week over week. 2) A single source ASN accounts for more than 25 percent of blocked traffic. 3) A brand new attack category appears that did not fire at all the prior week.
The goal is to give the team a regular signal of what Cloudflare is actually catching at the edge without anyone having to log into the dashboard, and to auto-escalate when something looks unusual.
Example output
What does this prompt do?
- Pulls last week's request, cache, and WAF block numbers across all your Cloudflare zones, then compares them to the prior week so you see week over week movement.
- Writes a short executive summary covering total traffic, the blocked share, the biggest movers, the top attack categories that fired, and the worst offending countries or networks.
- Posts the digest to a Slack channel with section headings and clean percentage deltas, so the team can read it in the channel without opening the Cloudflare dashboard.
- If a single signal looks unusual (a sharp jump in blocks, one network dominating blocked traffic, or a brand new attack category appearing), files a high priority Linear ticket for on call to triage.
What do I need to use this?
- A Cloudflare account with access to the zones you want covered in the digest.
- A Slack workspace and the channel where the weekly digest should land.
- A Linear workspace and the team where escalation tickets should be filed when anomalies hit.
How can I customize it?
- Change the cadence. The default runs every Monday at 8am Eastern, but any weekly schedule works.
- Pick the Slack channel that receives the digest and the Linear team that receives the escalation tickets.
- Tune the attention thresholds. Defaults are a 50 percent week over week jump in blocked traffic, any single network responsible for over 25 percent of blocks, or a brand new attack category.
FAQs
Will this work across multiple Cloudflare zones?
Do I need a paid Cloudflare plan?
Does this replace Cloudflare's built in weekly email?
What counts as an escalation worthy anomaly?
Can I send the digest somewhere other than Slack?
Related templates
When your flight moves, your calendar times get corrected automatically and you get a Slack note naming the meetings you're about to miss.
Every 15 minutes, forwarded phishing reports get traced back to the server that really sent them, with a verdict in Slack and the worst senders reported.
Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.
On the first Monday of every month, find the alarms nobody watches and the monitoring you quietly pay for, then get a costed cleanup list in Slack and Linear.
Every Monday, rank the week's matches by expected demand, put the big ones on your venue calendar, and post a rota-ready summary to Slack.
Every Tuesday we pull your best new reviews, draft social captions, email testimonials and product page quotes, then stage them in Notion for approval.
Stop hoping nothing weird happened at the edge last week.
Connect Cloudflare, Slack, and Linear once, and Geni posts the digest every Monday and pages on call automatically when anomalies show up.