Building an evidence-grounded agentic security operations harness on Cloudflare

Summary

Cloudflare’s Managed Defense harness uses a team of specialized AI agents to analyze security alerts, separating deterministic evidence collection from model inference to improve accuracy. Before any AI analysis, fixed reconnaissance workflows collect customer identity, detection history, traffic baseline, and enforcement outcomes, making evaluation reproducible. A lightweight triage model called Clef filters high-confidence false positives, while a coordinator agent runs four specialist agents in parallel for deeper investigation. The specialist agents cover traffic analysis, customer context, global telemetry, and threat intelligence, with a synthesis agent combining their typed findings into an advisory. The system preserves customer privacy by using only aggregate global telemetry, and Managed Defense Analysts remain responsible for final decisions and mitigations. The approach addresses three problems from a single-agent prototype: context becoming authority, scope drift, and failure to distinguish missing data from negative results.

Takeaways

1. 1

   Separating deterministic evidence collection from AI inference prevents hallucination and makes evaluation reproducible by using fixed reconnaissance workflows with versioned API calls.

2. 2

   A lightweight triage model called Clef, running on Workers AI, filters high-confidence false positives before specialist AI agents are invoked, reducing noise.

3. 3

   The system uses only aggregate global telemetry to preserve customer privacy while providing context from Cloudflare’s CDN, WAF, DDoS, Turnstile, Rate Limiting, and Cloudforce One threat intelligence.

FAQ