CLOUDFLARE 2026-10-07 Tier 1

Building an evidence-grounded agentic security operations harness on Cloudflare¶

Summary¶

Cloudflare details the architecture of the multi-AI-agent security-operations harness behind Cloudflare Managed Defense — the how companion to the 2026-09-29 application-security framework post. The problem is the alert paradox: alerts arrive in correlated spikes, and even a sophisticated SIEM leaves a human analyst to gather data, connect detections, and account for missing sources while new alerts keep arriving. A first prototype — one general-purpose agent handed the whole investigation — hallucinated claims the evidence did not support because telemetry, detector descriptions, policies, and threat intel were flattened into a single prompt, merging their distinct roles. Cloudflare's fix is a recon-first, inference-second harness: deterministic application code collects a versioned evidence package and fixes investigation scope before any model runs; a cheap triage model (Clef on Workers AI) filters known noise; a coordinator runs four specialist agents in parallel over the fixed evidence; a synthesis agent combines their typed findings into one advisory constrained to an approved classification vocabulary; and application code validates every citation a specialist makes against the evidence package. The whole thing runs on the Cloudflare developer platform (Workflows + D1 + R2 + Durable Objects + Flue + AI Search), and the Managed Defense Analyst remains responsible for the decision and any mitigation.

Key takeaways¶

Why a single agent fails — three named failure modes. (Source: sources/2026-10-07-cloudflare-building-an-evidence-grounded-agentic-security-operations-ha-efc47ac2) The first single-shot prototype produced useful analysis but hallucinated unsupported claims, exhibiting:
Context became authority — a detection is a hypothesis, not proof an exploit succeeded; a broad agent blurs that distinction and treats retrieved context as fact (llm-hallucination).
Scope drifted — an agent can query the wrong account, time range, or source; "you can't rely on a language model prompt to be a boundary."
Failure disappeared — a timed-out lookup may not distinguish "not checked" from "checked and not found." The structural response: move evidence collection and scope enforcement into application code, before model analysis begins.
Recon first, inference second — the front half of the harness has no agents. Deterministic code runs a fixed set of reconnaissance workflows with versioned API calls, collecting the customer's identity, detection history, traffic baseline, enforcement outcome, and network observations. Each piece of data is stored with its source, version, and timestamp. Because recon is a fixed snapshot (not agent-fetched), two runs replay the same inputs → differences between specialists come from interpretation, not retrieval — making evaluation reproducible. This is the security-ops instance of deterministic work in code, judgment in the model.
Filter noise early with a cheap triage model. Most alerts are not incidents; the same rule fires repeatedly on known traffic. A lightweight triage model — Clef running on Workers AI — compares each alert with its recon data (has this fired before? what did analysts decide? does traffic look like normal human behavior?). Alerts scored high-likelihood false-positive skip the specialist agents; known high-volume noise is deterministically classified as passive on arrival — it stays available as context but never enters the active queue. A cheap fast classifier gating expensive deep analysis (patterns/cheap-approximator-with-expensive-fallback; patterns/two-stage-evaluation; mitigates concepts/alert-fatigue).
Specialist agents handle the investigation — coordinator fans out four in parallel. For alerts needing deeper review, a coordinator agent runs four specialists concurrently (patterns/specialized-agent-decomposition; patterns/parallel-retrieval-fusion):
Traffic analysis — request behavior, historical changes, enforcement.
Customer context — earlier alerts, dispositions, analyst decisions.
Global telemetry — compares activity with privacy-preserving Internet-wide signals.
Threat intelligence — checks indicators already admitted to the alert/case. A synthesis agent combines their typed findings into one advisory; it cannot fetch new evidence or choose a classification outside the approved vocabulary. Keeping each task narrow makes unsupported claims easier to catch and recommendations easier to audit.
Global context without customer data. The global-telemetry specialist works only with aggregates — it never receives another customer's individual records or identity. It combines features from Cloudflare's CDN, WAF, DDoS, Turnstile, Rate Limiting, and Cloudforce One threat intelligence. A globally-common pattern is weighted per-customer but does not automatically imply a widespread campaign for everyone — a deliberate bounded-inference stance that keeps the model from over-claiming.
History is evidence. Every evaluation knows the alert's own track record — how many times a service alert has fired, how many were dispositioned false positive, what the analyst concluded. "An attack pattern that has been benign every time your analysts have seen it is a very different object from the first sighting of something new," and specialists are told which they're looking at. Approved background context is retrieved from previous alerts and cases (AI Search-enriched), so yesterday's conclusions carry into today's decision instead of being rebuilt. Related alerts aggregate into a consolidated case storing evidence, findings, and recommendations; the system deterministically joins/correlates, but a human confirms actual scope.
From evidence to decision — mandatory citation + deterministic validation. Before analysis, the system creates a versioned evidence package with the subject, scope, time anchor, admitted evidence, policy versions, sources, and coverage gaps. Specialists must cite items in that package; application code checks that every citation exists, belongs to the investigation, and supports the attached claim — invalid findings are corrected or recorded as limitations. Clef is used a second time to score whether the collected evidence is sufficient and non-contradictory, then picks from a deterministically reduced list of attack classifications and dispositions. This citation-validation step is the concrete mechanism that converts "trust the LLM's claim" into "verify the claim against admitted evidence" — the structural antidote to context-as-authority.
Platform substrate. Application code on Workers admits evidence and validates results; Workflows coordinates each stage and saves completed work before the next begins, so a failed stage reuses evidence and findings that already passed validation instead of starting over (durable execution); D1 keeps investigation + advisory state; R2 holds bounded context + evidence artifacts; case-chat state persists in Durable Objects, uses Flue, and is enriched with AI Search.
Handling incomplete evidence — three explicit states. At network scale a source will fail. The advisory distinguishes not checked / checked, no matching result / checked, with evidence supporting absence — directly fixing the "failure disappeared" prototype flaw. If global telemetry is unavailable, the system can describe what's unusual for the customer but cannot say whether the pattern is widespread; when evidence is insufficient it makes no classification or disposition recommendation (graceful degradation of the conclusion, not a confident guess).
Remediation + human authority. Recommendations lead to a solution, not a ticket — a Rate Limiting rule for an abusive path, a WAF custom rule for a signature, or a DDoS protection change. For fully-managed customers analysts can apply the suggested rules; others get recommendations in the dashboard / chosen alert path. Application code fixes the customer scope before any model sees results, gives each specialist only the evidence it needs, and the model never receives authority to cross tenant boundaries or act for analysts — the Managed Defense Analyst accepts or updates the advice (human-in-the-loop).

Operational details¶

Models: initial analysis + scoring with Clef (Cloudflare's open-source decision model, on Workers AI); deeper model-backed analysis via approved OpenAI Daybreak Defense Network and Anthropic models, named as GPT-5.6 Cyber and Mythos.
Specialist count: 4 (traffic analysis, customer context, global telemetry, threat intelligence) behind 1 coordinator + 1 synthesis agent.
Evidence package fields: subject, scope, time anchor, admitted evidence, policy versions, sources, coverage gaps (all versioned/timestamped).
Three evidence states: not-checked / checked-no-match / checked-absence-supported.
Correlation surface: reverse-proxy (Application Security) + forward-proxy (Cloudflare One) visibility links an external attack to internal access / scanning / lateral movement.
Platform: Workers (admit + validate), Workflows (stage coordination + save-before-next), D1 (investigation/advisory state), R2 (bounded context + evidence artifacts), Durable Objects + Flue + AI Search (case-chat state).
Status: early beta in Cloudflare Managed Defense for eligible application-security alerts/cases; roadmap adds a Custom Managed level and continuous agents monitoring traffic for patterns fixed rules miss.

Caveats¶

No quantitative results (no precision/recall, no MTTD/MTTR, no false-positive reduction numbers) — the post is an architecture description, not an evaluation.
Model names (GPT-5.6 Cyber, Mythos) are the post's labels for approved partner models; no capability detail given.
The coordinator↔specialist↔synthesis collaboration protocol is described by role and constraint, not by wire format.
"Early beta" — several capabilities (Custom Managed, continuous agents) are roadmap.

Source¶

systems/cloudflare-managed-defense — the SOC/MDR team + harness this post architects.
systems/clef — the decision model used twice (noise triage + evidence-sufficiency scoring).
patterns/specialized-agent-decomposition — the coordinator + four-specialist + synthesis structure.
patterns/deterministic-tool-vs-llm-judgment — recon + scope + citation-validation in code, interpretation in the model.
concepts/llm-hallucination — the "context became authority" failure the whole harness exists to prevent.
concepts/human-in-the-loop — analyst retains decision + mitigation authority; model never crosses tenant boundaries.
concepts/alert-fatigue — the alert-paradox + cheap-triage-filter motivation.