Building an evidence-grounded agentic security operations harness on Cloudflare在 Cloudflare 上构建基于证据的代理式安全运营框架

Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale.安全警报很少会逐个出现。单一警报就可能导致整个环境出现峰值，需要人工分析师来判断哪些警报相互关联及其含义。当多个警报同时出现时，即使是经验丰富的安全分析师也可能迅速感到应接不暇。这就是“警报悖论”。现在，我们在 Cloudflare 规模下，通过内置的多 AI 代理安全运营框架，能够处理更多此类工作。

Our Cloudflare Managed Defense AI agent harness speeds up the process of gathering data, connecting and aggregating detections, and accounting for missing sources while new alerts continue to arrive. To further analyze context, we make use of the OpenAI Daybreak Defense Network and our partnership with Anthropic. Cloudflare uses approved OpenAI Daybreak and Anthropic models, including GPT-5.6 Cyber and Mythos, for deeper model-backed analysis. Initial analysis and scoring is done with Clef, Cloudflare’s open-source decision model.我们的 Cloudflare Managed Defense AI 代理框架加快了收集数据、连接和聚合检测结果以及在持续收到新警报时处理缺失来源的过程。为了进一步分析上下文，我们利用 OpenAI Daybreak Defense Network 以及我们与 Anthropic 的合作伙伴关系。Cloudflare 使用经批准的 OpenAI Daybreak 和 Anthropic 模型（包括 GPT-5.6 Cyber 和 Mythos）进行更深入的模型支持分析。初步分析和评分由 Cloudflare 的开源决策模型 Clef 完成。

Collecting evidence to understand what each alert means requires a lot of time. Even in a highly sophisticated Security Information and Event Management (SIEM), too much is still left for a human to review. Human analysts must gather data, connect and aggregate detections, and account for missing sources while new alerts continue to arrive.收集证据以理解每个警报的含义需要大量时间。即使在高度复杂的安全信息和事件管理系统 (SIEM) 中，仍有太多工作留给人工去审查。人工分析师必须在持续收到新警报的同时，收集数据、连接和聚合检测结果，并补全缺失的来源信息。

Think about every time a human analyst reviews an alert: "Which should we silence? Which action should we take? Which alert should we ignore? Which should we resolve as false positives? Which should we resolve as true positives? Which should trigger our incident team?" We address this predicament with our AI agent strategy. Our approach reduces all of those questions and gives Managed Defense Analysts a quick and consolidated view, directly providing insight into related alerts, admitted evidence, visible gaps, and recommended next steps. The result: cutting back on the time needed to analyze, and creating a hyper focus on actually getting security alerts resolved and mitigations deployed.试想一下，人工分析师每次审查警报时都会思考：“我们应该静默哪些警报？我们应该采取什么行动？应该忽略哪些警报？哪些应被判定为误报？哪些应被判定为实报？哪些应触发我们的事件响应团队？”我们通过 AI 代理策略解决了这一困境。我们的方法减少了所有这些疑问，并为 Managed Defense 分析师提供了一个快速且整合的视图，直接洞察相关警报、已采信的证据、明显的缺失环节以及建议的后续步骤。其结果是：减少了分析所需的时间，并使工作高度聚焦于真正解决安全警报和部署缓解措施。

Copy linkWhy a single agent fails复制链接为什么单一代理会失败

Our first prototype showed the limits of one general-purpose agent. We provided the AI agent the whole investigation. It produced useful analysis, but it also hallucinated claims the evidence did not support. Telemetry, detector descriptions, policies, and threat intelligence were flattened into one prompt, which caused their distinct roles to merge together.我们的第一个原型展示了通用代理的局限性。我们向 AI 代理提供了整个调查过程。它生成了有用的分析，但也产生了证据不支持的幻觉主张。遥测数据、检测器描述、策略和威胁情报被扁平化为一个提示词，导致它们各自的角色混淆在一起。

We saw three recurring problems with our first single-shot AI agent harness:我们在第一个单次调用 AI 代理框架中发现了三个反复出现的问题：

• Context became authority. A detection is a hypothesis, not proof that an exploit succeeded or an attack occurred. A broad AI agent can blur that distinction.上下文变成了权威。检测结果是一个假设，而不是漏洞利用成功或攻击发生的证明。广泛的 AI 代理可能会模糊这种区别。
• Scope drifted. An AI agent can query the wrong account, time range, or source. You can’t rely on a language model prompt to be a boundary.范围漂移。AI 代理可能会查询错误的账户、时间范围或来源。你不能依赖语言模型提示词来设定边界。
• Failure disappeared. If a lookup times out, the result may not distinguish "not checked" from "checked and not found."故障消失。如果查找超时，结果可能无法区分“未检查”和“已检查但未找到”。

To address these challenges we moved evidence collection and scope enforcement into application code, before model analysis begins.为了解决这些挑战，我们在模型分析开始之前，将证据收集和范围强制执行移入应用程序代码中。

Copy linkRecon first, inference second复制链接先侦察，后推理

It's tempting to put an AI agent at every step. The front half of our harness has none.人们很容易想在每个步骤都放置一个 AI 代理。但我们框架的前半部分没有任何 AI 代理。

Before we even call inference, deterministic code runs a fixed set of reconnaissance workflows with versioned API calls. It collects the customer's identity, detection history, traffic baseline, enforcement outcome, and network observations. Each piece of data is stored with its source, version, and timestamp.甚至在调用推理之前，确定性代码就会运行一组固定的侦察工作流，并使用版本化的 API 调用。它会收集客户身份、检测历史、流量基线、执行结果和网络观测数据。每条数据都与其来源、版本和时间戳一起存储。

Cloudflare sees both the request and the action applied to it. That lets the investigation connect the behavior that triggered an alert with both the control that fired and its outcome.Cloudflare 同时能看到请求及其应用的动作。这使得调查能够将触发警报的行为与触发的控制措施及其结果联系起来。

The fixed recon snapshot also makes evaluation reproducible. If AI agents fetch their own data, two runs may disagree because their inputs changed. Here, the same snapshot can be replayed, so differences between specialist AI agents’ findings come from interpretation rather than retrieval.固定的侦察快照也使得评估具有可重复性。如果 AI 代理自行获取数据，两次运行的结果可能会不一致，因为它们的输入发生了变化。在这里，相同的快照可以被重放，因此专业 AI 代理之间的发现差异源于解释而非检索。

Copy linkFilter noise early复制链接尽早过滤噪声

Most alerts are not incidents. The same rule often fires repeatedly on a known traffic pattern, and paging Managed Defense Analysts every time makes it easier to miss a real security incident.大多数警报并非安全事件。同一规则通常会在已知的流量模式上反复触发，每次都呼叫 Managed Defense 分析师会更容易导致错过真正的安全事件。

We needed a lightweight triage model to compare each alert with its reconnaissance data: Has this event been detected for the customer before? What did Managed Defense Analysts decide previously? Does the traffic look consistent with normal human behavior? Alerts scored with a high likelihood to be false positives skip analysis by the specialist AI agents.我们需要一个轻量级的分类模型来将每个警报与其侦察数据进行比较：该客户之前是否检测到此事件？Managed Defense 分析师之前做出了什么决定？流量看起来是否符合正常的人类行为？被评为极有可能是误报的警报将跳过专业 AI 代理的分析。

Clef, running on Workers AI, was the perfect fit for this type of fast agentic reasoning. 运行在 Workers AI 上的 Clef 非常适合这种快速的代理式推理。

Known high-volume noise is deterministically classified as passive when it arrives. It remains available as context but does not enter the active queue.已知的高频噪声在到达时会被确定性地归类为被动。它作为上下文保留，但不会进入主动队列。

Copy linkSpecialist AI agents handle the investigation复制链接专业 AI 代理负责调查

For alerts that need deeper review, a coordinator AI agent runs four specialist AI agents in parallel:对于需要更深入审查的警报，协调员 AI 代理会并行运行四个专业 AI 代理：

• Traffic analysis reviews request behavior, historical changes, and enforcement.流量分析：审查请求行为、历史变化和执行情况。
• Customer context reviews earlier alerts, dispositions, and Managed Defense Analysts’ decisions.客户上下文：审查之前的警报、处置结果和 Managed Defense 分析师的决定。
• Global telemetry compares the activity with privacy-preserving Internet-wide signals.全球遥测：将活动与保护隐私的互联网范围信号进行比较。
• Threat intelligence checks indicators already admitted to the alert or case.威胁情报：检查已纳入警报或案例的指标。

A synthesis AI agent combines their typed findings into one advisory; it can’t fetch new evidence or choose a classification outside the approved vocabulary. Keeping each task narrow makes unsupported claims easier to catch, and recommendations easier to audit.综合 AI 代理将它们的类型化发现合并为一份建议报告；它不能获取新证据或在批准的词汇表之外选择分类。保持每项任务的狭窄范围使得不支持的主张更容易被发现，建议也更容易被审计。

Copy linkGlobal context without customer data复制链接无客户数据的全球上下文

A security tool knows what happened inside the environment it is deployed in, but little about the world beyond it. Cloudflare compares an alert with patterns seen across its global network.安全工具了解其部署环境内发生的事情，但对环境之外的世界知之甚少。Cloudflare 会将警报与全球网络中观察到的模式进行比较。

For example, an IP may be targeting one site, scanning thousands of sites, or appearing for the first time. Those patterns carry different weights. To preserve customer privacy, the global telemetry specialist works only with aggregates; it never receives another customer's individual records or identity.例如，一个 IP 可能正在针对一个站点，扫描数千个站点，或者首次出现。这些模式具有不同的权重。为了保护客户隐私，全球遥测专家仅处理聚合数据；它永远不会接收其他客户的个人记录或身份信息。

This view combines features from Cloudflare's CDN, WAF, DDoS, Turnstile, Rate Limiting, and Cloudforce One threat intelligence. The synthesis AI agent weighs both global reputation and customer history. This ensures a globally common pattern can still be used on a per-customer basis, but does not automatically imply a widespread campaign for all customers.此视图结合了来自 Cloudflare 的 CDN、WAF、DDoS、Turnstile、速率限制和 Cloudforce One 威胁情报的功能。综合 AI 代理同时权衡全球声誉和客户历史。这确保了全球常见的模式仍可按客户使用，但不会自动暗示所有客户都面临广泛的攻击活动。

Copy linkHistory is evidence复制链接历史就是证据

Every evaluation is conscious of what came before it: the alert, the pattern, and which customer. The recon dossier records the alert's own track record including how many times this service alert has fired, how many of those were dispositioned as false positives, and what the Managed Defense Analyst concluded. An attack pattern that has been benign every time your Managed Defense Analysts have seen it is a very different object from the first sighting of something new, and the specialist AI agents are told which one they are looking at. Approved background context is retrieved from previous alerts and cases, so yesterday's conclusions are carried into today's decision, instead of being rebuilt from scratch.每次评估都清楚之前的记录：警报、模式以及客户是谁。侦察档案记录了警报自身的追踪记录，包括该服务警报触发了多少次，其中多少次被处置为误报，以及 Managed Defense 分析师得出了什么结论。在你的 Managed Defense 分析师看来一直良性的攻击模式，与首次发现的新事物是完全不同的对象，专业 AI 代理会被告知它们正在查看的是哪一种。批准的背景上下文会从之前的警报和案例中检索，因此昨天的结论被带入今天的决策中，而不是从头开始重建。

Our system aggregates related alerts into a consolidated case. In each case, we store evidence, findings, and recommendations. Our system deterministically joins and correlates this data, but we leave it to a Managed Defense Analyst to confirm the actual scope. Over time, a case can connect network, application, and Zero Trust evidence together, while tracking the source of the evidence for additional context and reference purposes.我们的系统将相关警报聚合到一个整合的案例中。在每个案例中，我们存储证据、发现和建议。我们的系统确定性地连接和关联这些数据，但我们留给 Managed Defense 分析师去确认实际范围。随着时间的推移，一个案例可以将网络、应用和零信任证据连接在一起，同时跟踪证据来源以获取额外的上下文和参考。

Copy linkFrom evidence to decision复制链接从证据到决策

Before analysis, the system creates a versioned evidence package with the subject, scope, time anchor, admitted evidence, policy versions, sources, and coverage gaps. Specialists must cite items in that package. Application code checks that every citation exists, belongs to the investigation, and supports the attached claim. Invalid findings are corrected or recorded as limitations.分析前，系统创建一个版本化的证据包，包含主题、范围、时间锚点、采信证据、策略版本、来源和覆盖缺口。专家必须引用该包中的项目。应用程序代码检查每项引用是否存在、是否属于该调查，以及是否支持所附主张。无效的发现会被纠正或记录为局限性。

We lean on Clef a second time to score our evidence. Is the collected evidence enough for a decision? Does any of our collected evidence contradict? Based on this evidence, Clef picks from a deterministically reduced list of attack classifications and dispositions.我们再次利用 Clef 对证据进行评分。收集的证据是否足以做出决定？收集的证据是否有矛盾之处？基于这些证据，Clef 从确定性缩减的攻击分类和处置列表中进行选择。

Cloudflare's developer platform runs this process. Application code on Workers admits evidence and validates results; Workflows coordinates each stage and saves completed work before the next begins, so a failed stage reuses evidence and findings that already passed validation instead of starting over. D1 keeps investigation and advisory state, R2 holds bounded context and evidence artifacts. Case-chat state persists in Durable Objects, uses Flue, and is enriched with AI Search.Cloudflare 的开发者平台运行此过程。Workers 上的应用程序代码采信证据并验证结果；Workflows 协调每个阶段并在下一个阶段开始前保存已完成的工作，因此失败的阶段会重用已通过验证的证据和发现，而不是从头开始。D1 保持调查和建议状态，R2 保存有界上下文和证据工件。案例聊天状态持久化在 Durable Objects 中，使用 Flue，并由 AI Search 增强。

Finally, an LLM-powered agent produces an advisory report using terms that Managed Defense Analysts already work with: affected surface, enforcement outcome, relevant controls, and next step. Managed Defense Analysts can inspect evidence, investigate further, revise the recommendation, or group alerts into a case. Application code fixes the customer scope before any model sees results, and gives each specialist only the evidence it needs. The model never receives authority to cross tenant boundaries or act for the Managed Defense Analysts.最后，一个由 LLM 驱动的代理使用 Managed Defense 分析师已经熟悉的术语生成建议报告：受影响的表面、执行结果、相关控制措施和后续步骤。Managed Defense 分析师可以检查证据、进一步调查、修改建议或将警报归入案例。应用程序代码在任何模型看到结果之前固定客户范围，并仅给每个专家提供其所需的证据。模型永远不会获得跨越租户边界或代表 Managed Defense 分析师采取行动的权限。

Copy linkHandling incomplete evidence复制链接处理不完整的证据

At network scale, a source will sometimes fail. A comparison may time out, metadata may be missing, or a threat intelligence lookup may return no match. The system keeps evidence already collected and records the gap.在网络规模下，来源有时会失败。比较可能会超时，元数据可能缺失，或者威胁情报查找可能返回无匹配结果。系统保留已收集的证据并记录缺口。

The advisory distinguishes three states:建议报告区分三种状态：

• Not checked未检查
• Checked, with no matching result已检查，无匹配结果
• Checked, with evidence supporting absence已检查，有证据支持不存在

If global telemetry is unavailable, the system can describe what is unusual for the customer but cannot say whether the pattern is widespread. When the evidence is insufficient, it makes no classification or disposition recommendation.如果全球遥测不可用，系统可以描述对客户而言什么是异常的，但无法说明该模式是否广泛存在。当证据不足时，它不会做出分类或处置建议。

Copy linkRemediation复制链接补救措施

A useful recommendation should lead to a solution, rather than a ticket. The advisory might suggest a rate limiting rule for an abusive path, a WAF custom rule for a signature, or a DDoS protection change. For fully managed customers, Managed Defense Analysts can apply the suggested rules; other customers will receive their recommendations in the dashboard and through their chosen alert path.有用的建议应该指向解决方案，而不是工单。建议报告可能会针对滥用路径提出速率限制规则，针对特征签名提出 WAF 自定义规则，或提出 DDoS 防护变更。对于全托管客户，Managed Defense 分析师可以应用建议的规则；其他客户将在仪表板中通过其选择的警报路径收到建议。

In the end, the Managed Defense Analyst remains responsible for the decision and any mitigation. Each alert and case includes the evidence behind the AI agent’s recommendation, which empowers the Managed Defense Analyst to reach a conclusion by accepting or updating the AI agent’s advice.最终，Managed Defense 分析师仍需对决策和任何缓解措施负责。每个警报和案例都包含 AI 代理建议背后的证据，这使 Managed Defense 分析师能够通过接受或更新 AI 代理的建议来得出结论。

Copy linkWhat comes next复制链接后续计划

Managed Defense Analysts remain responsible for judgment. The AI agent harness handles more of the repetitive work: assembling investigations, connecting related events, and showing the evidence behind each recommendation. Over the next few quarters, we plan to add a Custom Managed level with more flexibility for each organization.Managed Defense 分析师仍负责判断。AI 代理框架处理更多重复性工作：组装调查、连接相关事件，并展示每项建议背后的证据。在接下来的几个季度中，我们计划增加一个具有更大灵活性的“自定义托管”级别。

We also plan to explore continuous AI agents that monitor Cloudflare traffic and surface patterns that fixed rules and thresholds may miss.我们还计划探索持续运行的 AI 代理，它们可以监控 Cloudflare 流量并发现固定规则和阈值可能遗漏的模式。

The early beta is available in Cloudflare Managed Defense for eligible application-security alerts and cases. If you already use Cloudflare WAF, DDoS protection, Magic Transit, or another supported product, talk to your enterprise account team about adding Managed Defense.早期测试版现已在 Cloudflare Managed Defense 中提供，适用于符合条件的应用程序安全警报和案例。如果您已经使用 Cloudflare WAF、DDoS 防护、Magic Transit 或其他支持的产品，请与您的企业客户团队联系，了解如何添加 Managed Defense。