SIRT Triage Agent Workshop

Guided hands-on workshop

Build an AI-driven security incident triage agent.

Deploy an analyst console to your own Cloudflare account and progressively wire in D1, Durable Objects, Workers AI, the Agents SDK, Sandbox SDK, and Dynamic Workers. Your workshop account is provided via labs.cloudflare.com.

Get started Lab account ↗ See the finished demo

How it works

Deploy, wire, and watch your analyst console come to life.

01

Log in and deploy

Sign in to your labs.cloudflare.com account, authenticate wrangler, and deploy an empty analyst console.

02

Follow the guide

Each lesson adds one Cloudflare primitive. D1 populates incidents, Durable Objects track state, Workers AI powers analysis, and the Agents SDK orchestrates triage.

03

See it work

Every lesson produces a visible change in your deployed app. By the end, your console triages incidents with parallel AI agents.

Course path

Lessons

  1. 01 Welcome and setup

    Get your workshop account ready and authenticate wrangler.

  2. 02 What is SIRT and why agentic triage

    Understand the security incident response use case, the before/after value proposition, and preview the finished demo.

  3. 03 Workshop architecture and the harness diagram

    Read the 6-agent triage harness diagram and understand the progressive build path from empty UI to full analyst console.

  4. 04 Explore the reference demo

    Walk through the finished analyst console demo to understand each screen you will build.

  5. 05 Deploy the empty Analyst Console

    Clone the workshop app, deploy it to Workers, and see your empty analyst console queue at a live URL.

  6. 06 Wire up D1 to surface the incident queue

    Create a D1 database, run the seed migration, add the binding, and watch the incident queue populate with four sample incidents.

  7. 07 Per-incident state with Durable Objects

    Add a SIRTSession Durable Object so each incident has persistent state that survives page reloads.

  8. 08 Workers AI -- what it is, why it matters, first call

    Learn what Workers AI provides, why it matters for security automation, and make your first AI.run() call.

  9. 09 A first investigate step with Workers AI

    Hook a Workers AI call into the Investigate button so clicking it produces a structured analysis that streams into the UI.

  10. 10 Agents SDK -- durable agents, scoped tools, the Agent class

    Convert the single Workers AI call into a proper Agent subclass with an investigate() RPC method, introducing the Agents SDK.

  11. 11 Coordinator + parallel triage sub-agents

    Implement the 4-agent parallel dispatch pattern with a Coordinator that fans out to Command, Identity, Network, and Activity analyzers, then synthesizes the results into a triage card.

  12. 12 Response Agent and playbook-driven action plans

    Add the Response Agent that reads playbook files and produces a structured action plan with per-action risk, reversibility, and approve/reject controls.

  13. 13 Sandbox SDK -- let an agent run a CLI process

    Give the Network sub-agent a Sandbox to run real CLI enrichment commands like dig and whois, with the command and output surfaced in the UI.

  14. 14 Dynamic Workers -- execute agent-generated code

    Let the Response Agent generate a custom Worker at runtime (e.g. an IOC scoring helper) and execute it via Dynamic Workers, showing the generated code, execution time, and cost estimate.

  15. 15 Recap, before/after, what to extend

    Compare your deployed analyst console to the reference demo, review the five agents you didn't build, and learn what to extend after the workshop.