Security & Incident Response
SIRT
Security Incident Response Team. The group of analysts responsible for detecting, triaging, investigating, and responding to security incidents across an organization.
IOC (Indicator of Compromise)
Observable evidence that a security breach may have occurred — IP addresses, domain names, file hashes, command-line strings, or behavioral patterns associated with malicious activity.
Triage
The process of rapidly assessing an incoming security alert to determine whether it's real, how severe it is, and what response is needed. Analogous to medical triage — prioritize by urgency.
C2 (Command and Control)
Infrastructure used by attackers to communicate with and control compromised systems. A C2 beacon is a process on a victim machine that periodically contacts the attacker's C2 server for instructions.
EDR (Endpoint Detection and Response)
Security software deployed on workstations and servers that monitors process execution, file changes, and network connections. Generates telemetry used in incident investigation.
BEC (Business Email Compromise)
An attack where a threat actor gains access to a corporate email account and uses it to defraud the organization or its partners — typically via invoice fraud, wire transfer requests, or credential harvesting.
MITRE ATT&CK
A publicly available knowledge base of adversary tactics, techniques, and procedures (TTPs). Used as a common language for describing attack behaviors. Technique IDs like T1059.001 (PowerShell) reference specific entries.
MFA Bypass
Techniques attackers use to circumvent multi-factor authentication — including legacy protocol abuse (IMAP), token theft, phishing proxies, or social engineering of help desk staff.
Playbook
A documented, repeatable procedure for responding to a specific type of security incident. Contains step-by-step actions, decision points, escalation criteria, and rollback procedures.
Lateral Movement
The technique attackers use to move through a network after initial compromise — pivoting from one system to another to reach higher-value targets or data.
Cloudflare Platform
Worker
A serverless function that runs on Cloudflare's global network. Workers handle HTTP requests, run JavaScript/TypeScript, and access platform resources through bindings. Your workshop app is a Worker.
Binding
The mechanism by which a Worker accesses Cloudflare platform resources — D1 databases, Durable Objects, AI models, KV stores, R2 buckets, etc. Bindings are configured in wrangler.jsonc and accessed via the env parameter (e.g. env.AI, env.INCIDENTS_DB).
D1
Cloudflare's serverless SQL database. Built on SQLite, runs at the edge alongside your Worker. Accessed through a binding — no connection strings, no drivers, no cold start penalty.
Durable Object (DO)
A stateful, single-threaded object that lives on Cloudflare's network. Each DO instance has its own persistent storage (SQLite or key-value) and processes requests sequentially. Used in this workshop for per-incident session state and the TriageAgent.
Workers AI
Cloudflare's serverless GPU inference platform. Runs LLMs and other models on Cloudflare's network — accessed via the env.AI binding. No API keys, no external endpoints, no data leaving the network.
Agents SDK
A Cloudflare library for building stateful AI agents on Workers. Provides the Agent class (extending Durable Objects), tool definitions, state management, and orchestration patterns for multi-agent systems.
Sandbox SDK
A Cloudflare library for running isolated code execution environments. Allows agents to execute shell commands (like dig, whois) in a sandboxed container — providing ground-truth data instead of model inference.
Dynamic Workers / Worker Loader
A Cloudflare capability that lets a Worker create and execute other Workers at runtime. The host Worker uses env.LOADER.load() to spin up an ephemeral V8 isolate from generated source code — useful for executing agent-generated code safely.
Wrangler
The Cloudflare Workers CLI. Used to create, develop, test, and deploy Workers. Configuration lives in wrangler.jsonc (or wrangler.toml).
Isolate
A lightweight V8 execution context. Each Worker request runs in its own isolate — providing security isolation without the overhead of a full container or VM. Isolates start in sub-millisecond time.