Before you start building, take 10 minutes to walk through the finished product. The reference demo at /demo shows exactly what your analyst console will look like by the end of the workshop.
Open the demo
Navigate to /demo on this workshop site. This is a self-contained simulation — it uses canned data, not live AI calls — so it always works and loads instantly.
You will see the SIRT Analyst Console with ten incidents in the queue, sorted by severity. The incidents span malware, phishing, authentication anomalies, data exfiltration, AI prompt injection, cloud misconfiguration, credential stuffing, user-reported phishing, CI pipeline compromise, and ransomware.
Walk through the triage flow
Click the first incident in the queue — the malware scenario (Office macro / encoded PowerShell). Then click Investigate.
Watch four sub-agents stream their analysis in parallel:
- Command-Line Analyzer — decodes the obfuscated PowerShell command, identifies LOLBin abuse (Living Off The Land Binaries), extracts IOCs
- Identity Analyzer — assesses whether the user account is likely compromised based on access patterns and risk factors
- Network Analyzer — evaluates the destination IP/domain reputation, ASN, hosting infrastructure
- Activity Analyzer — surfaces baseline deviations, lead-up activity, and cross-incident correlations
This parallel dispatch pattern is what you will build in lesson 11 using the Agents SDK.
Review the triage card
After all four sub-agents complete, the Triage Synthesizer combines their findings into a single structured triage card showing:
- Severity (P0-P3) with confidence level
- Incident type (malware, phishing, unauthorized access, data exfiltration)
- Key indicators (IPs, domains, users, hostnames)
- Sub-agent agreement (unanimous, majority, split)
- Recommended next step (engage response agent, escalate to L2, etc.)
Review the action plan
Continue to the action plan screen. The Response Agent reads relevant playbooks and produces structured action recommendations. Each action includes:
- Action type and target (e.g. “Isolate endpoint WKSTN-JDOE-PC”)
- Risk level (low, medium, high) and reversibility (can it be undone?)
- Prerequisites (what must happen first)
- Rationale (why the agent recommends this)
- Per-action controls: approve, reject, or escalate
What is simulated vs. what you will build live
| Demo element | In the demo | What you build |
|---|---|---|
| Sub-agent analysis | Canned text revealed with setTimeout | Real Workers AI inference per sub-agent |
| Parallel dispatch | 4 timers with staggered durations | Agents SDK with real parallel execution |
| Action plan | Pre-written per scenario | Response Agent reading playbook files via Workers AI |
| CLI enrichment | Not shown | Real dig/whois commands via Sandbox SDK |
| Dynamic Workers | Not shown | Agent-generated code executed at runtime |
You are ready to build
Now that you have seen the finished product, you will progressively build each capability across the remaining lessons. The next step is to deploy an empty version of this console to your own Cloudflare account.