> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automate.ax/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Automate.ax automations are TypeScript programs.
> Use Bun for installation and command examples.
> Use Automate.ax for the product name and automate.ax for the package, CLI, and domain.
> Treat documented public APIs as current; do not invent transitional or deprecated names.

# On Layer 4 DDoS attack

> Runs for advanced network-layer DDoS attack alerts.

`cloudflare.onLayer4DdosAttack` runs for advanced network-layer DDoS attack alerts. Automate.ax creates the generic webhook destination and notification policy, verifies `cf-webhook-auth`, and removes managed resources when the deployment no longer subscribes.

```ts automations/cloudflare-on-layer-4-ddos-attack.automation.ts theme={null}
import { automation } from "automate.ax"
import { cloudflare } from "automate.ax/cloudflare"

export default automation("On Layer 4 DDoS attack", () => {
  const event = cloudflare.onLayer4DdosAttack({ accountId: "account-id" })
  // Escalate the Cloudflare Layer 4 DDoS alert.
})
```

Optional `filters` narrow the managed Cloudflare policy. Optional `account` selects a static project account binding. Returns the normalized alert type, provider data, text, timestamp, account and policy IDs, policy name, correlation ID, and alert state when present.

<Warning>
  Cloudflare generic webhooks and individual alert types can require a paid plan
  or enabled product.
</Warning>