cloudflare.onLayer7DdosAttack runs for advanced application-layer DDoS attack alerts. Automate.ax creates the generic webhook destination and notification policy, verifies cf-webhook-auth, and removes managed resources when the deployment no longer subscribes.
automations/cloudflare-on-layer-7-ddos-attack.automation.ts
filters narrow the managed Cloudflare policy. Optional account selects a static project account binding. Returns the normalized alert type, provider data, text, timestamp, account and policy IDs, policy name, correlation ID, and alert state when present.