Create a WAF list from an approved incident webhook
Turn an incident signal into a ready containment list without opening another console.
Trigger
Webhook received
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Action
Create WAF List
Tool to create a new empty waf list for the account. use after confirming the account id. example: create list(account id="<id>", kind="ip", name="blocklist")
Why this helps
During an incident, creating the right empty list is a small task that can still delay the response owner.
- Start a response playbook from your existing incident signal
- Use a named account and list policy
- Leave a clear audit trail for the responder
Setup
Build it in a few focused steps.
- 1Connect Cloudflare in Notis once.
- 2Create an automation for the incident webhook.
- 3Tell Notis to create an empty WAF list only when the webhook matches your approved incident policy.
- 4Choose a webhook trigger and provide its endpoint to the sender.
- 5Choose a report channel and test with one safe incident example.
Questions about this workflow
Does this add IPs to the list?
No. The allowed action creates an empty list; item population needs a separate supported workflow.
Can any webhook create a list?
Your prompt should restrict creation to approved incident types and accounts.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Zoom to Cloudflare. A trigger fires from one place; an action lands in another.
Zoom triggers
Cloudflare actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Create DNS record
Tool to create a new dns record within a specific zone. use after obtaining the zone id to programmatically add dns entries.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Create WAF List
Tool to create a new empty waf list for the account. use after confirming the account id. example: create list(account id="<id>", kind="ip", name="blocklist")
Daily Usage Report Changed
Triggers when the Zoom daily usage report changes for a selected year/month. This trigger monitors daily usage statistics including: - New users added - Number of meetings held - Participant counts - Meeting minutes consumed
Create Zone
Tool to create a new zone. use after confirming account id when adding a domain to cloudflare.
Meeting Details Changed
Triggers when a specific meeting's details change. Detects changes such as: - Meeting topic changes - Agenda updates - Schedule changes (timezone, duration) - Settings modifications (waiting room, recording, video, etc.) - Password changes - Recurrence pattern updates
Delete DNS Record
Tool to delete a dns record within a specific zone. use after confirming zone and record ids. example: "delete dns record 372e6795... from zone 023e105f4ecef..."
Meeting Recording Changed
Triggers when a specific meeting's cloud recordings change. Detects changes such as: - New recording files appearing - Recording processing completion (status changes) - Recording metadata changes (count, size, etc.) - New participant audio files
Delete WAF List
Tool to delete a waf list. use when you need to remove a list after verifying no filters reference it. example: delete list(account id="<account id>", list id="<list id>")
Meeting Summary Created or Updated
Triggers when a meeting summary is created or updated for a specific meeting. IMPORTANT: This trigger requires a PAID Zoom account (Pro, Business, or Enterprise plan). Free Zoom accounts cannot use this feature. Additionally requires: - AI Companion feature enabled in account settings - Meeting must not be end-to-end encrypted (E2EE) - Meeting summary must be enabled and generated for the meeting
Delete Zone
Tool to delete a zone. use after confirming the zone identifier to permanently remove a dns zone from your cloudflare account. example: delete zone(zone identifier="023e105f4ecef8ad9ca31a8372d0c353")
New Cloud Recording
Triggers when a new cloud recording meeting instance appears for a user.
List WAF Lists
Tool to fetch all waf lists (no items) for an account. use after confirming account id.
New Meeting Created
Triggers when a new Zoom meeting is created for a user.
List Account Members
Tool to list members of a given cloudflare account. use after confirming the account id.
Connect any two apps with Notis in the middle.
Zoom and Cloudflare, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Cloudflare.