Endpoint guard

Monitor → Cloudflare → Endpoint Guard watches every endpoint for error rate, without you writing a rule per endpoint.

The problem it solves

Zone-wide error rate is nearly useless on a busy site. One endpoint returning 100% errors moves a zone-wide rate by a fraction of a percent, and the threshold that would catch it fires constantly on normal variation.

Per-endpoint rules catch it — but nobody writes and maintains four hundred rules.

How it works

1. Scans all endpoints (host + path, normalised).
2. Learns a baseline per endpoint over time.
3. Applies a threshold: fixed, or derived from the baseline.
4. Suppresses what is statistically not a signal.
5. Alerts on what survives.

Endpoints you do not care about go on an ignore list.

Learned baselines

suggest first is the right order. Look at what it proposes for a week before letting it page anybody.

Why 4xx and 5xx are split

They mean different things. A rise in 5xx is yours. A rise in 4xx is usually a client, a scanner, or a change in what people are asking for — and mixing them means a bot sweep looks like an outage.

False-positive suppression

Four mechanisms, because a per-endpoint guard that cries wolf gets switched off:

Wilson lower bound. Three errors out of four requests is not a 75% error rate; it is four requests. The alert uses the lower bound of the confidence interval, so low-volume endpoints need real evidence.

K-of-N persistence. The condition must hold in K of the last N windows. One bad window is not a trend.

Short window. A brief window keeps detection fast without letting a single sample decide.

Incident-hour exclusion. Baselines do not learn from hours that were already an incident. Otherwise every outage raises the "normal" error rate and the next one is harder to see.

SLO burn severity

Severity can be derived from how fast the endpoint is burning its error budget, rather than from the raw rate. An endpoint with budget to spare does not need to wake anybody; one burning a month's budget in an hour does.

Copilot pre-fire triage

The Copilot can be asked for a verdict before an alert fires.

Every verdict is written to an audit log with its reasoning.