Meet Scruff, Security's New AI Teammate (Custom Agent)

Notion’s security team built Scruff, a custom AI “teammate” designed to speed up alert triage without ever making the final call on whether an incident is a true positive or false positive. The core idea is to turn hand-written runbooks and security-tool context into evidence-driven investigation support—so responders can move faster between systems and ask better follow-up questions.

Scruff triggers when a new alert page is created in Notion’s alerts database. From there, it pulls the alert’s existing context—severity, event details, actor and source information, plus a linked runbook written by the detection and response team—and runs an investigation aligned to the runbook’s steps. Crucially, Scruff’s job is not to decide “this is real” or “this is noise.” Instead, it frames what evidence points toward concern versus legitimacy and surfaces targeted questions that help a human responder explore the next best leads.

A concrete example is the alert titled “AWS IM identity center manual modifications.” In Scruff’s investigation output, responders see an event timeline and supporting findings drawn from connected systems. One highlighted result: Slack search turned up no pre-announced change documentation. The workflow also supports collaboration—because the alert lives as an Ocean page in Notion, team members can add comments and context directly on the same page. In the example, a security teammate named Zach is shown as a confirmed security team member with a history of legitimate AWS IAM Identity Center administrative work, and Zach comments that the alert is a compliment—context that can shift how a responder interprets the event.

Under the hood, Scruff is configured through an instructions page that defines its identity, strengths, and operating principles. The setup emphasizes critical thinking and evidence focus: gather comprehensive context, question assumptions, and avoid making determinations about true/false positives. Scruff is also wired to multiple external security tools via MCP servers, enabling cross-system searching during triage. The transcript lists connections to Slack, CrowdStrike, Wiz, and Scanner, reflecting the practical need to correlate signals across disparate platforms.

Scruff also maintains a “memories” page that acts like a running journal of what worked and what didn’t. Each time Scruff runs, it records tuning recommendations—such as adding a suppression for a specific behavior, deduplicating an alert type, or switching to a different MCP tool next time. Over repeated runs, these memory entries reduce friction and improve future investigations, effectively learning from earlier missteps in a straightforward, operationally useful way.

For builders, the advice is to start small: don’t aim to automate everything. If the system can reliably handle one narrow triage improvement—backed by clear instructions, runbooks, and MCP servers that provide high-quality data—it can meaningfully reduce responder workload while keeping final judgment in human hands.