Turning Cloudflare’s threat indicators into real-time WAF rules (opens in new tab)
Cloudflare now lets security teams turn live Threat Events intelligence into proactive WAF rules. Instead of manually blocking known malicious IPs, organizations can filter traffic by threat actor, targeted industry or country, attack type, and recency. The integration separates always-on detection from mitigation, allowing teams to validate intelligence before enforcing blocks without sacrificing visibility. ## Always-on Threat Detection - The system builds on Cloudflare’s always-on Attack Signature Detection framework. - Threat intelligence runs continuously in the background and enriches HTTP requests with metadata before a WAF action is taken. - This removes the traditional “log versus block” trade-off: teams can observe detections in analytics and later create blocking rules. - Cloudforce One subscribers can review threat actors, targeted industries, and traffic patterns before enabling mitigation. - Detection is designed to add negligible latency. - The initial release supports IP-based matching, with planned support for JA3 fingerprints and domain-based indicators to identify attackers who rotate IP addresses. ## New WAF Intelligence Fields Cloudflare exposes threat context through fields that can be used in WAF custom rules and rate-limiting policies: - `cf.intel.ip.attacker_names`: Known threat groups, such as `CRAVENFLEA`. - `cf.intel.ip.target_industries`: Industries previously targeted by the IP. - `cf.intel.ip.attacker_countries`: Countries associated with the threat event. - `cf.intel.ip.target_countries`: Countries targeted by the event. - `cf.intel.ip.datasets`: Intelligence sources or attack categories, such as `ddos` and `waf`. Because an IP may have multiple associated actors, industries, or datasets, these values are arrays. Rules use `any()` with the `[*]` wildcard to match individual values. ## Example WAF Rules - Block IPs involved in DDoS activity against France: ```text any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos") ``` - Block BLACKBASTA-associated traffic targeting banking and financial services: ```text any(cf.intel.ip.target_industries[*] == "Banking & Financial Services") and any(cf.intel.ip.attacker_names[*] == "BLACKBASTA") ``` - Apply broad protection against traffic originating from Iran: ```text any(cf.intel.ip.attacker_countries[*] == "IR") ``` ## Deployment Through Existing Workflows - The fields are available in the WAF rule builder for custom rules and rate limiting. - Teams can configure them through the Cloudflare API or Terraform. - Rules can be automated across individual domains or an entire account. - Security Analytics records matches, including the triggered rule and the specific intelligence indicator involved. - Threat Events users can create Saved Views—such as IPs targeting the financial sector within the last seven days—and convert them into WAF rules with one click. ## Global Distribution and Performance - Cloudflare compresses threat intelligence datasets into a high-performance format. - The data is distributed to Cloudflare data centers worldwide. - The WAF can therefore evaluate threat indicators at the edge without requiring local IP lists or introducing significant request latency. - The post begins to describe this lookup process as O(1), but the provided content ends before explaining the implementation in detail. Cloudflare’s integration gives teams a practical path from threat intelligence to enforcement: investigate indicators, validate them in analytics, and deploy precise WAF or rate-limiting rules through the UI, API, or Terraform. Teams should use the always-on visibility to tune criteria before blocking, while preparing for future indicators such as JA3 fingerprints and malicious domains.