Block attackers before they strike with Cloudforce One threat intel in your WAF!

Hey there, it's me, Shiichan! Today I've got a story about the security world getting a little bit smarter. Being able to block attackers by their "identity" before they even land a punch? That's pretty exciting!

Cloudflare Blog blog.cloudflare.com

What was announced?

On the Cloudflare Blog, they announced that you can now use Cloudforce One threat intelligence directly inside your WAF (Web Application Firewall) rules.

All the "this IP looks like an attacker" knowledge Cloudflare has been collecting can now be dropped straight into your own rules to block threats in real time. Five new cf.intel fields were added, and you can use them in WAF custom rules and Rate Limiting expressions.

Here are the five:

• cf.intel.ip.attacker_names — known threat group identities
• cf.intel.ip.target_industries — industries the IP has targeted before
• cf.intel.ip.attacker_countries — source country of the threat activity
• cf.intel.ip.target_countries — countries being targeted
• cf.intel.ip.datasets — data source classification (DDoS, WAF, cybercrime, and more)

The story so far

You could already see risky IPs on the Threat Events screen, but actually blocking them was a manual, reactive process. Once you noticed an attacker, you had to build a rule by hand every time, which was a bit of a chore.

What changes

Now you can protect against specific threat groups or shield industries that get targeted a lot. And you're freed from the old "log-only vs. block" trade-off: you can visualize first, and once you're confident, flip to enforcement. That flow feels natural now.

Dive Deep

The mechanism is pretty clever. This runs on an "always-on" detection framework, so even without pre-built rules, it automatically enriches HTTP requests with threat metadata.

The threat intelligence datasets are compressed into a high-performance format and distributed to every single Cloudflare data center worldwide. That means IP lookups run in O(1) (constant time) with latency down to microseconds. It also evaluates all the signals tied to one IP together in a single pass, which is nice and efficient.

Here's how the rules look. To block DDoS participants targeting France:

any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")

To protect the finance sector from BLACKBASTA:

any(cf.intel.ip.target_industries[*] == "Banking & Financial Services") and any(cf.intel.ip.attacker_names[*] == "BLACKBASTA")

You can deploy it lots of ways: WAF custom rules and Rate Limiting via API or Terraform, the UI rule builder, or one-click creation from the Threat Events dashboard. Everything you block is logged in Security Analytics.

It's available today with any active Cloudforce One subscription. The tiers are Essentials (default datasets and threat hunting), Advantage (custom analyst insights on request), and Elite (the full package with brand protection and all datasets).

Wrap-up

• Cloudforce One threat intelligence is now usable directly in WAF rules
• The five cf.intel fields let you match on threat groups, targeted industries, source/target countries, and data classification
• Always-on detection plus globally distributed compressed data gives O(1), microsecond-fast lookups
• Works with WAF custom rules / Rate Limiting / UI / one-click creation, with logging in Security Analytics
• Available today if you have an active Cloudforce One subscription

This one's for Cloudflare security folks who want to move from just "seeing" threat intel to automatically "stopping" it!