Turn Threat Events Saved Views into WAF Rules in One Click!

Hey there, it's me, Shiichan! Today I found an update that makes security operations a little easier, so let me tell you about it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, a new feature landed for Cloudforce One users. Now you can turn the malicious IP addresses you find in Threat Events straight into a WAF rule. With one click, you can generate a WAF rule that matches the dynamic list of IP addresses returned by any of your Saved Views.

The story so far

Until now, you had to manually pull the indicators out of your threat events and copy them into your firewall rules. Even after spotting a threat, there was friction before you could actually block it, and copy-paste mistakes were easy to make.

The post puts it this way:

Threat intelligence is most effective when it is immediately actionable.

What changes

Investigation and mitigation are now connected in a single click. When you spot a campaign targeting a specific industry, or a known indicator type, you can pivot straight from investigation to defense.

And you no longer have to hand-write complex, static IP rules. You can reuse the filtering logic you already defined and saved in your Threat Events views. The rule expression is generated automatically, so manual copy errors go away and the right malicious infrastructure gets blocked instantly.

Dive Deep

You can set these rules up through the dashboard UI or via the API / Terraform.

In the dashboard, go to Application Security > Threat Intelligence > Manage Views, pick the view you want, and select Create WAF Rule. That pre-populates the WAF rule builder with the matching threat event IP indicators.

To automate it, combine the WAF Rule Builder API with your Threat Events saved views endpoints, and you can script the whole workflow.

Wrap-up

• You can now generate a WAF rule in one click from your Cloudforce One Threat Events saved views
• No more manual copy-paste, and no more copy errors
• Works through both the dashboard UI and the API / Terraform
• Great for security folks who want to connect threat intelligence to everyday defense fast!