Threat Intelligence Comes Straight to Your WAF Rules!

Hey there, it's me! Today I've got a nice little security update to share with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog announced that you can now reference Cloudforce One threat intelligence directly from your WAF rules!

It checks the client IP of incoming requests against a threat database covering the past seven days, and exposes new fields you can use as rule conditions.

The story so far

Cloudforce One already provided threat intelligence, but wiring that data into WAF rule conditions took extra effort. Now those checks are available as WAF detection fields, so you can drop them straight into a rule expression.

What changes

You can now use these fields inside your rules:

• cf.intel.ip.datasets — the dataset type that flagged the IP (ddos or waf)
• cf.intel.ip.target_industries — industries being targeted
• cf.intel.ip.attacker_names — associated threat actors
• cf.intel.ip.attacker_countries — countries where the threat activity originates
• cf.intel.ip.target_countries — countries being targeted

For example, a rule to block IPs tied to DDoS activity targeting France can be written with the any() function like this:

any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")

Dive Deep

These new fields work with custom rules, rate limiting rules, the Cloudflare API, and Terraform. Matches are also logged in Security Analytics, so you can review them later.

One thing to note: you'll need an active Cloudforce One subscription to use this feature.

Wrap-up

• New fields let you reference Cloudforce One threat intelligence directly in WAF rules
• You can match on attacker names, targeted countries, targeted industries, dataset type, and origin countries
• Works with custom rules, rate limiting rules, the API, and Terraform, and results show up in Security Analytics
• Requires a Cloudforce One subscription

If you already use Cloudforce One and want to make your WAF a little smarter, this update is a great fit for you!