# Threat Intelligence Comes Straight to Your WAF Rules!

Hey there, it's me! Today I've got a nice little security update to share with you.

## What was announced?

The [Cloudflare Changelog](https://developers.cloudflare.com/changelog/post/2026-06-15-threat-intelligence-fields/) announced that you can now reference [Cloudforce One](https://developers.cloudflare.com/security-center/cloudforce-one/) threat intelligence directly from your [WAF](https://developers.cloudflare.com/waf/) rules!

It checks the client IP of incoming requests against a threat database covering the past seven days, and exposes new fields you can use as rule conditions.

## The story so far

Cloudforce One already provided threat intelligence, but wiring that data into WAF rule conditions took extra effort. Now those checks are available as [WAF detection fields](https://developers.cloudflare.com/waf/detections/threat-intelligence/), so you can drop them straight into a rule expression.

## What changes

You can now use these fields inside your rules:

- `cf.intel.ip.datasets` — the dataset type that flagged the IP (`ddos` or `waf`)
- `cf.intel.ip.target_industries` — industries being targeted
- `cf.intel.ip.attacker_names` — associated threat actors
- `cf.intel.ip.attacker_countries` — countries where the threat activity originates
- `cf.intel.ip.target_countries` — countries being targeted

For example, a rule to block IPs tied to DDoS activity targeting France can be written with the [`any()` function](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#any) like this:

```
any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")
```

## Dive Deep

These new fields work with [custom rules](https://developers.cloudflare.com/waf/custom-rules/), [rate limiting rules](https://developers.cloudflare.com/waf/rate-limiting-rules/), the Cloudflare API, and Terraform. Matches are also logged in [Security Analytics](https://developers.cloudflare.com/waf/analytics/security-analytics/), so you can review them later.

One thing to note: you'll need an active Cloudforce One subscription to use this feature.

## Wrap-up

- New fields let you reference Cloudforce One threat intelligence directly in WAF rules
- You can match on attacker names, targeted countries, targeted industries, dataset type, and origin countries
- Works with custom rules, rate limiting rules, the API, and Terraform, and results show up in Security Analytics
- Requires a Cloudforce One subscription

If you already use Cloudforce One and want to make your WAF a little smarter, this update is a great fit for you!