WAF Attack Signature Detection Hits Early Access: Look First, Block Later!

Hi everyone, it's Shii-chan! Today's news is about a WAF feature that lets you look before you block, and I'm so excited!

Cloudflare Changelog developers.cloudflare.com

What was announced?

In the Cloudflare Changelog, Cloudflare announced that Attack Signature Detection for WAF is now in Early Access.

It evaluates requests against Cloudflare attack signatures and records matches without applying any mitigation action. That means you can investigate suspicious traffic before deciding how to respond.

Why it matters

Blocking right away can sometimes stop legitimate requests too, and that's a real worry when you tune a WAF.

If you can see what would match first, you can harden your protection step by step with less fear of false positives.

What changes

You can review what was detected and then design your mitigation yourself.

• In Security Analytics > Attack Analysis, you can review matching signature references, categories, confidence levels, and request outcomes
• You can use those fields in Security Rules
• You can combine them with request properties such as hostname, path, and HTTP method to apply scoped mitigation

For example, this makes it easier to do something like "block only high-confidence matches on this API path".

Dive Deep

Here are the key points to keep in mind.

• It uses the same signature definitions as Cloudflare Managed Rules
• It does not inherit your Managed Rules actions, overrides, or deployment configuration
• Managed Rules remain the recommended baseline protection during Early Access
• To get access, contact your Cloudflare account team

So it isn't a replacement for Managed Rules. It's an investigation and tuning tool that you use alongside them.

Wrap-up

• Attack Signature Detection records attack signature matches without mitigating, and it's in Early Access
• Attack Analysis shows signature references, categories, confidence levels, and outcomes
• Security Rules let you apply scoped mitigation
• It doesn't inherit Managed Rules settings, and Managed Rules stay the recommended baseline

If you've hesitated to switch WAF rules to block because you worried about false positives, this one is for you!