WAF - Use Cloudforce One threat intelligence in WAF rules

<p>You can now match incoming requests against Cloudforce One threat intelligence in your WAF rules. A new detection looks up the client IP address of each request against the threat intelligence database. If the IP was involved in threat activity in the past seven days, Cloudflare populates <code>cf.intel.ip.*</code> fields that you can use in <a href="https://developers.cloudflare.com/waf/custom-rules/">custom rules</a> and <a href="https://developers.cloudflare.com/waf/rate-limiting-rules/">rate limiting rules</a>.</p> <p>The detection populates the following fields. Use the <a href="https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#any"><code>any()</code></a> function with the <code>[*]</code> wildcard to match array values:</p> <ul> <li><code>cf.intel.ip.datasets</code> — the dataset that flagged the IP address (<code>ddos</code> or <code>waf</code>).</li> <li><code>cf.intel.ip.target_industries</code> — industries the IP address has targeted.</li> <li><code>cf.intel.ip.attacker_names</code> — known threat actors associated with the IP address.</li> <li><code>cf.intel.ip.attacker_countries</code> — source countries of the threat activity.</li> <li><code>cf.intel.ip.target_countries</code> — countries the IP address has targeted.</li> </ul> <p>For example, the following custom rule expression blocks requests from IP addresses associated with DDoS activity that have targeted France:</p> <figure class="nb-code-figure" data-nb-lang="txt"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="txt" data-nb-lang="txt"><code><span class="line"><span class="nb-shiki-wvjl67">any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")</span></span></code></pre></figure> <p>These fields work with the Cloudflare API and Terraform. Matches are logged in <a href="https://developers.cloudflare.com/waf/analytics/security-analytics/">Security Analytics</a>.</p> <p>The threat intelligence detection is available to customers with an active <a href="https://developers.cloudflare.com/security-center/cloudforce-one/">Cloudforce One</a> subscription. For more information, refer to <a href="https://developers.cloudflare.com/waf/detections/threat-intelligence/">Threat intelligence</a>.</p>