WAF, Rules - Failed detections field available in Rules

<p>You can now use <code>cf.appsec.request.failed_detections</code> to control how your rules handle requests when a security detection reports a failure.</p> <p>The field is an <code>Array&lt;String&gt;</code> of detection IDs that reports failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections for personally identifiable information (PII), prompt injection, custom topics, and unsafe topics.</p> <p>The field does not alter the existing behavior of detections. Use it in rules to choose how to handle requests with reported failures.</p> <p>When no failures are reported, the field returns <code>[]</code>. You can use it on all plans, but your plan must still include the detections and rule features you want to use.</p> <p>Supported rules:</p> <ul> <li>Custom rules at the zone and account levels</li> <li>Rate limiting rules at the zone and account levels</li> <li>Request Header Transform Rules at the zone level</li> </ul> <p>Match any reported failure:</p> <figure class="nb-code-figure" data-nb-lang="txt"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="txt" data-nb-lang="txt"><code><span class="line"><span class="nb-shiki-wvjl67">len(cf.appsec.request.failed_detections) gt 0</span></span></code></pre></figure> <p>Match a reported leaked credentials detection failure:</p> <figure class="nb-code-figure" data-nb-lang="txt"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="txt" data-nb-lang="txt"><code><span class="line"><span class="nb-shiki-wvjl67">any(cf.appsec.request.failed_detections[*] eq "waf_credential_check")</span></span></code></pre></figure> <p>For more information, refer to the <a href="https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.appsec.request.failed_detections/">Failed detections field reference</a>.</p>