Cloudflare Bridges Threat Intel and WAF with Live Indicator Rules

Cloudflare’s Threat Events platform delivers a real-time view of the global attack landscape, but turning that raw data into direct, automated mitigation has always been a cumbersome, manual process. Security teams could see which IP addresses were connected to known threat actors or were targeting specific industries, yet adding those indicators to their own WAF policies typically meant hand-coding rules based on static lists.

A new integration announced today changes that by connecting threat intelligence directly to the WAF engine. Administrators can now write proactive rules that evaluate traffic against live global threat data, letting them screen requests based on who is attacking, who is being targeted, and what kind of attack is underway — all before an attacker reaches their application.

Always-On Detection Framework

This capability rides on the same always-on detection architecture behind Cloudflare’s Attack Signature Detection. That framework splits detection from mitigation, ensuring threat intelligence is continuously enriching request analytics with threat metadata, even when no take-action rule is configured.

The design eliminates a longstanding "log vs. block" trade-off. When a rule blocks traffic, you typically lose visibility into how other signatures would have evaluated that same request. Under the always-on model, that context is preserved. For Cloudforce One subscribers, analytics automatically show which threat actors are probing a site and which industries their originating IPs typically target, providing a window to verify patterns before shifting into full block mode.

These detections run with negligible latency. The initial release keys on IP-based matching, with plans to expand toward JA3 fingerprints and domain-based matching — a move aimed at catching attackers who rotate IPs but leave identifiable software signatures or malicious destination links in their payloads.

New WAF Fields and Rule Expressions

To support this, the WAF now exposes structured threat-intelligence fields on incoming requests. Because a single IP may map to multiple threat actors or targeted sectors, the fields are arrays. Matching uses the any() function with the [*] wildcard to distinguish whether any element in the threat profile matches a condition.

Example expressions demonstrate the range of filtering capability:

  • Block DDoS participants attacking a region: any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")
  • Target known actors hitting finance: any(cf.intel.ip.target_industries[*] == "Banking & Financial Services") and any(cf.intel.ip.attacker_names[*] == "BLACKBASTA")
  • Broad controls on high-risk origins: any(cf.intel.ip.attacker_countries[*] == "IR")

Integration Points for Deployment

The cf.intel fields are available across the WAF rule builder for both custom rules and rate-limited rules, and they work with the standard Cloudflare API and Terraform schemes. That means existing infrastructure-as-code processes remain intact for automating policies across domains or an entire account.

Visibility in Security Analytics

Matches on these threat-intel fields are logged in Security Analytics, allowing deep inspection of which rule fired and which indicator matched. Those enriched logs are intended to assist auditing and post-incident review, and provide a click-through pathway from a specific logged match directly to creating a corresponding custom rule.

Workflow Shortcuts in the Threat Dashboard

For teams working in the Threat Intelligence Dashboard, there is no longer a need to copy and paste IP lists. Saved Views — such as "IPs seen attacking the Financial sector in the last seven days" — can be exported in a single click as a configured WAF rule, bridging investigation and response.

Global Distribution for Constant-Time Lookups

A WAF engine processing millions of indicators could easily choke on lookup latency. Cloudflare avoids that by compressing threat-intelligence datasets into a high-performance format replicated to every data center globally. Each request entry triggers an O(1) constant-time lookup against local datasets — meaning performance hits stay in the microseconds whether policy checks against ten indicators or ten million.

Critically, the engine does not stop at the first match. It evaluates the entire set of signals attached to an IP in a single pass, so a rule requesting "Attacker = RU AND Target Industry = Banking" correctly triggers based on the intersection of those attributes without degrading to iterative lookups.

Availability

The feature is live today for customers with any active Cloudforce One subscription:

  • Essentials covers default Threat Events datasets, indicator search, and threat-hunting investigations.
  • Advantage adds access to analyst-curated threat intelligence via requests for information.
  • Elite adds brand protection, more RFI capacity, and full access to Threat Events datasets.

Rules using live threat intelligence can be built directly from Threat Events in the Security Center or through the WAF section of the Cloudflare Dashboard.