Cloudflare Pushes Threat Intel Directly Into WAF Rules

Cloudflare has shipped a feature that security teams have been asking for: the ability to write WAF rules using the same threat intelligence data that powers their Threat Events dashboard. Instead of manually copying IP lists or relying on reactive blocklists, you can now write expressions like any(cf.intel.ip.attacker_names[*] == "BLACKBASTA") and have the WAF enforce it in real time.

Always-on detection, no trade-offs

The feature builds on Cloudflare's always-on detection framework, which separates detection from mitigation. That means threat intelligence runs continuously in the background, enriching request metadata without requiring pre-configured rules. The key advantage: you don't have to choose between logging and blocking. In traditional setups, blocking a request means you lose visibility into how other signatures would have assessed it. Here, you get both — visibility in Security Analytics and the ability to block when ready.

For Cloudforce One subscribers, these insights appear automatically in analytics. You can see which threat actors are hitting your site, what industries those IPs usually target, and verify traffic patterns before flipping the switch to block. The detection engine adds negligible latency, performing O(1) lookups against compressed datasets distributed to every Cloudflare data center.

New WAF fields for threat intelligence

Cloudflare exposed five new fields directly to the WAF engine:

• cf.intel.ip.attacker_names — known threat group names (e.g., CRAVENFLEA)
• cf.intel.ip.target_industries — industries targeted by the IP
• cf.intel.ip.attacker_countries — source country of the threat event
• cf.intel.ip.target_countries — countries targeted by the threat event
• cf.intel.ip.datasets — source feed (e.g., ddos, waf)

Because a single IP can be associated with multiple threat actors or industries, these fields are arrays. You use the any() function and [*] wildcard to match any value. Example: any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos") blocks known DDoS participants targeting France.

Workflow integration

The fields work in the WAF rule builder for custom rules and rate limiting, fully supported via API and Terraform. Matches are logged in Security Analytics with full context, including which rule triggered and which indicator matched. There's also a one-click export from the Threat Events dashboard: save a view (e.g., "IPs attacking the Financial sector in the last 7 days") and create a WAF rule directly.

Cloudflare says they're already working on extending this to JA3 fingerprints and domain-based matching, which would let you block traffic even when attackers rotate IPs by identifying unique software signatures or malicious destination links.

Available today for Cloudforce One subscribers (Essentials, Advantage, and Elite tiers).