NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·2h ago
Security
Cloudflare Blog·Jun 8·5 min read
Turning Cloudflare’s threat indicators into real-time WAF rules
TL;DR
Organizations face challenges in blocking high-risk traffic from specific threat actors. Cloudflare has integrated its Cloudforce One threat intelligence into its Web Application Firewall (WAF) using new cf.intel fields.
✦ Why It Matters
Engineers can leverage real-time threat intelligence to enhance their web application security strategies.
Key Takeaways
- Implement proactive WAF rules using live threat intelligence.
- Utilize specialized fields for filtering traffic based on threats.
- Leverage the always-on detection framework for continuous monitoring.
- Access detailed analytics for auditing and postmortem analysis.
How It Works
The integration allows users to create WAF rules that automatically block IPs associated with known threat actors. By using fields like cf.intel.ip.attacker_names and cf.intel.ip.target_industries, users can define complex rules that trigger based on real-time threat data.
This system operates efficiently, performing constant-time lookups to ensure that even with millions of threat indicators, latency remains negligible.