--- title: Turning Cloudflare’s threat indicators into real-time... description: Cloudflare has launched a new integration that brings Cloudforce One threat intelligence directly into the WAF rule engine via new `cf.intel` fields. Security... canonical: https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Turning Cloudflare’s threat indicators into real-time WAF rules | daily.dev og:description: Cloudflare has launched a new integration that brings Cloudforce One threat intelligence directly into the WAF rule engine via new `cf.intel` fields. Security... og:url: https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d og:image: https://api.daily.dev/og/posts/bzOLPQo7d.png og:image:alt: Turning Cloudflare’s threat indicators into real-time WAF rules og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Turning Cloudflare’s threat indicators into real-time WAF rules **[Cloudflare](https://daily.dev/sources/cloudflare)** · 6 min read · 0 upvotes · 0 comments ## Summary Cloudflare has launched a new integration that brings Cloudforce One threat intelligence directly into the WAF rule engine via new `cf.intel` fields. Security teams can now write proactive WAF rules that filter traffic based on known threat actor names, targeted industries, attacker/target countries, and dataset sources. The system uses an always-on detection model with O(1) constant-time lookups against locally distributed threat datasets, adding negligible latency. Rules support array-based matching with `any()` and `[*]` wildcards, and are fully compatible with the Cloudflare API and Terraform. Matches are logged in Security Analytics, and users can export Saved Views from the Threat Intelligence Dashboard directly into WAF rules. The feature requires an active Cloudforce One subscription and currently focuses on IP-based matching, with JA3 fingerprint and domain-based matching planned. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Introducing the 2026 Cloudflare Threat Report](https://daily.dev/posts/introducing-the-2026-cloudflare-threat-report-uvb0xygap) · Cloudflare · 0 upvotes · 0 comments - [AI Security for Apps is now generally available](https://daily.dev/posts/ai-security-for-apps-is-now-generally-available-rf3xvcigf) · Cloudflare · 1 upvotes · 0 comments - [Translating risk insights into actionable protection: leveling up security posture with Cloudflare and Mastercard](https://daily.dev/posts/translating-risk-insights-into-actionable-protection-leveling-up-security-posture-with-cloudflare-a-4m2vcua5d) · Cloudflare · 0 upvotes · 0 comments - [Evolving Cloudflare’s Threat Intelligence Platform: actionable, scalable, and ETL-less](https://daily.dev/posts/evolving-cloudflare-s-threat-intelligence-platform-actionable-scalable-and-etl-less-rkwiglr22) · Cloudflare · 0 upvotes · 0 comments - [Google Threat Intelligence in Elastic Security — Elastic Security Labs](https://daily.dev/posts/google-threat-intelligence-in-elastic-security-elastic-security-labs-y7jy3yh81) · Elastic Security Labs · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Turning Cloudflare’s threat indicators into real-time WAF rules","url":"https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d"},"datePublished":"2026-06-08T15:18:14.020Z","dateModified":"2026-06-08T15:18:43.245Z","description":"Cloudflare has launched a new integration that brings Cloudforce One threat intelligence directly into the WAF rule engine via new `cf.intel` fields. Security...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/df763af7bfd251edb9e66b84fbfda698?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/df763af7bfd251edb9e66b84fbfda698?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloudflare","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Turning Cloudflare’s threat indicators into real-time WAF rules"}]} ```