Blog.Cloudflare Cloudflare Enhances WAF with Real-Time Threat Intelligence Integration
Article Content
- •Cloudflare's WAF now integrates live threat intelligence for proactive traffic mitigation.
- •Users can create rules based on threat actor names, industries, and attack types.
- •The integration aims to automate blocking of known malicious IPs, enhancing security.
Cloudflare has launched a new integration for its Web Application Firewall (WAF) that allows users to create proactive mitigation rules using live threat intelligence data. This feature enables security teams to block high-risk traffic based on specific threat actor names, targeted industries, and attack types such as DDoS and cybercrime. The integration aims to automate the blocking of known malicious IP addresses, enhancing the security posture of applications without manual intervention. This capability is built on an always-on detection framework that separates detection from mitigation, ensuring continuous visibility into potential threats. The new rules can be configured in real-time, allowing organizations to respond swiftly to emerging threats. This development is particularly beneficial for organizations that have previously struggled with manual configurations to protect against known bad actors. The integration is available to Cloudforce One subscribers, enhancing their analytics with actionable threat data.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Cravenflea and RaccoonO365 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…