Use attack signatures in Security Rules

Attack Signature Detection fields let Security Rules act on matching traffic. The detection fields do not apply actions by themselves.

Start with the narrowest application scope that meets your security objective. Treat low-confidence signatures as candidates for application-specific review instead of broad blocking.

You can use these fields in Security Rules created in the dashboard or through the API. For rule creation steps, refer to Create a custom rule in the dashboard or Create a custom rule via API.

This expression matches the SQL injection category:

any(cf.waf.signature.request.categories[*] eq "sqli")

Use the same array expression for another category, including a specific CVE category. Review historical matches before selecting an action.

This expression matches high-confidence signatures:

any(cf.waf.signature.request.confidence[*] eq "high")

Replace high with low to match low-confidence signatures. You can create separate rules to apply different actions to each confidence level.

This expression matches a specific signature Ref:

any(cf.waf.signature.request.refs[*] eq "d68f8101f6e14e25aefcaea69c530a29")

The Ref is the same value as the corresponding Managed Rule public Rule ID. Use this mapping to reconcile the rule with your Managed Rules configuration.

Combine a signature condition with request properties in the rule builder. Use properties such as hostname, path, and method to limit mitigation to the affected application surface.

For a known false positive, exclude the legitimate endpoint from mitigation. Keep protection for the rest of the application. Validate combined expressions in the rule builder before deployment.

Attack Signature Detection and Managed Rules have no special interaction. A Custom Rule using a detection field follows normal Custom Rules ordering.

A terminating action stops request processing at that rule. Managed Rules do not evaluate the same request. A non-terminating Log action lets processing continue to Managed Rules.

To compare the two products without changing traffic:

Verify whether Managed Rules already mitigate the traffic before adding duplicate handling. Recheck your Security Rules after application releases or major traffic changes.

For field types and Logpush mappings, refer to Attack Signature Detection fields.