Skip to content

Commit 26e50da

Browse files
committed
Review get started instructions
1 parent 1b222f0 commit 26e50da

File tree

1 file changed

+14
-4
lines changed

1 file changed

+14
-4
lines changed

src/content/docs/waf/detections/attack-score.mdx

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,23 @@ Cloudflare does not recommend that you block traffic solely based on the WAF Att
6767

6868
### 1. Create a custom rule
6969

70-
If you are an Enterprise customer:
70+
If you are an Enterprise customer, create a [WAF custom rule](/waf/custom-rules/create-dashboard/) that blocks requests with a **WAF Attack Score** less than or equal to 20 (recommended initial threshold). For example:
7171

72-
- Create a [WAF custom rule](/waf/custom-rules/create-dashboard/) that logs all requests with a WAF Attack Score below 40 (recommended initial threshold). For example, set the rule expression to `cf.waf.score lt 40` and the rule action to _Log_.
72+
| Field | Operator | Value |
73+
| ---------------- | --------------------- | ----- |
74+
| WAF Attack Score | less than or equal to | `20` |
7375

74-
If you are a Business customer:
76+
- Equivalent rule expression: `cf.waf.score le 20`
77+
- Action: _Block_
7578

76-
- Create a [WAF custom rule](/waf/custom-rules/create-dashboard/) matching requests with a WAF Attack Score Class of _Attack_. For example, set the rule expression to `cf.waf.score.class eq "attack"` and the rule action to a challenge action (such as _Managed Challenge_) or _Block_.
79+
Business customers must create a custom rule with the **WAF Attack Score Class** field instead. For example, use this field to block incoming requests with a score class of _Attack_:
80+
81+
| Field | Operator | Value |
82+
| ---------------------- | -------- | -------- |
83+
| WAF Attack Score Class | equals | `Attack` |
84+
85+
- Equivalent rule expression: `cf.waf.score.class eq "attack"`
86+
- Action: _Block_
7787

7888
### 2. Monitor domain traffic
7989

0 commit comments

Comments
 (0)