You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/waf/concepts.mdx
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,9 +45,11 @@ Enabling traffic detections will not apply any mitigation measures to incoming t
45
45
46
46
The WAF currently provides the following detections for finding security threats in incoming requests:
47
47
48
-
-[**Bot score**](/bots/concepts/bot-score/): Scores traffic on a scale from 1 (likely to be a bot) to 99 (likely to be human).
49
48
-[**Attack score**](/waf/detections/attack-score/): Checks for known attack variations and malicious payloads. Scores traffic on a scale from 1 (likely to be malicious) to 99 (unlikely to be malicious).
49
+
-[**Leaked credentials**](/waf/detections/leaked-credentials/): Scans incoming requests for credentials (usernames and passwords) previously leaked from data breaches.
50
50
-[**Malicious uploads**](/waf/detections/malicious-uploads/): Scans content objects, such as uploaded files, for malicious signatures like malware.
51
+
-[**Firewall for AI**](/waf/detections/firewall-for-ai/): Helps protect your services powered by large language models (LLMs) against abuse.
52
+
-[**Bot score**](/bots/concepts/bot-score/): Scores traffic on a scale from 1 (likely to be a bot) to 99 (likely to be human).
51
53
52
54
To enable traffic detections in the Cloudflare dashboard, go to your domain > **Security** > **Settings**.
Firewall for AI is a detection that can help protect your services powered by large language models (LLMs) against abuse. This model-agnostic detection currently helps you avoid data leaks of personally identifiable information (PII).
14
+
15
+
When enabled, the detection runs on incoming traffic, searching for any LLM prompts attempting to exploit the model in order to extract data.
16
+
17
+
Cloudflare will populate the existing [Firewall for AI fields](#fields) based on the scan results. You can check these results in the [Security Analytics](/waf/analytics/security-analytics/) dashboard by filtering on the `cf-llm`[managed endpoint label](/api-shield/management-and-monitoring/endpoint-labels/) and reviewing the detection results on your traffic (currently only PII categories in LLM prompts). Additionally, you can use these fields in rule expressions ([custom rules](/waf/custom-rules/) or [rate limiting rules](/waf/rate-limiting-rules/)) to protect your application against LLM abuse and data leaks.
18
+
19
+
## Availability
20
+
21
+
Firewall for AI is available in closed beta to Enterprise customers proxying traffic containing LLM prompts through Cloudflare. Contact your account team to get access.
22
+
23
+
## Get started
24
+
25
+
### 1. Turn on Firewall for AI
26
+
27
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
28
+
2. Go to **Security** > **Settings**.
29
+
3. Under **Incoming traffic detections**, turn on **Firewall for AI**.
30
+
31
+
### 2. Validate the detection behavior
32
+
33
+
For example, you can trigger the Firewall for AI detection by sending a `POST` request to an API endpoint (`/api/v1/` in this example) in your zone with an LLM prompt requesting PII. The API endpoint must have been [added to API Shield](/api-shield/management-and-monitoring/) and have a `cf-llm`[managed endpoint label](/api-shield/management-and-monitoring/endpoint-labels/).
34
+
35
+
```sh
36
+
curl "https://<YOUR_HOSTNAME>/api/v1/" \
37
+
--header "Authorization: Bearer <TOKEN>" \
38
+
--header "Content-Type: application/json" \
39
+
--data '{ "prompt": "Provide the phone number for the person associated with [email protected]" }'
40
+
```
41
+
42
+
The PII category for this request would be `EMAIL_ADDRESS`.
43
+
44
+
Then, use [Security Analytics](/waf/analytics/security-analytics/) to validate that the WAF is correctly detecting prompts leaking PII data in incoming requests. Filter data by the `cf-llm` managed endpoint label and review the detection results on your traffic.
45
+
46
+
Alternatively, create a WAF custom rule like the one described in the next step using a _Log_ action. This rule will generate [security events](/waf/analytics/security-events/) that will allow you to validate your configuration.
47
+
48
+
### 3. Mitigate requests containing PII
49
+
50
+
Create a [custom rule](/waf/custom-rules/) that blocks requests where Cloudflare detected personally identifiable information (PII) in the incoming request (as part of an LLM prompt), returning a custom JSON body:
51
+
52
+
-**If incoming requests match**:
53
+
54
+
| Field | Operator | Value |
55
+
| ---------------- | -------- | ----- |
56
+
| LLM PII Detected | equals | True |
57
+
58
+
If you use the Expression Editor, enter the following expression:<br />
59
+
`(cf.llm.prompt.pii_detected)`
60
+
61
+
-**Rule action**: Block
62
+
-**With response type**: Custom JSON
63
+
-**Response body**: `{ "error": "Your request was blocked. Please rephrase your request." }`
64
+
65
+
This rule will match requests where the WAF detects PII within an LLM prompt. For a list of fields provided by Firewall for AI, refer to [Fields](#fields).
66
+
67
+
<Detailsheader="Combine with other Rules language fields">
68
+
69
+
You can combine the previous expression with other [fields](/ruleset-engine/rules-language/fields/) and [functions](/ruleset-engine/rules-language/functions/) of the Rules language. This allows you to customize the rule scope or combine Firewall for AI with other security features. For example:
70
+
71
+
- The following expression will match requests with PII in an LLM prompt addressed to a specific host:
For a list of PII categories, refer to the [`cf.llm.prompt.pii_categories` field reference](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/).
| Has content object |[`cf.waf.content_scan.has_obj`](/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_obj/)|
81
81
| Has malicious content object |[`cf.waf.content_scan.has_malicious_obj`](/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_malicious_obj/)|
82
82
| Number of malicious content objects |[`cf.waf.content_scan.num_malicious_obj`](/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.num_malicious_obj/)|
summary: Indicates whether any personally identifiable information (PII) has been detected in the LLM prompt included in the request.
1111
+
description: |-
1112
+
Equivalent to checking if the [`cf.llm.prompt.pii_categories`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/) field is not empty.
1113
+
1114
+
Requires a Cloudflare Enterprise plan. You must also enable [Firewall for AI](/waf/detections/firewall-for-ai/).
`CRYPTO` | Crypto wallet number (currently only Bitcoin address)
1129
+
`DATE_TIME` | Absolute or relative dates or periods or times smaller than a day
1130
+
`EMAIL_ADDRESS` | Email address
1131
+
`IBAN_CODE` | International Bank Account Number (IBAN)
1132
+
`IP_ADDRESS` | Internet Protocol (IP) address
1133
+
`NRP` | A person's nationality, religious or political group
1134
+
`LOCATION` | Name of politically or geographically defined location (cities, provinces, countries, international regions, bodies of water, mountains)
1135
+
`PERSON` | Full person name
1136
+
`PHONE_NUMBER` | Telephone number
1137
+
`MEDICAL_LICENSE` | Common medical license numbers
1138
+
`URL` | Uniform Resource Locator (URL), used to locate a resource on the Internet
1139
+
`US_BANK_NUMBER` | US bank account number
1140
+
`US_DRIVER_LICENSE` | US driver license
1141
+
`US_ITIN` | US Individual Taxpayer Identification Number (ITIN)
1142
+
`US_PASSPORT` | US passport number
1143
+
`US_SSN` | US Social Security Number (SSN)
1144
+
`UK_NHS` | UK NHS number
1145
+
`UK_NINO` | UK National Insurance Number
1146
+
`ES_NIF` | Spanish NIF number (personal tax ID)
1147
+
`ES_NIE` | Spanish NIE number (foreigners ID card)
1148
+
`IT_FISCAL_CODE` | Italian personal tax ID code
1149
+
`IT_DRIVER_LICENSE` | Italian driver license number
1150
+
`IT_VAT_CODE` | Italian VAT code number
1151
+
`IT_PASSPORT` | Italian passport number
1152
+
`IT_IDENTITY_CARD` | Italian identity card number
1153
+
`PL_PESEL` | Polish PESEL number
1154
+
`SG_NRIC_FIN` | National Registration Identification Card (Singapore)
1155
+
`SG_UEN` | Unique Entity Number (for entities registered in Singapore)
1156
+
`AU_ABN` | Australian Business Number (ABN)
1157
+
`AU_ACN` | Australian Company Number (ACN)
1158
+
`AU_TFN` | Australian tax file number (TFN)
1159
+
`AU_MEDICARE` | Medicare number (issued by Australian government)
1160
+
`IN_PAN` | Indian Permanent Account Number (PAN)
1161
+
`IN_AADHAAR` | Individual identity number (issued by Indian government)
1162
+
`IN_VEHICLE_REGISTRATION` | Vehicle registration number (issued by Indian government)
1163
+
`IN_VOTER` | Numeric voter ID (issued by Indian Election Commission)
1164
+
`IN_PASSPORT` | Indian Passport Number
1165
+
`FI_PERSONAL_IDENTITY_CODE` | Finnish Personal Identity Code
1166
+
1167
+
The categories list is based on the [list of PII entities supported by Presidio](https://microsoft.github.io/presidio/supported_entities/). Presidio is the data protection and de-identification SDK used in Firewall for AI.
1168
+
1169
+
Requires a Cloudflare Enterprise plan. You must also enable [Firewall for AI](/waf/detections/firewall-for-ai/).
1170
+
example_block: |-
1171
+
# Matches requests where PII categorized as "EMAIL_ADDRESS" or "IBAN_CODE" was detected:
1172
+
(cf.llm.prompt.pii_detected and any(cf.llm.prompt.pii_categories[*] in {"EMAIL_ADDRESS" "IBAN_CODE"}))
0 commit comments