Cloudflare
Telemetry Evidence
These values show how indexed rules identify Cloudflare telemetry.Kusto
Cloudflare Panther
Cloudflare.Firewall Cloudflare.HttpRequest cloudflare
Detection Rules
Kusto #
- Cloudflare - Bad client IP source medium: 'Detects requests from IP with bad reputation index.'
T1133,T1190 - Cloudflare - Bad client IP source medium: 'Detects requests from IP with bad reputation index.'
T1133,T1190 - Cloudflare - Client request from country in blocklist source medium: 'Detects requests from countries which are in blocklist.'
T1133,T1190 - Cloudflare - Client request from country in blocklist source medium: 'Detects requests from countries which are in blocklist.'
T1133,T1190 - Cloudflare - Empty user agent source medium: 'Detects requests where user agent is empty.'
T1133,T1190 - Cloudflare - Empty user agent source medium: 'Detects requests where user agent is empty.'
T1133,T1190 - Cloudflare - Multiple error requests from single source source low: 'Detects multiple failure requests from single source in short timeframe.'
T1133,T1190 - Cloudflare - Multiple error requests from single source source low: 'Detects multiple failure requests from single source in short timeframe.'
T1133,T1190 - Cloudflare - Multiple user agents for single source source medium: 'Detects requests with different user agents from one source in short timeframe.'
T1133,T1190 - Cloudflare - Multiple user agents for single source source medium: 'Detects requests with different user agents from one source in short timeframe.'
T1133,T1190
Show 10 more
- Cloudflare - Unexpected client request source medium: 'Detects client requests to unusual client request.'
T1133,T1190 - Cloudflare - Unexpected client request source medium: 'Detects client requests to unusual client request.'
T1133,T1190 - Cloudflare - Unexpected POST requests source medium: 'Detects post requests to unusual extensions.'
T1071,T1505 - Cloudflare - Unexpected POST requests source medium: 'Detects post requests to unusual extensions.'
T1071,T1505 - Cloudflare - Unexpected URI source medium: 'Detects client requests to unusual URI.'
T1133,T1190 - Cloudflare - Unexpected URI source medium: 'Detects client requests to unusual URI.'
T1133,T1190 - Cloudflare - WAF Allowed threat source high: 'Detects WAF "Allowed" action on threat events.'
T1133,T1190 - Cloudflare - WAF Allowed threat source high: 'Detects WAF "Allowed" action on threat events.'
T1133,T1190 - Cloudflare - XSS probing pattern in request source medium: 'Detects XSS probing patterns.'
T1133,T1190 - Cloudflare - XSS probing pattern in request source medium: 'Detects XSS probing patterns.'
T1133,T1190
Panther #
- Cloudflare Bot High Volume source low: Monitors for bots making HTTP Requests at a rate higher than 2req/sec
- Cloudflare L7 DDoS source medium: Layer 7 Distributed Denial of Service (DDoS) detected
- Cloudflare React2Shell RCE Attempt Detected source high: Detects React2Shell (CVE-2025-55182) RCE attempts blocked by Cloudflare WAF
- GreyNoise V3 Malicious IP Activity source high: Detects when an IP address in any log event is classified as malicious or unknown by GreyNoise V3 internet scanner intelligence. Known business services and benign IPs are excluded.
T1595.001 - GTI/VirusTotal Threat Intelligence Indicator Match source high: Detects when an IP address, domain, or file hash in any log event matches a known malicious indicator from Google Threat Intelligence (GTI) / VirusTotal enrichment. Severity is elevated based on GTI's threat severity verdict and the number of vendors flagging the indicator as malicious.
T1595.001 - OTX Threat Intelligence Indicator Match source high: Detects when an IP address in any log event matches a known threat indicator from AlienVault OTX pulse intelligence. Severity is elevated when the pulse includes a named adversary or known malware families.
T1595.001