[WAF] Add threat intelligence detection docs#31205
Conversation
New section at /waf/detections/threat-intelligence/ with four pages: overview (concept), get started, available fields (reference), and example rules (configuration). Requires active Cloudforce One subscription. Fields match on client IP address against a seven-day threat intelligence database.
Review✅ No style-guide issues found in commit CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
ask-bonk
Bot
added
content:new
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
|
Reviewed PR #31205 and posted two inline comments. Labels applied: Issues found:
The frontmatter, component imports, link formatting, and structure are otherwise consistent with existing WAF detection docs. |
- Remove 'Today,' from index.mdx intro per style guide - Replace raw PUT curl (which replaces all rules) with a link to 'Create a custom rule via API' plus the expression example, matching the pattern used by sibling detection get-started pages
2 participants
Summary
New documentation section at
/waf/detections/threat-intelligence/for the threat intelligence WAF detection (SHIP-11629). Four pages:index.mdx) — what the detection does, data freshness (seven-day window), availability (Cloudforce One subscription)get-started.mdx) — create a rule in Log mode, review matches in Security Analytics, switch to Block/Challenge, optional Saved Views exportfields.mdx) — fivecf.intel.ip.*fields, case sensitivity, union/flattened matching behavior, analytics gap (rule fields vs logged fields)example-rules.mdx) — six recipes covering Log, Block, Challenge, rate limiting, and combining with attack scoreDocumentation checklist