Attack Signature Detection populates these request fields when signatures match:
| Field | Type | Meaning |
|---|---|---|
cf.waf.signature.request.categories |
Array<String> |
Categories associated with all matching signatures. A signature can have more than one category. |
cf.waf.signature.request.confidence |
Array<String> |
Confidence values associated with matching signatures. Supported values are high and low. |
cf.waf.signature.request.refs |
Array<String> |
Refs for matching signatures, up to 10 per request. Each Ref matches the corresponding Managed Rule public Rule ID. |
All three fields are available in Security Analytics and Security Rules. You can reference them in rules created in the dashboard or through the API.
The fields can contain values like these:
| Field | Example value |
|---|---|
cf.waf.signature.request.categories |
["sqli", "cve-2025-55182"] |
cf.waf.signature.request.confidence |
["high"] |
cf.waf.signature.request.refs |
["d68f8101f6e14e25aefcaea69c530a29"] |
Use any() to test array elements:
any(cf.waf.signature.request.categories[*] eq "sqli")any(cf.waf.signature.request.confidence[*] eq "high")any(cf.waf.signature.request.refs[*] eq "d68f8101f6e14e25aefcaea69c530a29")For rollout guidance, refer to Use attack signatures in Security Rules.
Signature Refs and categories are available in Logpush:
| Rules field | Logpush field |
|---|---|
cf.waf.signature.request.refs |
wafRequestSignatureRefs |
cf.waf.signature.request.categories |
wafRequestSignatureCategories |
Only signature Ref and category mappings are available in Logpush.