Cloudflare WAF Sync

Push threat IP blocks directly to Cloudflare's global edge network to drop malicious traffic before it ever reaches your origin servers.

1. Integration Overview

While local firewalls (UFW/iptables) stop packets at your server interface, Syncing with Cloudflare WAF stops malicious requests at Cloudflare's edge data centers globally. This completely eliminates origin bandwidth consumption and CPU overhead caused by DDoS or brute force floods.

2. API Credentials Setup

To enable Cloudflare WAF Sync for a project, obtain your credentials from the Cloudflare Dashboard:

1. Go to Cloudflare Dashboard > Zone Overview and copy your Zone ID.
2. Navigate to My Profile > API Tokens and create a token with Zone - Firewall Services - Edit permissions.
3. In Sprint Log Parser, visit your Project Settings and enter your **Zone ID** and **API Token**.

3. Action Modes & Synchronization

When Sprint Log Parser detects a verified threat, it sends a REST API payload to Cloudflare's Firewall Access Rules endpoint (`/client/v4/zones/{zone_id}/firewall/access_rules/rules`):

POST https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/access_rules/rules
Authorization: Bearer YOUR_CLOUDFLARE_API_TOKEN
Content-Type: application/json

{
  "mode": "block",
  "configuration": {
    "target": "ip",
    "value": "ATTACKER_IP"
  },
  "notes": "Automated block by Sprint Log Parser (SQLi detected)"
}