Get better visibility for the WAF with payload logging

This post introduces and details improvements to Cloudflare's WAF payload logging feature. The core contribution is the enhancement of the payload logging compiler, built on Wirefilter, to provide more precise and reduced logging. Key technical advancements include: 1. Partial evaluation of array fields (e.g., `http.request.headers.names[*]`) to log only matching elements, significantly reducing log volume. 2. Improved handling of 'partial' match operators (like 'contains', 'in', 'matches') to log only the specific matching parts of a field rather than the entire field. 3. Logging 'before' and 'after' context for partial matches to provide clearer debugging information and further reduce log volume. The post also explains the underlying Wirefilter architecture and the encryption of logs for customer privacy.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack