Cloudflare WAF war-room — Action + Rule before you skip

1. Why a 403 is five questions

Concept: Operators collapse five WAF failures into one sentence. A managed rule blocked /api/checkout. Sampled logs hid the Ray ID. The custom rule you shipped never evaluated. Someone already skipped the whole managed phase. The origin never saw the request because an IP Access Allow never reached custom rules — or a rewrite changed the path first. Those are five first clicks, not one “open WAF and disable.”

The evidence desk taught you which dashboard proves Cloudflare is working. This command center is the war-room when the edge already answered and the answer is 403 / challenge / “checkout is dead.” You isolate one transaction, name the rule, then ship the smallest skip that restores that path — not the tenant.

Hero · one Ray ID on the wall

2. Mental model — five war-room surfaces

Path: Memorise five named objects before you click. Each surface is allowed to prove one thing. Over-claiming a field is how you skip http_request_firewall_managed at 02:00 and open a false-negative ticket at 09:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open Security rules → Create rule until a diamond says so.

Path · pick the branch before the skip

4. How to choose — first tool + proof field

Do: Print this next to the dashboard. If you cannot recite the proof field, you are not ready to create an exception.

5. Runbook Side A → B → C

Side A isolates the live verdict (Events + Ray ID). Side B proves the what-if and chooses skip vs exception (Trace + Security rules). Side C confirms the forensic row and closes the ticket (Log Explorer). On a messy Sev-2, do them in this order until a field lights up.

Side A — Security Events + Ray ID (the live verdict)

1. Lock one transaction before you open WAF

   Write hostname, path, method, UTC minute, client IP (lab: 203.0.113.88), and the Ray ID from the error page or cf-ray. Official: every request through Cloudflare gets a Ray ID; it is also added toward origin as cf-ray. If you have no Ray ID and no 403 body, this is still an evidence-desk ticket first.

2. Open Security Events, not the rule editor

   Official path: in the Cloudflare dashboard go to the Analytics page for the zone, then select the Events tab. Deeplink: dash.cloudflare.com/?to=/:account/:zone/security/analytics. Enterprise also has account-level Security events. Source: Security Events — Location in the dashboard.

3. Filter, then read the columns that close a WAF ticket

   Select Add filter. Field / operator / value — no quotes, no AS prefix on ASN, no wildcards. Filter Ray ID if you have it; otherwise Host + Path + Action. Expand the Sampled log. Quote Action and the applied security feature (Managed rules, Rate limiting rules, Custom rules, Bot Fight Mode). A single HTTP request can generate more than one security event. Source: Security Events — Sampled logs; Event actions.

4. If Events is empty, do not invent a skip

   Empty Sampled logs means either nothing was actioned/flagged, sampling hid the row, or an IP Access Allow never reached WAF (those matches do not appear in Events). Narrow the duration (official sampling advice). Then jump to Side C. Source: Security Events — Sampling; Rule phase interactions.

Side B — Trace + skip vs exception (the what-if and the smallest restore)

1. If the question is “would this match?”, open Trace

   Path: account Trace · dash.cloudflare.com/?to=/:account/trace. Enter a hostname that belongs to the account, HTTP method, optional User-Agent / cookies / geolocation / Bot Score / request body. For POST/PUT/PATCH enter a Request Body. Select Send Trace. Inactive rules are not evaluated. Administrator or Super Administrator only. Source: Use Cloudflare Trace.

2. Read executed configurations in evaluation order

   Trace results show evaluated and executed configurations from Ruleset Engine products, Page Rules, and Workers. Switch Results shown to All configurations if you need the misses. Check for a URL rewrite before custom rules — official phase-interactions note: custom rules see the rewritten path. Source: Trace a request; Rule phase interactions.

3. Choose exception, not Skip all remaining

   Official false-positive path: add an exception to skip the execution of WAF managed rulesets or some of their rules. Zone path: Security rules → Create → Managed rules. Exception name + When incoming requests match + Then: Skip specific rules from a Managed Ruleset (or Skip all remaining rules — last resort). Search by description, rule ID, or tag. Deploy. Place the exception before the execute rule it is meant to skip. Source: Add an exception in the dashboard; Troubleshoot managed rules.

4. Use custom Skip only when the product is not a managed ruleset

   Path: Security rules → Create rule → Custom rules · Choose action Skip. Official options: All remaining custom rules; All rate limiting rules; All Super Bot Fight Mode rules; All managed rules; products (Zone Lockdown, User Agent Blocking, Browser Integrity Check, Hotlink Protection, Security Level, legacy rate-limit / managed). Keep Log matching requests on so the skip still appears in Events. Source: Configure a custom rule with the Skip action; Available skip options.

Side C — Log Explorer (the forensic row) + close

1. When Sampled logs are not enough, leave Events

   Official Ray ID page: all customers can look up a Ray ID in Security Events Sampled logs; sampling can hide it. Next official door is Log Explorer. Path: Log Explorer → Log Search. Deeplink: dash.cloudflare.com/?to=/:account/log-explorer/log-search. Needs the dataset enabled (Manage datasets) and Logs Read. Source: Cloudflare Ray ID; Log Search.

2. Query the Ray ID, then read Action + RuleID

   Select Dataset (http_requests or the firewall-events dataset you enabled). Add filter Field = RayID, or Custom SQL. Official example uses WHERE RayID = '…'. For the security verdict, Logpush field names on firewall_events are Action, RuleID, Source, RayID, Description, EdgeResponseStatus. Prefer date = 'YYYY-MM-DD' so the scan stays narrow. Source: Log Search; Firewall events dataset.

3. Retest the original transaction and quote the new field

   Replay the same host + path + method. Events should show Action = skip for the exception (if logging is on), or no block on that RuleID. Trace should list the exception as executed before the managed ruleset. A changed setting is not a close until that field flips.

SELECT Datetime, ClientRequestHost, ClientRequestPath,
       EdgeResponseStatus, Action, RuleID, Source, RayID, Description
FROM   firewall_events
WHERE  date = '2026-08-16'
  AND  RayID = 'a1b2c3d4e5f67891'
LIMIT  1

Zone:            checkout.example.test     (lab)
UTC window:      01:30–01:50
Events path:     Analytics → Events → Sampled logs
Quote:           Action + Service + Rule + Ray ID
If empty:        narrower window, then Log Explorer WHERE RayID
Trace path:      Account → Trace → Send Trace
Restore path:    Security rules → Create → Managed rules
                 (exception · specific rule · host+path)
Close:           same POST /api/checkout · Action != block
                 or Action = skip on that RuleID

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only. Zone checkout.example.test, client 203.0.113.88.

CFWAF-01 — Prove the verdict (Security Events)

01:42 · P1. Mobile app v3.4 checkout POSTs return 403. An hour ago someone moved Cloudflare Managed Rules / OWASP from log to block. L1 already drafted a custom rule: Skip all remaining custom rules + All managed rules for starts_with(http.request.uri.path, "/api/").

First tool: zone Analytics → Events. Filter Host = checkout.example.test, Path contains /api/checkout, last two hours. Expand the 01:41 row.

Proof field: Action = block, Service = Managed rules, Rule = 949110: Inbound Anomaly Score Exceeded, Ray ID = a1b2c3d4e5f67891. Official troubleshooting: that description is the Cloudflare OWASP Core Ruleset score-exceeded rule. The ticket is that rule + that path — not “WAF is broken.”

CFWAF-02 — Prove the Ray ID when Events is empty

01:55 · P1. Same 403. The shopper pasted a Ray ID from the block page. Events → Add filter → Ray ID returns nothing. L1 says “Cloudflare never saw it — skip the zone.”

First tool: shrink duration (Last 30 minutes, then a custom 01:35–01:50). Official sampling: a smaller timeframe displays more events. If still empty, Log Explorer → Log Search, dataset firewall_events or http_requests, Custom SQL WHERE RayID = '…'.

Proof field: one row: Action, RuleID, Source = firewallmanaged, EdgeResponseStatus = 403. That is the live request. Trace cannot substitute — Trace is a simulated what-if.

CFWAF-03 — Prove the what-if (Trace)

02:10 · P2. Yesterday you shipped a custom rule that should challenge empty-UA POSTs to /api/checkout. Events is quiet. Someone wants the expression rewritten to true.

First tool: account Trace. URL https://checkout.example.test/api/checkout, method POST, User-Agent empty, Send Trace. Official: inactive rules are not evaluated; you need Administrator / Super Administrator.

Proof field: executed configurations in order. Common misses: a URL rewrite already changed /api/checkout (custom rules see the rewritten path), or an IP Access Allow for the office NAT bypassed custom rules entirely — and Allow matches do not appear in Security Events. Official phase-interactions workflow: check rewrites, then IP Access, then whether the request was expected to stop or skip later phases, then Trace.

CFWAF-04 — Smallest restore (exception, not skip-all)

02:25 · P1. CFWAF-01’s RuleID is confirmed. Product wants checkout green in fifteen minutes. Someone still has the Skip-all-managed draft open.

First tool: Security rules → Create → Managed rules. Exception name checkout-owasp-949110-lab. When incoming requests match: http.host eq "checkout.example.test" and starts_with(http.request.uri.path, "/api/checkout"). Then: Skip specific rules from a Managed Ruleset → Cloudflare OWASP Core Ruleset → search 949110 → select that rule. Keep Log matching requests on. Deploy. Confirm the exception sits above the OWASP execute rule.

Proof field: exception listed with Action = Skip on Security rules (filter Managed Rules). Retest: Events shows skip (or no 949110 block) for a new Ray ID on the same path. Official: you can instead configure the OWASP ruleset (paranoia / score threshold) if 949110 is the score trip — still not a phase skip.

CFWAF-05 — The skip was the incident

09:10 · P1. Overnight someone shipped Skip all remaining managed rules for starts_with(http.request.uri.path, "/api/") to “keep checkout up.” SQLi probes to /api/search now reach origin. Origin logs show the payloads. Events for those probes is empty or shows skip.

First tool: Events → filter Action = skip + Path prefix /api/. Name the skip rule. Official false-negative checklist: are Managed Rules being skipped via an exception? Is attack traffic matching a custom rule skipping all Managed Rules? Adjust the exception / skip expression so it does not apply to the attack traffic.

Proof field: the skip rule’s expression and the Events skip rows. Tighten to /api/checkout (or convert to a specific-rule exception). Retest: a lab SQLi on /api/search is blocked again; checkout still skips 949110 only.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Cloudflare Docs — Security Events (Analytics → Events tab; Sampled logs; Action; sampling; firewallEventsAdaptive; Add filter)
• Cloudflare Docs — Security Analytics (all HTTP vs actioned-only; Logs → Log Explorer)
• Cloudflare Docs — Trace a request (simulated HTTP/S; Trace vs Log Explorer; Administrator / Super Administrator)
• Cloudflare Docs — Use Cloudflare Trace (dashboard /trace; Send Trace; executed configurations)
• Cloudflare Docs — Cloudflare Ray ID (Sampled logs lookup; sampling caveat; Log Explorer; uniqueness caveat)
• Cloudflare Docs — HTTP headers (cf-ray)
• Cloudflare Docs — Log Explorer
• Cloudflare Docs — Log Search (/log-explorer/log-search; WHERE RayID; date column)
• Cloudflare Docs — Firewall events dataset (Action, RuleID, Source, RayID, Description)
• Cloudflare Docs — Troubleshoot managed rules (false positive exception vs disable-one-rule; 949110 OWASP; false-negative skip checklist; HAR for Support)
• Cloudflare Docs — Create exceptions (skip remaining / ruleset / specific rules; account vs zone scope)
• Cloudflare Docs — Add an exception in the dashboard (Security rules → Create → Managed rules; Action = Skip; Deploy / Save as Draft)
• Cloudflare Docs — Configure a custom rule with the Skip action (Security rules → Create rule → Custom rules; no skip of Bot Fight Mode)
• Cloudflare Docs — Available skip options (remaining custom rules; phases; products; Log matching requests)
• Cloudflare Docs — Rule phase interactions (rewrites before custom rules; IP Access Allow; Skip ≠ Allow; recommended workflow)
• Cloudflare Docs — Actions (block, challenge, managed_challenge, skip, log; terminating vs not)
• Cloudflare Docs — Managed Rules (exceptions as skip rules in http_request_firewall_managed; place before execute)
• Cloudflare Docs — Proxy status (orange cloud; Cloudflare only mitigates proxied traffic)

Related: Cloudflare evidence desk · Cloudflare session factory · WAF skip tuning · WAF deep dive · Cloudflare WAF hub