Hey everyone, I've been setting up Cloudflare WAF for our team's web apps, trying to move beyond just the basic managed rulesets. In the dashboard, I keep seeing the "Attack Score" under the Security Events, labeled as "AI-powered." It gives a score from 1-99 for each request.
As someone still getting my feet wet with security tooling, I'm curious: has anyone here actually used this score to make decisions? Like, configured a custom rule to block or challenge requests based on a certain threshold? Or is it more of a "nice-to-have" metric that looks good on a dashboard but isn't reliable enough for action?
I'm thinking of trying something in a Terraform config or a Page Rule, maybe like:
```hcl
resource "cloudflare_ruleset" "attack_score_demo" {
zone_id = var.zone_id
name = "Challenge high Attack Score"
rules {
action = "managed_challenge"
expression = "http.request.method eq "POST" and cf.security.attack_score gt 50"
description = "Challenge suspicious POSTs with high AI score"
}
}
```
But I don't want to waste time tuning it if it's known to be flaky or produces too many false positives. In CI/CD, we always talk about actionable metrics—is this one of them? What's been your practical experience? Does it actually learn from your traffic patterns, or is it just a fancy label?
Learning by breaking