Configure Cloudflare WAF for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform network-based response actions in your network using Cloudflare WAF®.

Cloudflare WAF supports these response actions:
  • Add/Remove IP from denylist

For more information, see Response action descriptions.

These resources are required:

  • A user with Super Administrator permissions for the Cloudflare WAF account.

  • Contact your CST to validate the Active Response integration. Have an IP address ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create an account API token for Cloudflare WAF Active Response

  1. Sign in to the Cloudflare Dashboard.
  2. In the navigation menu, select the account to configure for Active Response from the drop-down list.
  3. In the navigation menu, click Manage Account > Account API Tokens.
  4. Click Create Token.
  5. In the Token name field, enter a unique and descriptive name.

    For example: Arctic Wolf Active Response token

  6. In the Permission policies section, click Start from scratch.
    1. In Edit Policy, select Entire Account from the drop-down list.
    2. In the search for permission groups field, search Account Rule Lists.
    3. In Rules & Configuration > Account Rule Lists, select Read and Edit.
  7. Set Token Expiration to No expiration.
  8. Optional: To restrict API calls to Arctic Wolf IP addresses, in the Client IP Address Filtering section, add the IP addresses found in the Arctic Wolf Unified Portal under Settings > Allowlist Requirements.
  9. Click Review Token, and then review the token details.
  10. Click Create Token.
  11. Copy the Account ID and API Token, and then save them in a safe, encrypted location.
    Note: Cloudflare displays the API token only once.

Create a custom IP deny list in Cloudflare WAF

  1. Sign in to the Cloudflare Dashboard.
  2. In the navigation menu, select the account used in Create an account API token for Cloudflare WAF Active Response.
  3. In the navigation menu, click Manage Account > Configurations.
  4. Click the Lists tab.
  5. Perform one of these actions:
    • If you have an existing custom IP deny list, copy the list name, and then save it in a safe, encrypted location. You will provide this value to Arctic Wolf later.
    • If you do not have a custom IP deny list, complete these steps:
      1. Click Create IP List.
      2. In the Identifier field, enter a unique identifier for the list, such as deny_ip_list_awn.
      3. In the Description field, enter a meaningful description for the list, such as Custom IP deny list to be populated by Arctic Wolf Active Response action.
      4. Click Create.
      5. On the Add items to list page, click Cancel.
      6. Copy the list name, and then save it in a safe, encrypted location. You will provide this value to Arctic Wolf later.

Assign the custom IP list to a block ruleset in Cloudflare WAF

  1. Sign in to the Cloudflare Dashboard.
  2. In the navigation menu, select the account used in Create an account API token for Cloudflare WAF Active Response.
  3. In the navigation menu, click Protect & connect > Application Security > WAF.
  4. Click Create ruleset > Custom rulesets.
  5. In the Details section, configure these settings:
    • Ruleset Name — Enter a unique and descriptive ruleset name. For example: Arctic Wolf Active Response Block Ruleset
    • Description — Enter a meaningful description.
  6. In the Scope section, select All incoming requests.
  7. Click Add rule.
  8. On the Create Rules page, configure these settings:
    • Rule name — Enter a unique and descriptive rule name. For example: Arctic Wolf Active Response Block Rule
    • In the When incoming requests match… section:
    • In the Then take action… section:
      • Choose action — Select Block.
      • With response type — Select Default Cloudflare WAF block page.
    • In the Status section, select Active.
  9. Click Deploy.
  10. In the Deploy rule to production? confirmation dialog, click Deploy.
  11. On the Create custom ruleset page, click Deploy.

Provide Cloudflare WAF Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click Cloudflare WAF.
  5. On the New Active Response Integration page, configure these settings:
  6. Click Save Integration.