Log the payload of matched rules

The WAF allows you to log the request information that triggered a specific rule of a managed ruleset. This information is known as the payload. Payload information includes the specific string that triggered the rule, along with the text that appears immediately before and after the match.

Payload logging is especially useful when diagnosing the behavior of WAF rules. Since the values that triggered a rule may contain sensitive data, they are encrypted with a customer-provided public key so that only you can examine them later.

Note

This feature is only available for customers on an Enterprise plan.

Turn on payload logging

Each managed ruleset has its own payload logging configuration. To turn on payload logging, configure a public key to encrypt the logged payload by doing one of the following:

• Generate a key pair directly in the Cloudflare dashboard
• Use your own public key

Once enabled, the WAF saves the payload of any rule matches for the managed ruleset configured with payload logging, encrypting the payload with your public key.

For more information, refer to Configure payload logging in the dashboard or Configure payload logging via API.

Important

When you generate a key pair in the dashboard, Cloudflare will only save the generated public key, not the private key. You must store your private key safely.

View payload content

To view the content of the payload in clear text, do one of the following:

• In the Security Events page (Security > Events), enter your private key to decrypt the payload of a log entry directly in the browser. Refer to View the payload content in the dashboard for details.

• Decrypt the payload in the command line using the matched-data-cli tool. Refer to Decrypt the payload content in the command line for details.

• Decrypt the matched payload in your Logpush job using a Worker before storing the logs in your SIEM system. Refer to Store decrypted matched payloads in logs for details.

Important

All Cloudflare logs are encrypted at rest. Encrypting the payload content adds a second layer of encryption for the matched values that triggered a WAF rule.

Make sure you store your private key safely. If you lose the private key, configure payload logging with a new public key. The payload of new requests will be encrypted with the new public key.

Cloudflare cannot decrypt encrypted payloads, since this operation requires your private key. Cloudflare staff will never ask for the private key.

User role requirements

Only users with the Super Administrator role can enable payload logging or edit the payload logging configuration.