> ## Content Index
> Fetch the complete content index at: https://www.diogomoleta.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# The SecOps / Incident Response Angle
- URL: https://www.diogomoleta.com/the-secops-incident-response-angle/
- Published: 2026-09-25T11:45:24.000Z
- Updated: 2026-09-25T14:02:26.000Z
- Author: Diogo Moleta

## Introduction

Modern application security starts at the edge—long before a request ever reaches an origin server. As threat actors automate reconnaissance, brute-force attempts, and Layer 7 DDoS attacks, security operations teams must rely on perimeter controls to inspect, filter, and mitigate malicious traffic at scale.

To gain hands-on visibility into edge security mechanisms, I built a dedicated live lab environment using a custom domain (`experiement.xyz`) routed through Cloudflare’s global Anycast network. This article breaks down the implementation of custom WAF rules, API-driven deployments, rate-limiting strategies, and the telemetry hidden inside edge response headers.

## 1\. Architecture & DNS Setup

The core objective was to route all incoming domain traffic through an edge proxy, masking the origin server while enabling real-time packet and payload inspection.

```
[ Client / Automated Tool ] 
           │
           ▼
[ Cloudflare Global Anycast Edge ] ── (WAF / Rate Limiting Rules Evaluated)
           │
           ├── (If Malicious/Exceeds Limit) ──> Block / Managed Challenge (HTTP 403 / 429)
           │
           ▼
[ Origin Server / Unreachable Target ]

```

### Key Configuration

- **DNS Records:** A-records configured for `@` and `www` pointed to a dummy origin IP (`192.0.2.1`, RFC 5737 TEST-NET-1).
- **Proxy Status:** Enforced **Proxied** (Orange Cloud) mode across all records to ensure DNS queries resolve to Cloudflare's Anycast IPs rather than exposing raw origin infrastructure.

> **Key Takeaway:** Traffic proxied at the edge never hits the origin IP directly. Layer 3/4 filtering and Layer 7 inspection occur seamlessly across Cloudflare's edge data centers worldwide.

## 2\. Layer 7 Mitigation: Custom WAF Rules

Automated scripts and scrapers frequently rely on default user agents. To demonstrate Layer 7 mitigation, I configured a rule targeting command-line HTTP clients.

### Rule Expression

```
(http.user_agent contains "curl")

```

- **Action:** `Managed Challenge`
- **Scope:** Applied globally across all incoming HTTP/HTTPS requests to `experiement.xyz`.

### Automating Deployments via the Cloudflare Rulesets API

In an active Incident Response (IR) scenario, UI-based rule creation can be too slow. Mitigations must be deployed programmatically across multiple zones using API calls:

```
curl -X POST \
  "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/rulesets/phases/http_request_firewall_custom/entrypoint/rules" \
  -H "Authorization: Bearer ${CF_AUTH_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "rules": [
      {
        "action": "managed_challenge",
        "expression": "(http.user_agent contains \"curl\")",
        "description": "Emergency Mitigation: Block curl User-Agent"
      }
    ]
  }'

```

## 3\. Validating Mitigation & Telemetry Analysis

To test the WAF rule from a terminal, I executed an HTTP HEAD request using `curl.exe`:

```
curl.exe -I https://experiement.xyz

```

### Raw Edge Response

```
HTTP/1.1 403 Forbidden
Date: Sat, 25 Sep 2026 14:34:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Cf-Mitigated: challenge
Server: cloudflare
Server-Timing: chlray;desc="a40a6897fd18b2d1"
CF-RAY: a40a6897fd18b2d1-LIS

```

### Security Telemetry Breakdown

- **`HTTP 403 Forbidden`:** The request was intercepted and denied at the perimeter before reaching any origin server.
- **`Cf-Mitigated: challenge`:** Explicit confirmation that an active edge security rule triggered a challenge page instead of serving raw content.
- **`CF-RAY: a40a6897fd18b2d1-LIS`:** Unique request trace ID. The **`-LIS`** suffix confirms the packet was evaluated and mitigated at the **Lisbon, Portugal Point of Presence (PoP)**.

![](https://storage.ghost.io/c/fd/74/fd746f51-db13-4aa8-a0fe-1cf1f86b430b/content/images/2026/09/image-1.png)

## 4\. Rate Limiting & The Blast Radius Challenge

While hard blocking stops known malicious signatures, protecting endpoints like `/login` or `/api/v1/search` against brute-force attacks requires dynamic rate limiting.

### Lab Configuration

- **Target Path:** `http.request.uri.path eq "/"`
- **Threshold:** 3 requests per 10 seconds per Source IP (`ip.src`).
- **Action:** `Block (429 Too Many Requests)` for a duration of 10 seconds.

### The CGNAT / Shared IP Dilemma in SecOps

When designing rate-limiting policies, security teams must account for **Carrier-Grade NAT (CGNAT)** and corporate egress IPs, where hundreds of legitimate users share a single public IP.

- **Hard Blocking Risk:** Setting aggressive limits (e.g., 20 req/min with a `Block` action) can cause widespread collateral damage by locking out an entire corporate network.
- **Mitigation Strategy:** Use **Managed Challenge** instead of hard blocking as the rate-limiting action. Real human users pass a background browser check seamlessly, while automated scripts are halted instantly.

## 5\. Architectural Context: Layer 3/4 vs. Layer 7 Defense

Edge security requires a defense-in-depth approach operating across different OSI layers:

| **L**       | **Target Attack Vectors**                     | **Primary Edge Mitigation Mechanisms**                                                                                                     |
| ----------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **L3 / L4** | SYN Floods, UDP Amplification, NTP Reflection | **BGP Anycast** (traffic absorption), **BGP Flowspec** (hardware router drops), **eBPF/XDP** (kernel-level driver drops), **SYN Cookies**. |
| **L7**      | Credential Stuffing, Scraping, HTTP Floods    | **WAF Rules**, **Rate Limiting**, **Managed Challenges (Turnstile)**, **JA4 Fingerprinting**.                                              |

By terminating TCP/TLS connections at the edge, volumetric L3/L4 floods are dropped directly in hardware or driver space, preventing OS memory exhaustion on upstream servers.

## Final Thoughts

Setting up this environment reinforced a core principle of modern SecOps: **effective security relies on actionable telemetry and rapid, programmable mitigation.** Understanding how edge proxies handle requests, evaluate rules, and append diagnostic headers allows incident response teams to diagnose attacks in real time and enforce controls at planetary scale.