Skip to content

cloudflare-managed-ruleset.mdx

Latest commit

 

History

History
247 lines (183 loc) · 8.67 KB

cloudflare-managed-ruleset.mdx

File metadata and controls

247 lines (183 loc) · 8.67 KB
Raw
pcx_content_type configuration
description Rules and categories in the Cloudflare Managed Ruleset.
products
waf
title Cloudflare Managed Ruleset
sidebar
order
2

import { Details, Markdown, Render, Tabs, TabItem } from "~/components";

export const availableActions = "The available actions are: Block, Log, Non-Interactive Challenge, Managed Challenge, and Interactive Challenge.";

Created by the Cloudflare security team, this ruleset provides fast and effective protection for all of your applications. The ruleset is updated frequently to cover new vulnerabilities and reduce false positives.

Cloudflare recommends that you enable the rules whose tags correspond to your technology stack. For example, if you use WordPress, enable the rules tagged with wordpress.

Cloudflare's WAF changelog allows you to monitor ongoing changes to the WAF's managed rulesets.

:::note

Some rules in the Cloudflare Managed Ruleset are disabled by default, intending to strike a balance between providing the right protection and reducing the number of false positives.

It is not recommended that you enable all the available rules using overrides, since it may affect legitimate traffic, unless you are running a proof of concept (PoC) to understand what kind of requests the WAF can block.

:::

Deploy the Cloudflare Managed Ruleset {/* deploy-in-the-dashboard */}

<Render file="dash-deploy-managed-ruleset-zone" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", dashOptionName: "Cloudflare managed ruleset", }} />

Configure in the dashboard

You can configure (or override) the Cloudflare Managed Ruleset, overriding its default configuration, at several levels:

When you create several overrides at different levels, more specific configurations (tag and rule level) have priority over less specific configurations (ruleset level). Refer to Override a managed ruleset in the Ruleset Engine documentation for more information.

Ruleset-level configuration

You can configure (or override) the following Cloudflare Managed Ruleset settings in the Cloudflare dashboard:

  • Scope: When you define a custom filter expression for the scope, the Cloudflare Managed Ruleset applies only to a subset of the incoming requests. By default, a managed ruleset deployed in the dashboard applies to all incoming traffic.

  • Ruleset action: When you define an action for the ruleset, you override the default action defined for each rule. To remove the action override at the ruleset level, set the ruleset action to Default.

  • Ruleset status: Enables or disables all the rules in the ruleset.

    :::note When you enable all the rules in the ruleset, you will affect rules that are disabled by default and all the rules that are added to the managed ruleset in the future. :::

  • Payload logging: When enabled, logs the request information (payload) that triggered a specific rule of the managed ruleset. You must configure a public key to encrypt the payload.

Once you have deployed the Cloudflare Managed Ruleset, do the following to configure it in the dashboard:

<Render file="dash-configure-all-rules" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", }} />

Tag-level configuration

You can configure (or override) the following Cloudflare Managed Ruleset settings in the dashboard for rules tagged with at least one of the selected tags:

  • Rule action: Sets the rule action for all the rules with the selected tags.

  • Rule status: Sets the rule status for all the rules with the selected tags.

:::note Setting any of these configurations for specific tags affects all current and future rules with the tags you selected. :::

Once you have deployed the Cloudflare Managed Ruleset, do the following to configure rules with specific tags in the dashboard:

<Render file="dash-configure-rules-by-tag" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", }} />

Rule-level configuration

You can configure (or override) the following Cloudflare Managed Ruleset settings in the dashboard for the selected rules:

  • Rule action: Sets the action of a single rule or, if you select multiple rules, for the selected rules. Once you have changed the configuration of a rule, you have the option to reset the configuration back to the default one as defined in the Cloudflare Managed Ruleset.

  • Rule status: Sets the status (enabled or disabled) of a single rule or, if you select multiple rules, for the selected rules.

Once you have deployed the Cloudflare Managed Ruleset, do the following to configure individual ruleset rules in the dashboard:

<Render file="managed-rules-browse-zone-new-nav" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", }} />

<Render file="managed-ruleset-configure-individual-rules" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", }} />

<Render file="managed-rules-browse-zone" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", }} />

<Render file="managed-ruleset-configure-individual-rules" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", }} />

Configure via API

To deploy the Cloudflare Managed Ruleset for a given zone via API, create a rule with execute action in the entry point ruleset for the http_request_firewall_managed phase.

Example

<Render file="managed-rulesets/api-next-steps" product="waf" params={{ rulesetName: "Cloudflare Managed Ruleset", customizableAction: true, }} />

Configure using Terraform

The following example deploys the Cloudflare Managed Ruleset for a zone and overrides the action and status of a specific rule.

Details

At least one of the following token permissions is required:

  • Zone WAF Write

Configure the cloudflare_ruleset resource:

# Configure a ruleset at the zone level for the "http_request_firewall_managed" phase
resource "cloudflare_ruleset" "zone_level_managed_waf" {
  zone_id     = var.cloudflare_zone_id
  name        = "Managed WAF entry point ruleset"
  description = "Zone-level WAF Managed Rules config"
  kind        = "zone"
  phase       = "http_request_firewall_managed"

  # Execute Cloudflare Managed Ruleset
  rules = [{
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      overrides = {
        rules = [{
          id      = "5de7edfa648c4d6891dc3e7f84534ffa"
          action  = "log"
          enabled = true
        }]
      }
    }
  }]
}
# Configure a ruleset at the zone level for the "http_request_firewall_managed" phase
resource "cloudflare_ruleset" "zone_level_managed_waf" {
  zone_id     = var.cloudflare_zone_id
  name        = "Managed WAF entry point ruleset"
  description = "Zone-level WAF Managed Rules config"
  kind        = "zone"
  phase       = "http_request_firewall_managed"

  # Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      overrides {
        rules {
          id      = "5de7edfa648c4d6891dc3e7f84534ffa"
          action  = "log"
          enabled = true
        }
      }
    }
  }
}

For more information, refer to WAF Managed Rules configuration using Terraform.