You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/page-shield/best-practices/handle-an-alert.mdx
+24-7Lines changed: 24 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ description: >-
9
9
If you receive a client-side resource alert, sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
If you receive a [client-side resource alert](/page-shield/alerts/alert-types/), sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
15
15
@@ -19,15 +19,32 @@ Start by identifying the [detection system](/page-shield/how-it-works/malicious-
19
19
20
20
<Steps>
21
21
22
-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
23
-
2. Navigate to the client-side resource monitoring page:
24
-
- Old dashboard: Go to **Security** > **Page Shield**.
25
-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
26
-
3. Select **Scripts** or **Connections** and search for the resource mentioned on the alert you received.
27
-
4. Select **Details** next to the resource you identified. The example screenshot below shows a malicious script resource.
Once you [activate Page Shield's client-side resource monitoring](/page-shield/get-started/), the main client-side resources dashboard will show which resources (scripts and connections) are running on your domain, as well as the cookies recently detected in HTTP traffic.
11
18
@@ -26,13 +33,24 @@ To review the resources detected by Cloudflare:
26
33
27
34
<Steps>
28
35
29
-
1.Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
36
+
1.Go to the client-side resources page:
30
37
31
-
2. Go to the client-side resources page:
32
-
- Old dashboard: Go to **Security** > **Page Shield**.
33
-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
3. Review the list of scripts, connections, and cookies for your domain, depending on your plan. To apply a filter, select **Add filter** and use one or more of the available options.
40
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
2. Review the list of scripts, connections, and cookies for your domain, depending on your plan. To apply a filter, select **Add filter** and use one or more of the available options.
36
54
37
55
<details>
38
56
<summary>Available filters</summary>
@@ -47,7 +65,7 @@ To review the resources detected by Cloudflare:
47
65
48
66
</details>
49
67
50
-
4. Depending on your plan, you may be able to [view the details of each item](#view-details).
68
+
3. Depending on your plan, you may be able to [view the details of each item](#view-details).
51
69
52
70
</Steps>
53
71
@@ -59,14 +77,30 @@ The All Reported Connections and All Reported Scripts dashboards show all the de
59
77
60
78
<Steps>
61
79
62
-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
63
-
2. Go to the client-side resources page:
64
-
- Old dashboard: Go to **Security** > **Page Shield**.
65
-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
3. Select **Details** for each script considered malicious. The script details will contain:
34
47
-**Malicious code analysis**: Scores between 1-99 classifying how malicious the current script version is, where 1 means definitely malicious and 99 means definitely not malicious.
35
48
-**Code behavior analysis**: Scores classifying the behavior of the current script version in terms of code obfuscation and data exfiltration. The scores vary between 1-99, where 1 means definitely malicious and 99 means definitely not malicious.
36
49
-**Threat intelligence**: Whether the script URL and/or domain is known to be malicious according to threat intelligence feeds. If the script is considered malicious according to the feeds, the dashboard will show a list of associated threat [categories](/page-shield/how-it-works/malicious-script-detection/#malicious-script-and-connection-categories). If threat intelligence feeds do not have any information about the script URL or domain, the dashboard will show **Not present**.
@@ -41,7 +54,9 @@ To review the scripts considered malicious:
41
54
42
55
For more information, refer to [Malicious script and connection detection](/page-shield/how-it-works/malicious-script-detection/).
43
56
44
-
5. Based on the displayed information, and with the help of the [last seen/first seen fields in the script details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious script was detected.
57
+
4. Based on the displayed information, and with the help of the [last seen/first seen fields in the script details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious script was detected.
58
+
59
+
{/* prettier-ignore-end */}
45
60
46
61
</Steps>
47
62
@@ -53,21 +68,36 @@ To review the connections considered malicious:
53
68
54
69
<Steps>
55
70
56
-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
71
+
{/* prettier-ignore-start */}
57
72
58
-
2. Go to the client-side resources page:
59
-
- Old dashboard: Go to **Security** > **Page Shield**.
60
-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
3. Select **Details** for each connection considered malicious. The connection details will contain:
65
93
-**URL match**: Whether the connection's target URL is known to be malicious according to threat intelligence feeds. This field requires that you configure Page Shield to analyze the [full URI](/page-shield/reference/settings/#connection-target-details) of outgoing connections.
66
94
-**Domain match**: Whether the connection's target domain is known to be malicious according to threat intelligence feeds.
67
95
-**Category**: The categorization of the connection considered malicious according to threat intelligence feeds.
68
96
69
97
For more information, refer to [Malicious script and connection detection](/page-shield/how-it-works/malicious-script-detection/).
70
98
71
-
5. Based on the displayed information, and with the help of the [last seen/first seen fields in the connection details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious connection was detected.
99
+
4. Based on the displayed information, and with the help of the [last seen/first seen fields in the connection details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious connection was detected.
0 commit comments