Skip to content

Commit 0711bb2

Browse files
authored
[Page Shield] Use DashButton for zone-level instructions (#25896)
1 parent 5bf7b75 commit 0711bb2

File tree

8 files changed

+276
-85
lines changed

8 files changed

+276
-85
lines changed

src/content/docs/page-shield/best-practices/handle-an-alert.mdx

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ description: >-
99
If you receive a client-side resource alert, sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
1010
---
1111

12-
import { Steps } from "~/components";
12+
import { Steps, Tabs, TabItem, DashButton } from "~/components";
1313

1414
If you receive a [client-side resource alert](/page-shield/alerts/alert-types/), sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
1515

@@ -19,15 +19,32 @@ Start by identifying the [detection system](/page-shield/how-it-works/malicious-
1919

2020
<Steps>
2121

22-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
23-
2. Navigate to the client-side resource monitoring page:
24-
- Old dashboard: Go to **Security** > **Page Shield**.
25-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
26-
3. Select **Scripts** or **Connections** and search for the resource mentioned on the alert you received.
27-
4. Select **Details** next to the resource you identified. The example screenshot below shows a malicious script resource.
22+
{/* prettier-ignore-start */}
23+
24+
1. Navigate to the client-side resources page:
25+
26+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
27+
28+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
29+
2. Go to **Security** > **Page Shield**.
30+
31+
</TabItem> <TabItem label="New dashboard" icon="rocket">
32+
33+
1. In the Cloudflare dashboard, go to the **Web assets** page.
34+
35+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
36+
37+
2. Select the **Client-side resources** tab.
38+
39+
</TabItem> </Tabs>
40+
41+
2. Select **Scripts** or **Connections** and search for the resource mentioned on the alert you received.
42+
3. Select **Details** next to the resource you identified. The example screenshot below shows a malicious script resource.
2843

2944
![Dialog box showing the details of a script considered malicious.](~/assets/images/page-shield/handle-alert-malicious-script-example.png)
3045

46+
{/* prettier-ignore-end */}
47+
3148
</Steps>
3249

3350
The details page will specify which detection system triggered the alert. Check the values of the following fields:

src/content/docs/page-shield/detection/monitor-connections-scripts.mdx

Lines changed: 92 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,14 @@ sidebar:
55
order: 2
66
---
77

8-
import { Render, Markdown, Steps } from "~/components";
8+
import {
9+
Render,
10+
Markdown,
11+
Steps,
12+
Tabs,
13+
TabItem,
14+
DashButton,
15+
} from "~/components";
916

1017
Once you [activate Page Shield's client-side resource monitoring](/page-shield/get-started/), the main client-side resources dashboard will show which resources (scripts and connections) are running on your domain, as well as the cookies recently detected in HTTP traffic.
1118

@@ -26,13 +33,24 @@ To review the resources detected by Cloudflare:
2633

2734
<Steps>
2835

29-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
36+
1. Go to the client-side resources page:
3037

31-
2. Go to the client-side resources page:
32-
- Old dashboard: Go to **Security** > **Page Shield**.
33-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
38+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
3439

35-
3. Review the list of scripts, connections, and cookies for your domain, depending on your plan. To apply a filter, select **Add filter** and use one or more of the available options.
40+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
41+
2. Go to **Security** > **Page Shield**.
42+
43+
</TabItem> <TabItem label="New dashboard" icon="rocket">
44+
45+
1. In the Cloudflare dashboard, go to the **Web assets** page.
46+
47+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
48+
49+
2. Select the **Client-side resources** tab.
50+
51+
</TabItem> </Tabs>
52+
53+
2. Review the list of scripts, connections, and cookies for your domain, depending on your plan. To apply a filter, select **Add filter** and use one or more of the available options.
3654

3755
<details>
3856
<summary>Available filters</summary>
@@ -47,7 +65,7 @@ To review the resources detected by Cloudflare:
4765

4866
</details>
4967

50-
4. Depending on your plan, you may be able to [view the details of each item](#view-details).
68+
3. Depending on your plan, you may be able to [view the details of each item](#view-details).
5169

5270
</Steps>
5371

@@ -59,14 +77,30 @@ The All Reported Connections and All Reported Scripts dashboards show all the de
5977

6078
<Steps>
6179

62-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
63-
2. Go to the client-side resources page:
64-
- Old dashboard: Go to **Security** > **Page Shield**.
65-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
80+
{/* prettier-ignore-start */}
81+
82+
1. Go to the client-side resources page:
83+
84+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
85+
86+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
87+
2. Go to **Security** > **Page Shield**.
6688

67-
3. Select **Scripts** or **Connections**.
68-
4. Select **View all scripts** or **View all connections**.
69-
5. Review the information displayed in the dashboard.
89+
</TabItem> <TabItem label="New dashboard" icon="rocket">
90+
91+
1. In the Cloudflare dashboard, go to the **Web assets** page.
92+
93+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
94+
95+
2. Select the **Client-side resources** tab.
96+
97+
</TabItem> </Tabs>
98+
99+
2. Select **Scripts** or **Connections**.
100+
3. Select **View all scripts** or **View all connections**.
101+
4. Review the information displayed in the dashboard.
102+
103+
{/* prettier-ignore-end */}
70104

71105
</Steps>
72106

@@ -78,19 +112,32 @@ You can filter the data in these dashboards using different criteria, and print
78112
Only available to customers on Business and Enterprise plans.
79113
:::
80114

81-
To view the details of an item:
82-
83115
<Steps>
84116

85-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
117+
{/* prettier-ignore-start */}
118+
119+
1. Go to the client-side resources page:
86120

87-
2. Go to the client-side resources page:
88-
- Old dashboard: Go to **Security** > **Page Shield**.
89-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
121+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
90122

91-
3. Select **Scripts**, **Connections**, or **Cookies** (the available options depend on your plan).
123+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
124+
2. Go to **Security** > **Page Shield**.
92125

93-
4. Next to a script, connection, or cookie in the list, select **Details**.
126+
</TabItem> <TabItem label="New dashboard" icon="rocket">
127+
128+
1. In the Cloudflare dashboard, go to the **Web assets** page.
129+
130+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
131+
132+
2. Select the **Client-side resources** tab.
133+
134+
</TabItem> </Tabs>
135+
136+
2. Select **Scripts**, **Connections**, or **Cookies** (the available options depend on your plan).
137+
138+
3. Next to a script, connection, or cookie in the list, select **Details**.
139+
140+
{/* prettier-ignore-end */}
94141

95142
</Steps>
96143

@@ -150,13 +197,29 @@ To export script, connection, or cookie information in CSV format:
150197

151198
<Steps>
152199

153-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
154-
2. Go to the client-side resources page:
155-
- Old dashboard: Go to **Security** > **Page Shield**.
156-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
200+
{/* prettier-ignore-start */}
201+
202+
1. Go to the client-side resources page:
157203

158-
3. Select **Scripts**, **Connections**, or **Cookies**.
159-
4. (Optional) Apply any filters to the displayed data.
160-
5. Select **Download CSV**.
204+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
205+
206+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
207+
2. Go to **Security** > **Page Shield**.
208+
209+
</TabItem> <TabItem label="New dashboard" icon="rocket">
210+
211+
1. In the Cloudflare dashboard, go to the **Web assets** page.
212+
213+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
214+
215+
2. Select the **Client-side resources** tab.
216+
217+
</TabItem> </Tabs>
218+
219+
2. Select **Scripts**, **Connections**, or **Cookies**.
220+
3. (Optional) Apply any filters to the displayed data.
221+
4. Select **Download CSV**.
222+
223+
{/* prettier-ignore-end */}
161224

162225
</Steps>

src/content/docs/page-shield/detection/review-changed-scripts.mdx

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ head: []
77
description: Learn how to review scripts on your domain after receiving a code change alert.
88
---
99

10-
import { Steps } from "~/components";
10+
import { Steps, Tabs, TabItem, DashButton } from "~/components";
1111

1212
:::note
1313
Available as a paid add-on for customers on an Enterprise plan.
@@ -21,11 +21,27 @@ When you receive such a notification:
2121

2222
<Steps>
2323

24-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
25-
2. Go to the client-side resources page:
26-
- Old dashboard: Go to **Security** > **Page Shield**.
27-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
24+
{/* prettier-ignore-start */}
2825

29-
3. Check the details of each changed script and validate if it is an expected change.
26+
1. Go to the client-side resources page:
27+
28+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
29+
30+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
31+
2. Go to **Security** > **Page Shield**.
32+
33+
</TabItem> <TabItem label="New dashboard" icon="rocket">
34+
35+
1. In the Cloudflare dashboard, go to the **Web assets** page.
36+
37+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
38+
39+
2. Select the **Client-side resources** tab.
40+
41+
</TabItem> </Tabs>
42+
43+
2. Check the details of each changed script and validate if it is an expected change.
44+
45+
{/* prettier-ignore-end */}
3046

3147
</Steps>

src/content/docs/page-shield/detection/review-malicious-scripts.mdx

Lines changed: 45 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ description: Learn how to review scripts and connections that Page Shield
88
considered malicious.
99
---
1010

11-
import { Render, Steps } from "~/components";
11+
import { Render, Steps, Tabs, TabItem, DashButton } from "~/components";
1212

1313
:::note
1414
Only available to Enterprise customers with a paid add-on.
@@ -22,15 +22,28 @@ To review the scripts considered malicious:
2222

2323
<Steps>
2424

25-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
25+
{/* prettier-ignore-start */}
2626

27-
2. Go to the client-side resources page:
28-
- Old dashboard: Go to **Security** > **Page Shield**.
29-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
27+
1. Go to the client-side resources page:
3028

31-
3. Select the **Scripts** tab.
29+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
3230

33-
4. Select **Details** for each script considered malicious. The script details will contain:
31+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
32+
2. Go to **Security** > **Page Shield**.
33+
34+
</TabItem> <TabItem label="New dashboard" icon="rocket">
35+
36+
1. In the Cloudflare dashboard, go to the **Web assets** page.
37+
38+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
39+
40+
2. Select the **Client-side resources** tab.
41+
42+
</TabItem> </Tabs>
43+
44+
2. Select the **Scripts** tab.
45+
46+
3. Select **Details** for each script considered malicious. The script details will contain:
3447
- **Malicious code analysis**: Scores between 1-99 classifying how malicious the current script version is, where 1 means definitely malicious and 99 means definitely not malicious.
3548
- **Code behavior analysis**: Scores classifying the behavior of the current script version in terms of code obfuscation and data exfiltration. The scores vary between 1-99, where 1 means definitely malicious and 99 means definitely not malicious.
3649
- **Threat intelligence**: Whether the script URL and/or domain is known to be malicious according to threat intelligence feeds. If the script is considered malicious according to the feeds, the dashboard will show a list of associated threat [categories](/page-shield/how-it-works/malicious-script-detection/#malicious-script-and-connection-categories). If threat intelligence feeds do not have any information about the script URL or domain, the dashboard will show **Not present**.
@@ -41,7 +54,9 @@ To review the scripts considered malicious:
4154

4255
For more information, refer to [Malicious script and connection detection](/page-shield/how-it-works/malicious-script-detection/).
4356

44-
5. Based on the displayed information, and with the help of the [last seen/first seen fields in the script details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious script was detected.
57+
4. Based on the displayed information, and with the help of the [last seen/first seen fields in the script details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious script was detected.
58+
59+
{/* prettier-ignore-end */}
4560

4661
</Steps>
4762

@@ -53,21 +68,36 @@ To review the connections considered malicious:
5368

5469
<Steps>
5570

56-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
71+
{/* prettier-ignore-start */}
5772

58-
2. Go to the client-side resources page:
59-
- Old dashboard: Go to **Security** > **Page Shield**.
60-
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
73+
1. Go to the client-side resources page:
6174

62-
3. Select **Connections**.
75+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
6376

64-
4. Select **Details** for each connection considered malicious. The connection details will contain:
77+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
78+
2. Go to **Security** > **Page Shield**.
79+
80+
</TabItem> <TabItem label="New dashboard" icon="rocket">
81+
82+
1. In the Cloudflare dashboard, go to the **Web assets** page.
83+
84+
<DashButton url="/?to=/:account/:zone/security/web-assets" />
85+
86+
2. Select the **Client-side resources** tab.
87+
88+
</TabItem> </Tabs>
89+
90+
2. Select **Connections**.
91+
92+
3. Select **Details** for each connection considered malicious. The connection details will contain:
6593
- **URL match**: Whether the connection's target URL is known to be malicious according to threat intelligence feeds. This field requires that you configure Page Shield to analyze the [full URI](/page-shield/reference/settings/#connection-target-details) of outgoing connections.
6694
- **Domain match**: Whether the connection's target domain is known to be malicious according to threat intelligence feeds.
6795
- **Category**: The categorization of the connection considered malicious according to threat intelligence feeds.
6896

6997
For more information, refer to [Malicious script and connection detection](/page-shield/how-it-works/malicious-script-detection/).
7098

71-
5. Based on the displayed information, and with the help of the [last seen/first seen fields in the connection details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious connection was detected.
99+
4. Based on the displayed information, and with the help of the [last seen/first seen fields in the connection details](/page-shield/detection/monitor-connections-scripts/#view-details), review and update the pages where the malicious connection was detected.
100+
101+
{/* prettier-ignore-end */}
72102

73103
</Steps>

0 commit comments

Comments
 (0)