Skip to content

Commit 0ab52bb

Browse files
maxvpmaxvp
committed
Add block category partials
1 parent ab07e7e commit 0ab52bb

File tree

11 files changed

+129
-112
lines changed

11 files changed

+129
-112
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx‎

Lines changed: 4 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -63,34 +63,10 @@ Block [security categories](/cloudflare-one/policies/gateway/domain-categories/#
6363

6464
The categories included in this policy are not always a security threat, but blocking them can help minimize the risk that your organization is exposed to. For more information, refer to [domain categories](/cloudflare-one/policies/gateway/domain-categories/).
6565

66-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
67-
68-
| Selector | Operator | Value | Action |
69-
| ------------------ | -------- | --------------------------------------------------------- | ------ |
70-
| Content Categories | in | _Questionable Content_, _Security Risks_, _Miscellaneous_ | Block |
71-
72-
</TabItem>
73-
74-
<TabItem label="API">
75-
76-
```bash
77-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
78-
--header "Content-Type: application/json" \
79-
--header "Authorization: Bearer <API_TOKEN>" \
80-
--data '{
81-
"name": "Block content categories",
82-
"description": "Block common content categories that may pose a risk",
83-
"enabled": true,
84-
"action": "block",
85-
"filters": [
86-
"dns"
87-
],
88-
"traffic": "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})",
89-
"identity": ""
90-
}'
91-
```
92-
93-
</TabItem> </Tabs>
66+
<Render
67+
file="gateway/policies/dash-plus-api/dns-block-content-categories"
68+
product="cloudflare-one"
69+
/>
9470

9571
## Block unauthorized applications
9672

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx‎

Lines changed: 4 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -92,35 +92,10 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
9292

9393
Block content categories which go against your organization's acceptable use policy.
9494

95-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
96-
97-
| Selector | Operator | Value | Action |
98-
| ------------------ | -------- | -------------------------- | ------ |
99-
| Content Categories | in | _Adult Themes_, _Gambling_ | Block |
100-
101-
</TabItem>
102-
103-
<TabItem label="API">
104-
105-
```bash
106-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
107-
--header "Content-Type: application/json" \
108-
--header "Authorization: Bearer <API_TOKEN>" \
109-
--data '{
110-
"name": "Block content categories",
111-
"description": "Block access to unauthorized adult and gambling applications",
112-
"enabled": true,
113-
"action": "block",
114-
"filters": [
115-
"http"
116-
],
117-
"traffic": "any(http.request.uri.content_category[*] in {2 67 125 133 99})",
118-
"identity": "",
119-
"device_posture": ""
120-
}'
121-
```
122-
123-
</TabItem> </Tabs>
95+
<Render
96+
file="gateway/policies/dash-plus-api/http-block-content-categories"
97+
product="cloudflare-one"
98+
/>
12499

125100
## Block unauthorized applications
126101

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ The Allow action allows outbound traffic to reach destinations you specify withi
8585

8686
| Selector | Operator | Value | Action |
8787
| ------------------ | -------- | ----------- | ------ |
88-
| Content Categories | in | `Education` | Allow |
88+
| Content Categories | in | _Education_ | Allow |
8989

9090
#### Untrusted certificates
9191

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,13 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users"
149149
<Details header="All-DNS-ContentCategories-Blocklist">
150150

151151
<Render
152-
file="zero-trust/blocklist-content-categories"
153-
params={{ one: "DNS", two: "Security Risks" }}
152+
file="zero-trust/content-categories-description"
153+
params={{ policyType: "DNS" }}
154+
/>
155+
156+
<Render
157+
file="gateway/policies/dash-plus-api/dns-block-content-categories"
158+
product="cloudflare-one"
154159
/>
155160

156161
</Details>

‎src/content/docs/learning-paths/secure-internet-traffic/build-http-policies/recommended-http-policies.mdx‎

Lines changed: 23 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3,86 +3,81 @@ title: Recommended HTTP policies
33
pcx_content_type: learning-unit
44
sidebar:
55
order: 5
6-
76
---
87

9-
import { Details, Render } from "~/components"
8+
import { Details, Render } from "~/components";
109

1110
We recommend you add the following HTTP policies to build an Internet and SaaS app security strategy for your organization.
1211

13-
1412
<Details header="All-HTTP-Application-InspectBypass">
1513

1614
Bypass HTTP inspection for applications that use embedded certificates. This will help avoid any certificate pinning errors that may arise from an initial rollout.
1715

18-
<Render file="gateway/policies/do-not-inspect-applications" product="cloudflare-one" />
19-
16+
<Render
17+
file="gateway/policies/do-not-inspect-applications"
18+
product="cloudflare-one"
19+
/>
2020

2121
</Details>
2222

23-
2423
<Details header="Android-HTTP-Application-InspectionBypass">
2524

2625
Bypass HTTPS inspection for Android applications (such as Google Drive) that use certificate pinning, which is incompatible with Gateway inspection.
2726

2827
| Selector | Operator | Value | Logic | Action |
2928
| ---------------------------- | -------- | --------------------------------- | ----- | -------------- |
30-
| Application | in | *Google Drive* | And | Do Not Inspect |
31-
| Passed Device Posture Checks | in | *OS Version Android (OS version)* | | |
32-
29+
| Application | in | _Google Drive_ | And | Do Not Inspect |
30+
| Passed Device Posture Checks | in | _OS Version Android (OS version)_ | | |
3331

3432
</Details>
3533

36-
3734
<Details header="All-HTTP-Domain-Inspection-Bypass">
3835

3936
Bypass HTTP inspection for a custom list of domains identified as incompatible with TLS inspection.
4037

4138
| Selector | Operator | Value | Logic | Action |
4239
| -------- | -------- | ------------------------ | ----- | -------------- |
43-
| Domain | in list | *DomainInspectionBypass* | Or | Do Not Inspect |
44-
| Domain | in list | *Known Domains* | | |
45-
40+
| Domain | in list | _DomainInspectionBypass_ | Or | Do Not Inspect |
41+
| Domain | in list | _Known Domains_ | | |
4642

4743
</Details>
4844

49-
5045
<Details header="All-HTTP-SecurityRisks-Blocklist">
5146

5247
<Render file="zero-trust/blocklist-security-categories" />
5348

5449
| Selector | Operator | Value | Action |
5550
| -------------- | -------- | -------------------- | ------ |
56-
| Security Risks | in | *All security risks* | Block |
57-
51+
| Security Risks | in | _All security risks_ | Block |
5852

5953
</Details>
6054

61-
6255
<Details header="All-HTTP-ContentCategories-Blocklist">
6356

64-
<Render file="zero-trust/blocklist-content-categories" params={{ one: "HTTP", two: "Questionable Content, Security Risks, Miscellaneous, Adult Themes, Gambling" }} />
57+
<Render
58+
file="zero-trust/content-categories-description"
59+
params={{ policyType: "HTTP" }}
60+
/>
6561

62+
<Render
63+
file="gateway/policies/dash-plus-api/http-block-content-categories"
64+
product="cloudflare-one"
65+
/>
6666

6767
</Details>
6868

69-
7069
<Details header="All-HTTP-DomainHost-Blocklist">
7170

7271
<Render file="zero-trust/blocklist-domain-host" params={{ one: "HTTP" }} />
7372

74-
7573
</Details>
7674

77-
7875
<Details header="All-HTTP-Application-Blocklist">
7976

8077
<Render file="zero-trust/blocklist-application" />
8178

82-
8379
</Details>
8480

85-
8681
<Details header="PrivilegedUsers-HTTP-Any-Isolate">
8782

8883
Isolate traffic for privileged users who regularly access critical systems or execute actions such as threat analysis and malware testing.
@@ -91,33 +86,28 @@ Security teams often need to perform threat analysis or malware testing that cou
9186

9287
| Selector | Operator | Value | Action |
9388
| ---------------- | -------- | ------------------ | ------- |
94-
| User Group Names | in | *Privileged Users* | Isolate |
95-
89+
| User Group Names | in | _Privileged Users_ | Isolate |
9690

9791
</Details>
9892

99-
10093
<Details header="Quarantined-Users-HTTP-Restricted-Access">
10194

10295
<Render file="zero-trust/blocklist-restricted-users" />
10396

10497
| Selector | Operator | Value | Logic | Action |
10598
| ---------------- | ----------- | ------------------------------- | ----- | ------ |
106-
| Destination IP | not in list | *Quarantined-Users-IPAllowlist* | And | Block |
107-
| User Group Names | in | *Quarantined Users* | | |
108-
99+
| Destination IP | not in list | _Quarantined-Users-IPAllowlist_ | And | Block |
100+
| User Group Names | in | _Quarantined Users_ | | |
109101

110102
</Details>
111103

112-
113104
<Details header="All-HTTP-Domain-Isolate">
114105

115106
Isolate high risk domains or create a custom list of known risky domains to avoid data exfiltration or malware infection. Ideally, your incident response teams can update the blocklist with an [API automation](/security-center/intel-apis/) to provide real-time threat protection.
116107

117108
| Selector | Operator | Value | Logic | Action |
118109
| ------------------ | -------- | ---------------------------------- | ----- | ------- |
119-
| Content Categories | in | *New Domain*, *Newly Seen Domains* | Or | Isolate |
120-
| Domain | in list | *Domain Isolation* | | |
121-
110+
| Content Categories | in | _New Domain_, _Newly Seen Domains_ | Or | Isolate |
111+
| Domain | in list | _Domain Isolation_ | | |
122112

123113
</Details>

‎src/content/partials/cloudflare-one/gateway/policies/block-cipa.mdx‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
---
22
{}
3-
43
---
54

65
| Selector | Operator | Value | Action |
76
| ------------------ | -------- | ------------- | ------ |
8-
| Content categories | in | `CIPA Filter` | Block |
7+
| Content Categories | in | _CIPA Filter_ | Block |

‎src/content/partials/cloudflare-one/gateway/policies/block-file-types.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ Block the upload or download of files based on their type.
1818
<TabItem label="API">
1919

2020
```bash
21-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
21+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
2222
--header "Content-Type: application/json" \
23-
--header "Authorization: Bearer <API_TOKEN>" \
23+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
2424
--data '{
2525
"name": "Block file types",
2626
"description": "Block the upload or download of files based on their type",

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/dns-block-content-categories.mdx‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
{}
3+
---
4+
5+
import { Tabs, TabItem } from "~/components";
6+
7+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
8+
9+
| Selector | Operator | Value | Action |
10+
| ------------------ | -------- | --------------------------------------------------------- | ------ |
11+
| Content Categories | in | _Questionable Content_, _Security Risks_, _Miscellaneous_ | Block |
12+
13+
</TabItem>
14+
<TabItem label="API">
15+
16+
```bash
17+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
18+
--header "Content-Type: application/json" \
19+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
20+
--data '{
21+
"name": "Block content categories",
22+
"description": "Block common content categories that may pose a risk",
23+
"enabled": true,
24+
"action": "block",
25+
"filters": [
26+
"dns"
27+
],
28+
"traffic": "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})",
29+
"identity": ""
30+
}'
31+
```
32+
33+
</TabItem>
34+
<TabItem label="Terraform">
35+
36+
```tf
37+
resource "cloudflare_zero_trust_gateway_policy" "block_content_categories" {
38+
account_id = var.account_id
39+
name = "Block content categories"
40+
description = "Block common content categories that may pose a risk"
41+
enabled = true
42+
action = "block"
43+
filters = ["dns"]
44+
traffic = "any(dns.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161})"
45+
identity = ""
46+
}
47+
```
48+
49+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/dns-block-security-categories.mdx‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,6 @@ resource "cloudflare_zero_trust_gateway_policy" "block_security_threats" {
4444
action = "block"
4545
filters = ["dns"]
4646
traffic = "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
47-
rule_settings {
48-
block_page_enabled = true
49-
notification_settings {
50-
enabled = true
51-
}
52-
}
5347
}
5448
```
5549

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/http-block-content-categories.mdx‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
{}
3+
---
4+
5+
import { Tabs, TabItem } from "~/components";
6+
7+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
8+
9+
| Selector | Operator | Value | Action |
10+
| ------------------ | -------- | ------------------------------------------------------------------------------------- | ------ |
11+
| Content Categories | in | _Questionable Content_, _Security Risks_, _Miscellaneous_, _Adult Themes_, _Gambling_ | Block |
12+
13+
</TabItem>
14+
<TabItem label="API">
15+
16+
```bash
17+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
18+
--header "Content-Type: application/json" \
19+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
20+
--data '{
21+
"name": "Block content categories",
22+
"description": "Block access to unauthorized applications",
23+
"enabled": true,
24+
"action": "block",
25+
"filters": [
26+
"http"
27+
],
28+
"traffic": "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})",
29+
"identity": "",
30+
"device_posture": ""
31+
}'
32+
```
33+
34+
</TabItem>
35+
</Tabs>

0 commit comments

Comments
 (0)