Skip to content

Commit 19e4050

Browse files
pedrosousaRebeccaTamachiro
authored andcommitted
[Ruleset Engine] Improve linking (#21750)
1 parent 3671bb4 commit 19e4050

File tree

14 files changed

+79
-33
lines changed

14 files changed

+79
-33
lines changed

src/content/docs/ruleset-engine/basic-operations/deploy-rulesets.mdx

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ To apply a rule to every request in a phase at the **zone** level, set the rule
2424

2525
## Example
2626

27-
The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of a given zone (`$ZONE_ID`) by adding a rule that executes the managed ruleset.
27+
The following example deploys a [managed ruleset](/ruleset-engine/about/rulesets/#managed-rulesets) to the `http_request_firewall_managed` phase of a given zone (`$ZONE_ID`) by adding a rule that executes the managed ruleset.
2828

2929
<APIRequest
3030
path="/zones/{zone_id}/rulesets/phases/{ruleset_phase}/entrypoint"
@@ -81,8 +81,12 @@ The following example deploys a managed ruleset to the `http_request_firewall_ma
8181

8282
## Related resources
8383

84+
For more examples of deploying rulesets, refer to the following pages:
85+
86+
- [Deploy a managed ruleset](/ruleset-engine/managed-rulesets/deploy-managed-ruleset/)
87+
- [Managed ruleset override examples](/ruleset-engine/managed-rulesets/override-examples/).
88+
- [Deploy a custom ruleset](/ruleset-engine/custom-rulesets/deploy-custom-ruleset/)
89+
8490
Refer to [Work with managed rulesets](/ruleset-engine/managed-rulesets/) and [Work with custom rulesets](/ruleset-engine/custom-rulesets/) for more information.
8591

8692
For more information on the available API endpoints for editing and deploying rulesets, refer to [Update and deploy rulesets](/ruleset-engine/rulesets-api/update/).
87-
88-
For examples of deploying rulesets, refer to [Managed ruleset override examples](/ruleset-engine/managed-rulesets/override-examples/).

src/content/docs/ruleset-engine/custom-rulesets/add-rules-ruleset.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 3
66
---
77

8-
import { APIRequest } from "~/components";
8+
import { APIRequest, Render } from "~/components";
99

1010
To add rules to an existing custom ruleset, use the [Update an account ruleset](/api/resources/rulesets/methods/update/) operation and pass the rules in an array. Each rule has an expression and an action.
1111

@@ -20,6 +20,10 @@ You can use other API operations depending on the type of operation:
2020

2121
:::
2222

23+
<Render file="custom-rulesets-terraform" />
24+
25+
<Render file="custom-rulesets-dashboard" />
26+
2327
## Add rules
2428

2529
The following request adds two rules to a custom ruleset with ID `$RULESET_ID`. These will be the only two rules in the ruleset.

src/content/docs/ruleset-engine/custom-rulesets/create-custom-ruleset.mdx

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,16 @@ sidebar:
55
order: 2
66
---
77

8-
import { APIRequest } from "~/components";
8+
import { APIRequest, Render } from "~/components";
99

1010
Use the [Create an account ruleset](/api/resources/rulesets/methods/create/) operation to create a custom ruleset, making sure that you:
1111

1212
- Set the `kind` field to `custom`.
13-
- Specify the name of the phase where you want to create the custom ruleset in the `phase` field.
13+
- Specify the name of the [phase](/ruleset-engine/reference/phases-list/) where you want to create the custom ruleset in the `phase` field.
14+
15+
<Render file="custom-rulesets-terraform" />
16+
17+
<Render file="custom-rulesets-dashboard" />
1418

1519
## Example
1620

src/content/docs/ruleset-engine/custom-rulesets/deploy-custom-ruleset.mdx

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,19 @@ sidebar:
66
description: Learn how to deploy a custom ruleset to your Cloudflare account.
77
---
88

9-
import { APIRequest } from "~/components";
9+
import { APIRequest, Render } from "~/components";
1010

11-
Before you begin:
11+
To deploy a custom ruleset, add a rule with `execute` action to the list of rules of a phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) at the account level. The expression of the new rule will define when the custom ruleset will run.
1212

13-
1. Obtain the name of the phase where you want to deploy the custom ruleset.
14-
2. [Create a custom ruleset](/ruleset-engine/custom-rulesets/create-custom-ruleset/) and keep the ID of the new custom ruleset.
15-
3. [Fetch the rules already present in the phase entry point ruleset](/ruleset-engine/basic-operations/view-rulesets/#view-the-rules-included-in-a-ruleset). You must include in the `PUT` request all existing rules you want to keep.
13+
<Render file="custom-rulesets-terraform" />
1614

17-
To deploy a custom ruleset, add a rule that executes the custom ruleset. Define the rule scope in the rule expression.
15+
<Render file="custom-rulesets-dashboard" />
1816

19-
:::caution
20-
Regarding the expression of the rule deploying the ruleset, you must use parentheses to enclose any custom conditions and end your expression with `and cf.zone.plan eq "ENT"` or else the API operation will fail.
21-
:::
17+
## Before you begin
18+
19+
1. Obtain the name of the [phase](/ruleset-engine/reference/phases-list/) where you want to deploy the custom ruleset.
20+
2. [Create a custom ruleset](/ruleset-engine/custom-rulesets/create-custom-ruleset/) and keep the ID of the new custom ruleset.
21+
3. [Fetch the rules already present in the phase entry point ruleset](/ruleset-engine/basic-operations/view-rulesets/#view-the-rules-included-in-a-ruleset). You must include in the `PUT` request all existing rules you want to keep.
2222

2323
## Example
2424

@@ -108,3 +108,7 @@ The following `PUT` request adds a rule that executes a custom ruleset when the
108108
"messages": []
109109
}
110110
```
111+
112+
:::caution
113+
Regarding the expression of the rule deploying the ruleset, you must use parentheses to enclose any custom conditions and end your expression with `and cf.zone.plan eq "ENT"` or else the API operation will fail.
114+
:::

src/content/docs/ruleset-engine/custom-rulesets/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ You must create a rule with `execute` action in an entry point ruleset to execut
1515

1616
Currently, custom rulesets are only supported by the [Cloudflare WAF](/waf/).
1717

18-
:::caution
18+
:::note
1919
You cannot execute a custom ruleset from another custom ruleset, only from an entry point ruleset.
2020
:::
2121

src/content/docs/ruleset-engine/managed-rulesets/create-exception.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,14 @@ sidebar:
55
order: 5
66
---
77

8-
Use exceptions to skip the execution of a managed ruleset of some of its rules. Exceptions are also known as skip rules, since the rule action is `skip`.
8+
Use [exceptions](/waf/managed-rules/waf-exceptions/) to skip the execution of a managed ruleset of some of its rules.
99

1010
The exception configuration includes an [expression](/ruleset-engine/rules-language/expressions/) that defines the skip conditions, and the rules or managed rulesets to skip under those conditions.
1111

12+
If you are using Terraform, refer to [Configure exceptions](/terraform/additional-configurations/waf-managed-rulesets/#configure-exceptions) in the Terraform documentation.
13+
14+
If you are using the Cloudflare dashboard, refer to [Add an exception in the dashboard](/waf/managed-rules/waf-exceptions/define-dashboard/).
15+
1216
:::note
1317
Currently, only the [Cloudflare Web Application Firewall (WAF)](/waf/managed-rules/waf-exceptions/) supports managed rules exceptions.
1418
:::

src/content/docs/ruleset-engine/managed-rulesets/deploy-managed-ruleset.mdx

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,22 @@ sidebar:
77

88
import { RuleID, Render } from "~/components";
99

10-
You can deploy a managed ruleset at the zone level or at the account level.
10+
You can deploy a managed ruleset at the zone level or at the account level. To deploy a managed ruleset to a phase, use the [Rulesets API](/ruleset-engine/rulesets-api/).
1111

12-
To deploy a managed ruleset to a phase, use the [Rulesets API](/ruleset-engine/rulesets-api/).
12+
If you are using Terraform, refer to [WAF Managed Rules configuration using Terraform](/terraform/additional-configurations/waf-managed-rulesets/) for more information.
13+
14+
If you are using the Cloudflare dashboard, refer to the following pages:
15+
16+
- [Deploy a WAF managed ruleset in the dashboard (zone)](/waf/managed-rules/deploy-zone-dashboard/)
17+
- [Deploy a WAF managed ruleset in the dashboard (account)](/waf/account/managed-rulesets/deploy-dashboard/)
1318

1419
## Deploy a managed ruleset to a phase at the zone level
1520

1621
Use the following workflow to deploy a managed ruleset to a phase at the zone level.
1722

1823
1. Get your [zone ID](/fundamentals/setup/find-account-and-zone-ids/).
1924
2. Invoke the [List account rulesets](/api/resources/rulesets/methods/list/) operation to obtain the available managed rulesets. Managed rulesets exist at the account level, but you can deploy them to a zone. Find the ruleset ID of the managed ruleset you want to deploy.
20-
3. Identify the [phase](/ruleset-engine/about/phases/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, refer to the specific documentation for that product, or the [Phases list](/ruleset-engine/reference/phases-list/).
25+
3. Identify the [phase](/ruleset-engine/reference/phases-list/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it.
2126
4. Add a rule to the zone-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Refer to the following example for details on this step.
2227

2328
### Example
@@ -32,11 +37,11 @@ Use the following workflow to deploy a managed ruleset to a phase at the account
3237

3338
1. Get your [account ID](/fundamentals/setup/find-account-and-zone-ids/).
3439
2. Invoke the [List account rulesets](/api/resources/rulesets/methods/list/) operation to obtain the available managed rulesets. Find the ruleset ID of the managed ruleset you want to deploy.
35-
3. Identify the [phase](/ruleset-engine/about/phases/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, refer to the specific documentation for that product, or the [Phases list](/ruleset-engine/reference/phases-list/).
40+
3. Identify the [phase](/ruleset-engine/reference/phases-list/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it.
3641
4. Add a rule to the account-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Use parentheses to enclose any custom conditions in the rule expression and end your expression with `and cf.zone.plan eq "ENT"` so that it only applies to zones on an Enterprise plan. Refer to the following example for details on this step.
3742

3843
### Example
3944

4045
<Render file="managed-rulesets/api-account-example" product="waf" />
4146

42-
In this example, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
47+
In this example, the managed ruleset executes the behavior configured by Cloudflare. To learn how to customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).

src/content/docs/ruleset-engine/managed-rulesets/override-managed-ruleset.mdx

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,20 @@ sidebar:
77

88
import { Render, Details, APIRequest } from "~/components";
99

10-
To customize the behavior of a managed ruleset, override the ruleset at deployment. When you override a ruleset you specify changes to be executed on top of the default configuration. These changes take precedence over the ruleset's default behavior.
10+
To customize the behavior of a managed ruleset via API, override the ruleset at deployment. When you override a ruleset you specify changes to be executed on top of the default configuration. These changes take precedence over the ruleset's default behavior.
1111

1212
For example, to test a managed ruleset before enforcing it, consider executing the ruleset with all rules set to `log` instead of their default actions. To do this, override the configured behavior of the managed ruleset at the ruleset level, so that each rule uses the `log` action.
1313

14-
To define overrides in the Cloudflare dashboard, edit the configuration of the managed ruleset you previously deployed to a zone or to an account.
14+
If you are using Terraform, refer to the following pages:
15+
16+
- [WAF Managed Rules configuration using Terraform](/terraform/additional-configurations/waf-managed-rulesets/#configure-overrides)
17+
- [DDoS managed rulesets configuration using Terraform](/terraform/additional-configurations/ddos-managed-rulesets/)
18+
19+
To define overrides in the Cloudflare dashboard, refer to the following resources:
20+
21+
- [Configure a WAF managed ruleset in the dashboard](/waf/managed-rules/deploy-zone-dashboard/#configure-a-managed-ruleset)
22+
- [Configure HTTP DDoS Attack Protection in the dashboard](/ddos-protection/managed-rulesets/http/configure-dashboard/)
23+
- [Configure Network-layer DDoS Attack Protection in the dashboard](/ddos-protection/managed-rulesets/network/configure-dashboard/)
1524

1625
## Working with overrides
1726

@@ -132,4 +141,6 @@ The following `PUT` request adds a rule that executes a managed ruleset in the `
132141
}}
133142
/>
134143

135-
For additional examples of configuring overrides, refer to [Managed ruleset override examples](/ruleset-engine/managed-rulesets/override-examples/).
144+
## More resources
145+
146+
For additional examples of configuring overrides via API, refer to [Override examples](/ruleset-engine/managed-rulesets/override-examples/).

src/content/docs/terraform/additional-configurations/waf-managed-rulesets.mdx

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ This page provides examples of deploying and configuring [WAF Managed Rules](/wa
1515

1616
- [Deploy managed rulesets at the zone level](#deploy-managed-rulesets-at-the-zone-level)
1717
- [Deploy managed rulesets at the account level](#deploy-managed-rulesets-at-the-account-level)
18-
- [Configure skip rules](#configure-skip-rules)
18+
- [Configure exceptions](#configure-exceptions)
1919
- [Configure payload logging](#configure-payload-logging)
2020
- [Configure overrides](#configure-overrides)
2121
- [Configure the OWASP paranoia level, score threshold, and action](#configure-the-owasp-paranoia-level-score-threshold-and-action)
@@ -121,14 +121,14 @@ resource "cloudflare_ruleset" "account_level_managed_waf" {
121121
}
122122
```
123123

124-
## Configure skip rules
124+
## Configure exceptions
125125

126-
The following example adds two [skip rules](/waf/managed-rules/waf-exceptions/) (or exceptions) for the Cloudflare Managed Ruleset:
126+
The following example adds two [exceptions](/waf/managed-rules/waf-exceptions/) for the Cloudflare Managed Ruleset:
127127

128128
- The first rule will skip the execution of the entire Cloudflare Managed Ruleset (with ID <RuleID id="efb7b8c949ac4650a09736fc376e9aee" />) for specific URLs, according to the rule expression.
129129
- The second rule will skip the execution of two rules belonging to the Cloudflare Managed Ruleset for specific URLs, according to the rule expression.
130130

131-
Add the two skip rules to the `cloudflare_ruleset` resource before the rule that deploys the Cloudflare Managed Ruleset:
131+
Add the two exceptions to the `cloudflare_ruleset` resource before the rule that deploys the Cloudflare Managed Ruleset:
132132

133133
<Render file="v4-code-snippets" />
134134

@@ -178,7 +178,7 @@ resource "cloudflare_ruleset" "zone_level_managed_waf" {
178178

179179
:::caution[Important]
180180

181-
Ensure that you place the skip rules **before** the rule that executes the managed ruleset (or some of its rules) that you wish to skip, as in the previous example.
181+
Ensure that you place the exceptions **before** the rule that executes the managed ruleset (or some of its rules) that you wish to skip, as in the previous example.
182182
:::
183183

184184
## Configure overrides

src/content/docs/waf/custom-rules/skip/options.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ The available skip options in custom rules are the following:
2020

2121
- API action parameter: `phases`.
2222

23-
- Skips the execution of one or more phases. Based on the phases you can skip, this option effectively allows you to skip [rate limiting rules](/waf/rate-limiting-rules/), [Super Bot Fight Mode rules](/bots/get-started/super-bot-fight-mode/), and/or [WAF Managed Rules](/waf/managed-rules/). When skipping a phase, both the account and zone-level entry point rulesets of the phase will be skipped.
23+
- Skips the execution of one or more phases. Based on the phases you can skip, this option effectively allows you to skip [rate limiting rules](/waf/rate-limiting-rules/), [Super Bot Fight Mode rules](/bots/get-started/super-bot-fight-mode/), and/or [WAF Managed Rules](/waf/managed-rules/).
2424

2525
- The phases you can skip are the following:
2626

0 commit comments

Comments
 (0)