You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Managed rules, a feature of Cloudflare WAF (Web Application Firewall), identifies and removes suspicious activity for HTTP `GET` and `POST` requests.
11
13
12
14
:::caution
13
15
14
-
15
-
* This page contains documentation about the previous implementation of WAF Managed Rules. For more information on the new version, refer to [WAF Managed Rules](/waf/managed-rules/).
16
-
* All customers with access to the previous version of WAF managed rules can [migrate to the new version](/waf/reference/migration-guides/waf-managed-rules-migration/).
17
-
* The new WAF Managed Rules provide the [Cloudflare Free Managed Ruleset](/waf/managed-rules/) to all customers, including customers on a Free plan. Refer to the [announcement blog post](https://blog.cloudflare.com/waf-for-everyone/) for details.
16
+
- This page contains documentation about the previous implementation of WAF Managed Rules (now deprecated). For more information on the new version, refer to [WAF Managed Rules](/waf/managed-rules/).
17
+
- All customers with access to the previous version of WAF managed rules can [migrate to the new version](/waf/reference/migration-guides/waf-managed-rules-migration/).
18
+
- The new WAF Managed Rules provide the [Cloudflare Free Managed Ruleset](/waf/managed-rules/) to all customers, including customers on a Free plan. Refer to the [announcement blog post](https://blog.cloudflare.com/waf-for-everyone/) for details.
18
19
:::
19
20
20
21
Examples of [malicious content](https://www.cloudflare.com/learning/security/what-is-web-application-security/) that managed rules identify include:
21
22
22
-
* Common keywords used in comment spam (`XX`, `Rolex`, `Viagra`, etc.)
23
-
* Cross-site scripting attacks (XSS)
24
-
* SQL injections (SQLi)
23
+
- Common keywords used in comment spam (`XX`, `Rolex`, `Viagra`, etc.)
24
+
- Cross-site scripting attacks (XSS)
25
+
- SQL injections (SQLi)
25
26
26
27
WAF managed rules (previous version) are available to Pro, Business, and Enterprise plans for any [subdomains proxied to Cloudflare](/dns/proxy-status/). Control managed rules settings in **Security** > **WAF** > **Managed rules**.
You can use the sampled logs in the [Security Events](/waf/analytics/security-events/) dashboard, available at **Security** > **Events**, to review threats blocked by WAF managed rules.
35
+
You can use the sampled logs in the [Security Events](/waf/analytics/security-events/) dashboard to review threats blocked by WAF managed rules.
35
36
36
-
***
37
+
---
37
38
38
39
## Cloudflare Managed Ruleset
39
40
@@ -42,99 +43,97 @@ The Cloudflare Managed Ruleset contains security rules written and curated by Cl
42
43
**Cloudflare Specials** is a group that provides core firewall security against [common attacks](https://www.cloudflare.com/learning/security/what-is-web-application-security/).
43
44
44
45
:::note
45
-
46
46
Cloudflare recommends that you always leave **Cloudflare Specials** enabled. Additionally, only enable rule groups that correspond to your technology stack. For example, if you use WordPress, enable the **Cloudflare WordPress** group.
47
47
:::
48
48
49
49
When viewing a ruleset, Cloudflare shows default actions for each rule listed under **Default mode**. The **Mode** available for individual rules within a specific **Cloudflare Managed Ruleset** are:
50
50
51
-
***Default**: Takes the default action listed under **Default mode** when viewing a specific rule.
52
-
***Disable**: Turns off the specific rule within the group.
53
-
***Block**: Discards the request.
54
-
***Interactive Challenge**: The visitor receives a challenge page that requires interaction.
55
-
***Simulate**: The request is allowed through but is logged in [sampled logs](/waf/analytics/security-events/#sampled-logs).
51
+
-**Default**: Takes the default action listed under **Default mode** when viewing a specific rule.
52
+
-**Disable**: Turns off the specific rule within the group.
53
+
-**Block**: Discards the request.
54
+
-**Interactive Challenge**: The visitor receives a challenge page that requires interaction.
55
+
-**Simulate**: The request is allowed through but is logged in [sampled logs](/waf/analytics/security-events/#sampled-logs).
56
56
57
-
Cloudflare’s [WAF changelog](/waf/change-log/) allows customers to monitor ongoing changes to the Cloudflare Managed Ruleset.
57
+
Cloudflare's [WAF changelog](/waf/change-log/) allows customers to monitor ongoing changes to the Cloudflare Managed Ruleset.
58
58
59
-
***
59
+
---
60
60
61
61
## OWASP ModSecurity Core Rule Set
62
62
63
63
The OWASP ModSecurity Core Rule Set package assigns a score to each request based on how many OWASP rules trigger. Some OWASP rules have a higher sensitivity score than others.
64
64
65
65
After OWASP evaluates a request, Cloudflare compares the final score to the **Sensitivity** configured for the zone. If the score exceeds the sensitivity, the request is actioned based on the **Action** configured within **Package: OWASP ModSecurity Core Rule Set**:
66
66
67
-
***Block**: The request is discarded.
68
-
***Challenge**: The visitor receives an interactive challenge page.
69
-
***Simulate**: The request is allowed through but is logged in [sampled logs](/waf/analytics/security-events/#sampled-logs).
67
+
-**Block**: The request is discarded.
68
+
-**Challenge**: The visitor receives an interactive challenge page.
69
+
-**Simulate**: The request is allowed through but is logged in [sampled logs](/waf/analytics/security-events/#sampled-logs).
70
70
71
71
The sensitivity score required to trigger the WAF for a specific **Sensitivity** is as follows:
72
72
73
-
***Low**: 60 and higher
74
-
***Medium**: 40 and higher
75
-
***High**: 25 and higher
73
+
-**Low**: 60 and higher
74
+
-**Medium**: 40 and higher
75
+
-**High**: 25 and higher
76
76
77
77
For AJAX requests, the following scores are applied instead:
78
78
79
-
***Low**: 120 and higher
80
-
***Medium**: 80 and higher
81
-
***High**: 65 and higher
79
+
-**Low**: 120 and higher
80
+
-**Medium**: 80 and higher
81
+
-**High**: 65 and higher
82
82
83
83
Review the entry in [sampled logs](/waf/analytics/security-events/#sampled-logs) for the final score and for the individual triggered rules.
84
84
85
85
### Control the OWASP package
86
86
87
-
The OWASP ModSecurity Core Rule Set package contains several rules from the [OWASP project](https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project). Cloudflare does not write or curate OWASP rules. Unlike the Cloudflare Managed Ruleset, specific OWASP rules are either turned *On* or *Off.*
87
+
The OWASP ModSecurity Core Rule Set package contains several rules from the [OWASP project](https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project). Cloudflare does not write or curate OWASP rules. Unlike the Cloudflare Managed Ruleset, specific OWASP rules are either turned _On_ or _Off._
88
88
89
-
To manage OWASP thresholds, set the **Sensitivity** to *Low*, *Medium*, or *High* under **Package: OWASP ModSecurity Core Rule Set**.
89
+
To manage OWASP thresholds, set the **Sensitivity** to _Low_, _Medium_, or _High_ under **Package: OWASP ModSecurity Core Rule Set**.
90
90
91
-
Setting the **Sensitivity** to *Off* will disable the entire OWASP package including all its rules. Determining the appropriate **Sensitivity** depends on your business industry and operations. For instance, a *Low* setting is appropriate for:
91
+
Setting the **Sensitivity** to _Off_ will disable the entire OWASP package including all its rules. Determining the appropriate **Sensitivity** depends on your business industry and operations. For instance, a _Low_ setting is appropriate for:
92
92
93
-
* Certain business industries more likely to trigger the WAF.
94
-
* Large file uploads.
93
+
- Certain business industries more likely to trigger the WAF.
94
+
- Large file uploads.
95
95
96
96
With a high sensitivity, large file uploads will trigger the WAF.
97
97
98
-
Cloudflare recommends initially setting the sensitivity to *Low* and reviewing for false positives before further increasing the sensitivity.
98
+
Cloudflare recommends initially setting the sensitivity to _Low_ and reviewing for false positives before further increasing the sensitivity.
99
99
100
100
:::note
101
-
102
101
Sampled logs displays rule ID `981176` when a request is blocked by OWASP. Also, some OWASP rules listed in Sampled logs do not appear in the OWASP list of rules because disabling those rules is not recommended.
103
102
:::
104
103
105
-
***
104
+
---
106
105
107
106
## Important remarks
108
107
109
-
* Managed rules introduce a limited amount of latency.
108
+
- Managed rules introduce a limited amount of latency.
110
109
111
-
* Changes to WAF managed rules take about 30 seconds to update globally.
110
+
- Changes to WAF managed rules take about 30 seconds to update globally.
112
111
113
-
* Cloudflare uses proprietary rules to filter traffic.
112
+
- Cloudflare uses proprietary rules to filter traffic.
114
113
115
-
* Established Websockets do not trigger managed rules for subsequent requests.
114
+
- Established Websockets do not trigger managed rules for subsequent requests.
116
115
117
-
* Managed rules parse JSON responses to identify vulnerabilities targeted at APIs. JSON payload parsing is limited to 128 KB.
116
+
- Managed rules parse JSON responses to identify vulnerabilities targeted at APIs. JSON payload parsing is limited to 128 KB.
118
117
119
-
* Managed rules mitigate padding techniques. Cloudflare recommends the following:
118
+
- Managed rules mitigate padding techniques. Cloudflare recommends the following:
120
119
121
120
1. Turn on rule with ID `100048`. This rule protects against padding type attacks, but it is not deployed by default because there is a high probability of causing false positives in customer environments. It is, however, important that customers tune their managed rules configuration.
122
121
123
122
2. Create a WAF custom rule using the [Expression Editor](/ruleset-engine/rules-language/expressions/edit-expressions/#expression-editor) depending on the need to check headers and/or body to block larger payloads (> 128 KB). Use the following fields for this purpose:
You should test your rule in *Log* mode first (if available), since the rule might generate false positives.
127
+
You should test your rule in _Log_ mode first (if available), since the rule might generate false positives.
129
128
130
-
* There are a handful of managed rules that Cloudflare does not disable even if you turn off **Managed rules** in the Cloudflare dashboard, such as rules with IDs `WP0025B`, `100043A`, and `100030`.
129
+
- There are a handful of managed rules that Cloudflare does not disable even if you turn off **Managed rules** in the Cloudflare dashboard, such as rules with IDs `WP0025B`, `100043A`, and `100030`.
0 commit comments