Skip to content

Commit 2cd67eb

Browse files
Maddy-CloudflareMaddy-Cloudflare
committed
Adding more files
1 parent 2f894c4 commit 2cd67eb

File tree

16 files changed

+985
-38
lines changed

16 files changed

+985
-38
lines changed

‎src/content/docs/cloudflare-one/changelog/magic-firewall.mdx‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
pcx_content_type: changelog
3+
title: Magic Firewall
4+
---
5+
6+
import { ProductChangelog } from "~/components";
7+
8+
{/* <!-- Actual content lives in /src/content/changelog/magic-firewall/. Update the file there for new entries to appear here. For more details, refer to https://developers.cloudflare.com/style-guide/documentation-content-strategy/content-types/changelog/#yaml-file --> */}
9+
10+
<ProductChangelog product="magic-firewall" hideEntry="2024-06-16-cloudflare-one"/>
11+
12+
## 2024-09-12
13+
14+
**New UI improvements**
15+
16+
The dashboard now displays the order number of custom rules, and improved drag and drop functionality. You can also preview rules on a side panel without leaving the current page.
17+
18+
## 2024-08-16
19+
20+
**Magic Firewall Analytics Rule Log Enhancement**
21+
22+
Customers who create a rule in a disabled mode will see the rule as **Log (rule disabled)**.

‎src/content/docs/cloudflare-one/insights/logs/filter-views.mdx‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
title: Filter different views
3+
pcx_content_type: how-to
4+
5+
---
6+
7+
You can utilize different [Log filters](/logs/logpush/logpush-job/filters/) to only view specific data from Magic Firewall.
8+
9+
## Filter by enabled or disabled rules
10+
11+
Use the filter examples below to filter your Magic Firewall traffic to display events for enabled or disabled rules.
12+
13+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events for disabled rules.
14+
15+
```bash
16+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
17+
--header "X-Auth-Email: <EMAIL>" \
18+
--header "X-Auth-Key: <API_KEY>" \
19+
--header "Content-Type: application/json" \
20+
--data '{
21+
...
22+
"output_options": {
23+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
24+
},
25+
"filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"pass\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"drop\"}]}]}}"
26+
}'
27+
```
28+
29+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events for enabled rules.
30+
31+
```bash
32+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
33+
--header "X-Auth-Email: <EMAIL>" \
34+
--header "X-Auth-Key: <API_KEY>" \
35+
--header "Content-Type: application/json" \
36+
--data '{
37+
...
38+
"output_options": {
39+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
40+
},
41+
"filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"or\":[{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"drop\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"pass\"}]}]}]}}"
42+
}'
43+
```
44+
45+
## Filter by allowed or blocked traffic
46+
47+
Use the filter examples below to filter your Magic Firewall traffic to display events for allowed or blocked traffic.
48+
49+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events where no explicit action was taken, for example, a packet "fell through" Magic Firewall. This example does not have any rules applied.
50+
51+
```bash
52+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
53+
--header "X-Auth-Email: <EMAIL>" \
54+
--header "X-Auth-Key: <API_KEY>" \
55+
--header "Content-Type: application/json" \
56+
--data '{
57+
...
58+
"output_options": {
59+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
60+
},
61+
"filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"eq\",\"value\":\"\"}]}}"
62+
}'
63+
```
64+
65+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events where explicit action was taken. The example includes both enabled and disabled Magic Firewall rules.
66+
67+
```bash
68+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
69+
--header "X-Auth-Email: <EMAIL>" \
70+
--header "X-Auth-Key: <API_KEY>" \
71+
--header "Content-Type: application/json" \
72+
--data '{
73+
...
74+
"output_options": {
75+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
76+
},
77+
"filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"}]}}"
78+
}'
79+
```
80+
81+
## Filter by relevant fields to Magic Firewall
82+
83+
Use the examples below to filter out fields that are not relevant to traffic flowing through Magic Firewall. The example below only includes Magic Firewall events.
84+
85+
```bash
86+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
87+
--header "X-Auth-Email: <EMAIL>" \
88+
--header "X-Auth-Key: <API_KEY>" \
89+
--header "Content-Type: application/json" \
90+
--data '{
91+
...
92+
"output_options": {
93+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
94+
},
95+
"filter": "{\"where\":{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"}}"
96+
}'
97+
```

‎src/content/docs/cloudflare-one/insights/logs/use-logpush-with-ids.mdx‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Use Logpush with IDS
3+
pcx_content_type: concept
4+
5+
---
6+
7+
You can use Logpush with Magic Firewall IDS to log detected risks:
8+
9+
1. Consult the [Logpush Destination docs](/logs/logpush/logpush-job/api-configuration/#destination) to learn about what destinations Logpush supports. The documentation will also instruct you on how to correctly format the destination URL for Logpush.
10+
11+
2. Follow the [Manage Lopush with cURL](/logs/logpush/examples/example-logpush-curl/) tutorial to validate your Logpush destination and define a Logpush job.
12+
13+
## Notes on using Logpush with IDS
14+
15+
* Magic IDS is an account-scoped dataset. This means the string `/zone/<ZONE_ID>` in the Cloudflare API URLs in the tutorial should be replaced with `/account/<ACCOUNT_ID>`.
16+
17+
* Consult the [Magic IDS Detection fields doc](/logs/logpush/logpush-job/datasets/account/magic_ids_detections/) to know what fields you want configured for the job.
18+
19+
* When creating the Logpush job, the dataset field should equal `magic_ids_detections`.
20+
21+
* Timestamps by default are unixnano. Consult the [Logpush Options docs](/logs/logpush/logpush-job/api-configuration/#options) to learn what format you can choose that will be compatible with your destination and/or expectations. Note that all options must be added *after* all fields you want from the Logpush job, akin to URL parameters.

‎src/content/docs/cloudflare-one/insights/network-visibility/diagnostics/buckets.mdx‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,11 @@ Learn how to set up a bucket for use with full packet captures.
1717

1818
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
1919

20-
1. In the Cloudflare One dashboard, go to the **Packet captures** page in Magic Transit or Magic WAN.
21-
22-
To set up a bucket in Magic Transit: <DashButton url="/?to=/:account/magic-transit/packet-captures/captures" />
23-
24-
To set up a bucket in Magic WAN: <DashButton url="/?to=/:account/magic-wan/packet-captures/captures" />
25-
2. Select the **Buckets** tab.
26-
3. Select **Add a bucket**.
27-
4. Under **Bucket configuration**, select a bucket service and select **Next**.
28-
5. Enter the information related to your bucket for your service provider.
29-
6. When you are done, select **Next**.
20+
1. In the [Cloudflare One](https://one.dash.cloudflare.com) dashboard, go to **Network visibility** > **Diagnostics**.
21+
2. Select the **Buckets** tab > **Add a bucket**.
22+
3. Select a bucket service and select **Next**.
23+
4. Enter the information related to your bucket for your service provider.
24+
5. When you are done, select **Next**.
3025

3126
The **Prove ownership** step of the **Bucket configuration** displays.
3227

‎src/content/docs/cloudflare-one/insights/network-visibility/diagnostics/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ Full packet captures will collect new traffic sent to Cloudflare's network after
3030

3131
Refer to the articles in this section to learn how to use packet captures.
3232

33-
<DirectoryListing />
33+
<DirectoryListing />

‎src/content/docs/cloudflare-one/insights/network-visibility/diagnostics/packet-captures.mdx‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -167,13 +167,10 @@ The response is a JSON body that contains the details of the job running to buil
167167

168168
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
169169

170-
1. In the Cloudflare dashboard, go to the **Packet captures** page in Magic Transit or Magic WAN.
171-
172-
To set up a packet capture in Magic Transit: <DashButton url="/?to=/:account/magic-transit/packet-captures/captures" />
173-
174-
To set up a packet capture in Magic WAN: <DashButton url="/?to=/:account/magic-wan/packet-captures/captures" />
175-
2. In **Packet captures**, select **Start a capture**.
176-
3. Select the **Captures** tab.
170+
1. In the [Cloudflare One](https://one.dash.cloudflare.com) dashboard, go to **Network visibility** > **Diagnostics**.
171+
2. In **Captures**, select **Start a capture**.
172+
3. Select between **Full packet capture** or **Sample packet capture**, then fill in the information.
173+
4. Once you filled all the information, select **Start**.
177174

178175
</TabItem> <TabItem label="API">
179176

@@ -225,14 +222,9 @@ After your request finishes processing, you can download your packet captures.
225222

226223
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
227224

228-
1. In the Cloudflare dashboard, go to the **Packet captures** page in Magic Transit or Magic WAN.
229-
230-
To set up a packet capture in Magic Transit: <DashButton url="/?to=/:account/magic-transit/packet-captures/captures" />
231-
232-
To set up a packet capture in Magic WAN: <DashButton url="/?to=/:account/magic-wan/packet-captures/captures" />
225+
1. In the [Cloudflare One](https://one.dash.cloudflare.com) dashboard, go to **Network visibility** > **Diagnostics**.
233226
2. In **Packet captures**, select **Start a capture**.
234-
3. Select the **Captures** tab.
235-
4. Locate your packet capture you want to download, and select **Download**.
227+
3. Locate your packet capture you want to download, and select **Download**.
236228

237229
Packet captures are available to download when the **Status** displays **Success**.
238230

@@ -303,4 +295,4 @@ The response returns an array that includes up to 50 sent requests, which includ
303295
}
304296
```
305297

306-
</TabItem> </Tabs>
298+
</TabItem> </Tabs>

0 commit comments

Comments
 (0)