Skip to content

Commit 3353470

Browse files
pedrosousapedrosousa
authored
[WAF] Improve API examples (#17397)
1 parent 21b1041 commit 3353470

File tree

2 files changed

+228
-6
lines changed

2 files changed

+228
-6
lines changed

‎src/content/docs/waf/managed-rules/reference/exposed-credentials-check.mdx‎

Lines changed: 115 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 4
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, RuleID } from "~/components";
99

1010
The Cloudflare Exposed Credentials Check Managed Ruleset is a set of pre-configured rules for well-known CMS applications that perform a lookup against a public database of stolen credentials.
1111

@@ -39,14 +39,122 @@ You can configure the following settings of the Cloudflare Exposed Credentials C
3939
- **Set the action to perform.** When you define an action for the ruleset, you override the default action defined for each rule. The available actions are: _Managed Challenge_, _Block_, _JS Challenge_, _Log_, and _Interactive Challenge_. To remove the action override, set the ruleset action to _Default_.
4040
- **Override the action performed by individual rules.** The available actions are: _Exposed-Credential-Check Header_, _Managed Challenge_, _Block_, _JS Challenge_, _Log_, and _Interactive Challenge_. For more information, refer to [Available actions](/waf/managed-rules/check-for-exposed-credentials/#available-actions).
4141
- **Disable specific rules.**
42-
- **Customize the filter expression.** With a custom expression, the Cloudflare Managed Ruleset applies only to a subset of the incoming requests.
42+
- **Customize the filter expression.** With a custom expression, the Cloudflare Exposed Credentials Check Managed Ruleset applies only to a subset of the incoming requests.
4343
- **Configure [payload logging](/waf/managed-rules/payload-logging/configure/)**.
4444

4545
For details on configuring a managed ruleset in the dashboard, refer to [Configure a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#configure-a-managed-ruleset).
4646

4747
## Configure via API
4848

49-
To enable the Cloudflare Exposed Credentials Check Managed Ruleset for a given zone via API, create a rule with `execute` action in the entry point ruleset for the `http_request_firewall_managed` phase. For more information on deploying a managed ruleset, refer to [Deploy a managed ruleset](/ruleset-engine/managed-rulesets/deploy-managed-ruleset/).
49+
To enable the Cloudflare Exposed Credentials Check Managed Ruleset for a given zone via API, create a rule with `execute` action in the [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_request_firewall_managed` phase.
50+
51+
### Example
52+
53+
This example deploys the Cloudflare Exposed Credentials Check Managed Ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed for all incoming requests.
54+
55+
1. Invoke the [Get a zone entry point ruleset](/api/operations/getZoneEntrypointRuleset) operation to obtain the definition of the entry point ruleset for the `http_request_firewall_managed` phase. You will need the [zone ID](/fundamentals/setup/find-account-and-zone-ids/) for this task.
56+
57+
```bash
58+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint" \
59+
--header "Authorization: Bearer <API_TOKEN>"
60+
```
61+
62+
```json output {4}
63+
{
64+
"result": {
65+
"description": "Zone-level phase entry point",
66+
"id": "<RULESET_ID>",
67+
"kind": "zone",
68+
"last_updated": "2024-03-16T15:40:08.202335Z",
69+
"name": "zone",
70+
"phase": "http_request_firewall_managed",
71+
"rules": [
72+
// ...
73+
],
74+
"source": "firewall_managed",
75+
"version": "10"
76+
},
77+
"success": true,
78+
"errors": [],
79+
"messages": []
80+
}
81+
```
82+
83+
2. If the entry point ruleset already exists (that is, if you received a `200 OK` status code and the ruleset definition), take note of the ruleset ID in the response. Then, invoke the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation to add an `execute` rule to the existing ruleset deploying the Cloudflare Exposed Credentials Check Managed Ruleset (with ID <RuleID id="c2e184081120413c86c3ab7e14069605" />). By default, the rule will be added at the end of the list of rules already in the ruleset.
84+
85+
```bash
86+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
87+
--header "Authorization: Bearer <API_TOKEN>" \
88+
--header "Content-Type: application/json" \
89+
--data '{
90+
"action": "execute",
91+
"action_parameters": {
92+
"id": "c2e184081120413c86c3ab7e14069605"
93+
},
94+
"expression": "true",
95+
"description": "Execute the Cloudflare Exposed Credentials Check Managed Ruleset"
96+
}'
97+
```
98+
99+
```json output
100+
{
101+
"result": {
102+
"id": "<RULESET_ID>",
103+
"name": "Zone-level phase entry point",
104+
"description": "",
105+
"kind": "zone",
106+
"version": "11",
107+
"rules": [
108+
// ... any existing rules
109+
{
110+
"id": "<RULE_ID>",
111+
"version": "1",
112+
"action": "execute",
113+
"action_parameters": {
114+
"id": "c2e184081120413c86c3ab7e14069605",
115+
"version": "latest"
116+
},
117+
"expression": "true",
118+
"description": "Execute the Cloudflare Exposed Credentials Check Managed Ruleset",
119+
"last_updated": "2024-03-18T18:08:14.003361Z",
120+
"ref": "<RULE_REF>",
121+
"enabled": true
122+
}
123+
],
124+
"last_updated": "2024-03-18T18:08:14.003361Z",
125+
"phase": "http_request_firewall_managed"
126+
},
127+
"success": true,
128+
"errors": [],
129+
"messages": []
130+
}
131+
```
132+
133+
3. If the entry point ruleset does not exist (that is, if you received a `404 Not Found` status code in step 1), create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the Cloudflare Exposed Credentials Check Managed Ruleset (with ID <RuleID id="c2e184081120413c86c3ab7e14069605" />) for all incoming requests in the zone.
134+
135+
```bash
136+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
137+
--header "Authorization: Bearer <API_TOKEN>" \
138+
--header "Content-Type: application/json" \
139+
--data '{
140+
"name": "My ruleset",
141+
"description": "Entry point ruleset for WAF managed rulesets",
142+
"kind": "zone",
143+
"phase": "http_request_firewall_managed",
144+
"rules": [
145+
{
146+
"action": "execute",
147+
"action_parameters": {
148+
"id": "c2e184081120413c86c3ab7e14069605"
149+
},
150+
"expression": "true",
151+
"description": "Execute the Cloudflare Exposed Credentials Check Managed Ruleset"
152+
}
153+
]
154+
}'
155+
```
156+
157+
### Next steps
50158

51159
To configure the Exposed Credentials Check Managed Ruleset via API, create [overrides](/ruleset-engine/managed-rulesets/override-managed-ruleset/) using the Rulesets API. You can perform the following configurations:
52160

@@ -62,3 +170,7 @@ Besides activating the Exposed Credentials Check Managed Ruleset, you can also c
62170
For more information, refer to [Create a custom rule checking for exposed credentials](/waf/managed-rules/check-for-exposed-credentials/configure-api/#create-a-custom-rule-checking-for-exposed-credentials).
63171

64172
:::
173+
174+
### More resources
175+
176+
For more information on working with managed rulesets via API, refer to [Work with managed rulesets](/ruleset-engine/managed-rulesets/) in the Ruleset Engine documentation.

‎src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx‎

Lines changed: 113 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,115 @@ For details on configuring a managed ruleset in the dashboard, refer to [Configu
4242

4343
## Configure via API
4444

45-
To enable Cloudflare Sensitive Data Detection for a given zone using the API, create a rule with `execute` action in the entry point ruleset for the `http_response_firewall_managed` phase. For more information on deploying a managed ruleset, refer to [Deploy a managed ruleset](/ruleset-engine/managed-rulesets/deploy-managed-ruleset/).
46-
47-
The ruleset ID is the following: <RuleID id="e22d83c647c64a3eae91b71b499d988e" />.
45+
To enable Cloudflare Sensitive Data Detection for a given zone using the API, create a rule with `execute` action in the [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_response_firewall_managed` phase.
46+
47+
### Example
48+
49+
This example deploys the Cloudflare Sensitive Data Detection managed ruleset to the `http_response_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed for all incoming requests.
50+
51+
1. Invoke the [Get a zone entry point ruleset](/api/operations/getZoneEntrypointRuleset) operation to obtain the definition of the entry point ruleset for the `http_response_firewall_managed` phase. You will need the [zone ID](/fundamentals/setup/find-account-and-zone-ids/) for this task.
52+
53+
```bash
54+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_response_firewall_managed/entrypoint" \
55+
--header "Authorization: Bearer <API_TOKEN>"
56+
```
57+
58+
```json output {4}
59+
{
60+
"result": {
61+
"description": "Zone-level phase entry point (response)",
62+
"id": "<RULESET_ID>",
63+
"kind": "zone",
64+
"last_updated": "2024-03-16T15:40:08.202335Z",
65+
"name": "zone",
66+
"phase": "http_response_firewall_managed",
67+
"rules": [
68+
// ...
69+
],
70+
"source": "firewall_managed",
71+
"version": "10"
72+
},
73+
"success": true,
74+
"errors": [],
75+
"messages": []
76+
}
77+
```
78+
79+
2. If the entry point ruleset already exists (that is, if you received a `200 OK` status code and the ruleset definition), take note of the ruleset ID in the response. Then, invoke the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation to add an `execute` rule to the existing ruleset deploying the Cloudflare Sensitive Data Detection managed ruleset (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />). By default, the rule will be added at the end of the list of rules already in the ruleset.
80+
81+
```bash
82+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
83+
--header "Authorization: Bearer <API_TOKEN>" \
84+
--header "Content-Type: application/json" \
85+
--data '{
86+
"action": "execute",
87+
"action_parameters": {
88+
"id": "e22d83c647c64a3eae91b71b499d988e"
89+
},
90+
"expression": "true",
91+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset"
92+
}'
93+
```
94+
95+
```json output
96+
{
97+
"result": {
98+
"id": "<RULESET_ID>",
99+
"name": "Zone-level phase entry point (response)",
100+
"description": "",
101+
"kind": "zone",
102+
"version": "11",
103+
"rules": [
104+
// ... any existing rules
105+
{
106+
"id": "<RULE_ID>",
107+
"version": "1",
108+
"action": "execute",
109+
"action_parameters": {
110+
"id": "e22d83c647c64a3eae91b71b499d988e",
111+
"version": "latest"
112+
},
113+
"expression": "true",
114+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset",
115+
"last_updated": "2024-03-18T18:08:14.003361Z",
116+
"ref": "<RULE_REF>",
117+
"enabled": true
118+
}
119+
],
120+
"last_updated": "2024-03-18T18:08:14.003361Z",
121+
"phase": "http_response_firewall_managed"
122+
},
123+
"success": true,
124+
"errors": [],
125+
"messages": []
126+
}
127+
```
128+
129+
3. If the entry point ruleset does not exist (that is, if you received a `404 Not Found` status code in step 1), create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the Cloudflare Sensitive Data Detection managed ruleset (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />) for all incoming requests in the zone.
130+
131+
```bash
132+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
133+
--header "Authorization: Bearer <API_TOKEN>" \
134+
--header "Content-Type: application/json" \
135+
--data '{
136+
"name": "My ruleset",
137+
"description": "Entry point ruleset for WAF managed rulesets (response)",
138+
"kind": "zone",
139+
"phase": "http_response_firewall_managed",
140+
"rules": [
141+
{
142+
"action": "execute",
143+
"action_parameters": {
144+
"id": "e22d83c647c64a3eae91b71b499d988e"
145+
},
146+
"expression": "true",
147+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset"
148+
}
149+
]
150+
}'
151+
```
152+
153+
### Next steps
48154

49155
To configure Cloudflare Sensitive Data Detection using the API, create [overrides](/ruleset-engine/managed-rulesets/override-managed-ruleset/) using the Rulesets API. You can perform the following configurations:
50156

@@ -53,6 +159,10 @@ To configure Cloudflare Sensitive Data Detection using the API, create [override
53159

54160
For examples of creating overrides using the API, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
55161

162+
### More resources
163+
164+
For more information on working with managed rulesets via API, refer to [Work with managed rulesets](/ruleset-engine/managed-rulesets/) in the Ruleset Engine documentation.
165+
56166
## Review detected leaks
57167

58168
To check for any data leaks detected by Cloudflare Sensitive Data Detection, you can do the following:

0 commit comments

Comments
 (0)