Skip to content

Commit 7449b85

Browse files
cdishercdisher
authored
Merge branch 'cloudflare:production' into patch-7
2 parents eaa1b5c + 9295203 commit 7449b85

File tree

8 files changed

+544
-118
lines changed

8 files changed

+544
-118
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/user-side-certificates/index.mdx‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ Gateway [generates a unique root CA](#generate-a-cloudflare-root-certificate) fo
1515

1616
Zero Trust will indicate if a certificate is ready for use in inspection based on its deployment status:
1717

18-
| Deployment status | Description |
19-
| ----------------- | -------------------------------------------------------------------------------------------------------------- |
20-
| Inactive | The certificate has been generated by or uploaded to Cloudflare but is not deployed across the global network. |
21-
| Pending | The certificate is being activated or deactivated for use. |
22-
| Active | The certificate is deployed across the Cloudflare global network and ready to be turned on. |
23-
| Active and In-Use | The certificate is turned on. Gateway will use the certificate for inspection. |
18+
| Deployment status | Description |
19+
| -------------------- | -------------------------------------------------------------------------------------------------------------- |
20+
| Inactive | The certificate has been generated by or uploaded to Cloudflare but is not deployed across the global network. |
21+
| Pending | The certificate is being activated or deactivated for use. |
22+
| Available | The certificate is deployed across the Cloudflare global network and ready to be turned on. |
23+
| Available and In-Use | The certificate is turned on. Gateway will use the certificate for inspection. |
2424

2525
## Generate a Cloudflare root certificate
2626

@@ -39,10 +39,10 @@ Each Zero Trust account can generate a new root certificate a maximum of three t
3939
## Activate a root certificate
4040

4141
:::note
42-
Zero Trust accounts using the Cloudflare certificate prior to 2024-10-17 will need to redeploy and activate the newly generated certificate. Zero Trust accounts created during or after 2024-10-17 will use an active certificate by default.
42+
Zero Trust accounts using the Cloudflare certificate prior to 2024-10-17 will need to redeploy and activate the newly generated certificate. Zero Trust accounts created during or after 2024-10-17 will use an available certificate by default.
4343
:::
4444

45-
Once a certificate is generated in or uploaded to Zero Trust, you need to activate it. Activating a certificate deploys it across the Cloudflare network. You can have up to 25 active certificates at once.
45+
Once a certificate is generated in or uploaded to Zero Trust, you need to activate it. Activating a certificate deploys it across the Cloudflare network. You can have up to 25 available certificates at once.
4646

4747
To activate your root certificate:
4848

@@ -51,7 +51,7 @@ To activate your root certificate:
5151
3. Select the certificate you want to activate.
5252
4. Select **Activate**.
5353

54-
The status of the certificate will change to **Pending** while it deploys. Once the status of your certificate is **Active**, you can install it on your user's devices either [with WARP](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/) or [manually](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/).
54+
The status of the certificate will change to **Pending** while it deploys. Once the status of your certificate is **Available**, you can install it on your user's devices either [with WARP](/cloudflare-one/connections/connect-devices/user-side-certificates/automated-deployment/) or [manually](/cloudflare-one/connections/connect-devices/user-side-certificates/manual-deployment/).
5555

5656
Once you deploy and install your certificate, you can turn it on for use in inspection:
5757

@@ -60,4 +60,4 @@ Once you deploy and install your certificate, you can turn it on for use in insp
6060
3. Select the certificate you want to turn on.
6161
4. In **Basic information**, select **Confirm and turn on certificate**.
6262

63-
You can set multiple certificates to **Active**, but you can only turn on one certificate for use in inspection at a time. Setting a certificate as **In-Use** will set any other turned on certificates as **Active** and prevent them from being used for inspection until turned on again.
63+
You can set multiple certificates to **Available**, but you can only turn on one certificate for use in inspection at a time. Setting a certificate as **In-Use** will set any other turned on certificates as **Active** and prevent them from being used for inspection until turned on again.

‎src/content/docs/cloudflare-one/policies/browser-isolation/isolation-policies.mdx‎

Lines changed: 153 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ pcx_content_type: reference
33
title: Isolation policies
44
sidebar:
55
order: 2
6-
76
---
87

9-
import { Render } from "~/components"
8+
import { Render, Tabs, TabItem } from "~/components";
109

1110
With Browser Isolation, you can define policies to dynamically isolate websites based on identity, security threats, or content.
1211

@@ -28,12 +27,10 @@ If instead you need to isolate specific pages, you can list the domains for whic
2827

2928
:::note[Isolate identity providers for applications]
3029

31-
3230
Existing cookies and sessions from non-isolated browsing are not sent to the remote browser. Websites that implement single sign-on using third-party cookies will also need to be isolated.
3331

3432
For example, if `example.com` authenticates using Google Workspace, you will also need to isolate the top level [Google Workspace URLs](https://support.google.com/a/answer/9012184).
3533

36-
3734
:::
3835

3936
## Do Not Isolate
@@ -46,7 +43,7 @@ You can choose to disable isolation for certain destinations or categories. The
4643

4744
## Policy settings
4845

49-
The following optional settings appear in the Gateway HTTP policy builder when you select the *Isolate* action. Enable these settings to [prevent data loss](https://blog.cloudflare.com/data-protection-browser/) when users interact with untrusted websites in the remote browser.
46+
The following optional settings appear in the Gateway HTTP policy builder when you select the _Isolate_ action. Enable these settings to [prevent data loss](https://blog.cloudflare.com/data-protection-browser/) when users interact with untrusted websites in the remote browser.
5047

5148
### Disable copy / paste
5249

@@ -62,7 +59,7 @@ Prohibits users from performing keyboard input into the remote web page.
6259

6360
:::note
6461

65-
Mouse input remains available (to allow users to browse a website by following hyperlinks and scrolling). This does not prevent user input into third-party virtual keyboards within a remote web page.
62+
Mouse input remains available (to allow users to browse a website by following hyperlinks and scrolling). This does not prevent user input into third-party virtual keyboards within a remote web page.
6663
:::
6764

6865
### Disable upload
@@ -71,7 +68,7 @@ Prohibits users from uploading files from their local machine into a remote web
7168

7269
:::note
7370

74-
This option does not prevent files being uploaded to websites from third-party cloud file managers or files downloaded into the remote browser download bar from other isolated websites. To prevent files being uploaded from the remote browser into an isolated website, use HTTP Policies to block by [Upload Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
71+
This option does not prevent files being uploaded to websites from third-party cloud file managers or files downloaded into the remote browser download bar from other isolated websites. To prevent files being uploaded from the remote browser into an isolated website, use HTTP Policies to block by [Upload Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
7572
:::
7673

7774
### Disable download
@@ -80,7 +77,7 @@ Prohibits users from exporting files from the remote browser to their local mach
8077

8178
:::note
8279

83-
This option does not prevent files from being downloaded into the remote browser. To prevent files being downloaded into the remote browser, use HTTP Policies to block by [Download Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
80+
This option does not prevent files from being downloaded into the remote browser. To prevent files being downloaded into the remote browser, use HTTP Policies to block by [Download Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
8481
:::
8582

8683
### Disable clipboard redirection
@@ -91,7 +88,7 @@ Prevents copying isolated content from the remote browser to their local clipboa
9188

9289
This option does not prevent clipboard interactions between isolated websites. Use [Disable copy / paste](/cloudflare-one/policies/browser-isolation/isolation-policies/#disable-copy--paste) to prohibit clipboard use on sensitive isolated applications.
9390

94-
Disable copy / paste and Disable clipboard redirection are mutually exclusive and cannot be used in conjunction with each other.
91+
Disable copy / paste and Disable clipboard redirection are mutually exclusive and cannot be used in conjunction with each other.
9592
:::
9693

9794
## Common policies
@@ -100,36 +97,170 @@ Disable copy / paste and Disable clipboard redirection are mutually exclusive an
10097

10198
Isolate security threats such as malware and phishing.
10299

103-
| Selector | Operator | Value | Action |
104-
| -------------- | -------- | ------------------ | ------- |
105-
| Security Risks | in | All security risks | Isolate |
100+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
101+
102+
| Selector | Operator | Value | Action |
103+
| ------------------- | -------- | -------------------- | ------- |
104+
| Security Categories | in | _All security risks_ | Isolate |
105+
106+
</TabItem>
107+
108+
<TabItem label="API">
109+
110+
```bash
111+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
112+
--header "Content-Type: application/json" \
113+
--header "Authorization: Bearer <API_TOKEN>" \
114+
--data '{
115+
"name": "Isolate all security threats",
116+
"description": "Isolate security threats such as malware and phishing",
117+
"enabled": true,
118+
"action": "isolate",
119+
"filters": [
120+
"http"
121+
],
122+
"traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
123+
"identity": "",
124+
"device_posture": ""
125+
}'
126+
```
127+
128+
</TabItem> </Tabs>
106129

107130
### Isolate high risk content
108131

109132
Isolate high risk content categories such as newly registered domains.
110133

111-
| Selector | Operator | Value | Action |
112-
| ------------------ | -------- | -------------- | ------- |
113-
| Content categories | in | Security Risks | Isolate |
134+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
135+
136+
| Selector | Operator | Value | Action |
137+
| ------------------ | -------- | ---------------- | ------- |
138+
| Content Categories | in | _Security Risks_ | Isolate |
139+
140+
</TabItem>
141+
142+
<TabItem label="API">
143+
144+
```bash
145+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
146+
--header "Content-Type: application/json" \
147+
--header "Authorization: Bearer <API_TOKEN>" \
148+
--data '{
149+
"name": "Isolate high risk content",
150+
"description": "Isolate high risk content categories such as newly registered domains",
151+
"enabled": true,
152+
"action": "isolate",
153+
"filters": [
154+
"http"
155+
],
156+
"traffic": "any(http.request.uri.content_category[*] in {32 169 177 128})",
157+
"identity": "",
158+
"device_posture": ""
159+
}'
160+
```
161+
162+
</TabItem> </Tabs>
114163

115164
### Isolate news and media
116165

117166
Isolate news and media sites, which are targets for malvertising attacks.
118167

119-
| Selector | Operator | Value | Action |
120-
| ------------------ | -------- | -------------- | ------- |
121-
| Content categories | in | News and Media | Isolate |
168+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
169+
170+
| Selector | Operator | Value | Action |
171+
| ------------------ | -------- | ---------------- | ------- |
172+
| Content Categories | in | _News and Media_ | Isolate |
173+
174+
</TabItem>
175+
176+
<TabItem label="API">
177+
178+
```bash
179+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
180+
--header "Content-Type: application/json" \
181+
--header "Authorization: Bearer <API_TOKEN>" \
182+
--data '{
183+
"name": "Isolate news and media",
184+
"description": "Isolate news and media sites, which are targets for malvertising attacks",
185+
"enabled": true,
186+
"action": "isolate",
187+
"filters": [
188+
"http"
189+
],
190+
"traffic": "any(http.request.uri.content_category[*] in {122})",
191+
"identity": "",
192+
"device_posture": ""
193+
}'
194+
```
195+
196+
</TabItem> </Tabs>
122197

123198
### Isolate uncategorized content
124199

125200
Isolate content that has not been categorized by [Cloudflare Radar](/radar/).
126201

127-
| Selector | Operator | Value | Action |
128-
| ------------------ | -------- | ---------------------- | ------- |
129-
| Content categories | not in | All content categories | Isolate |
202+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
203+
204+
| Selector | Operator | Value | Action |
205+
| ------------------ | -------- | ------------------------ | ------- |
206+
| Content Categories | not in | _All content categories_ | Isolate |
207+
208+
</TabItem>
209+
210+
<TabItem label="API">
211+
212+
```bash
213+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
214+
--header "Content-Type: application/json" \
215+
--header "Authorization: Bearer <API_TOKEN>" \
216+
--data '{
217+
"name": "Isolate uncategorized content",
218+
"description": "Isolate content not categorized by Cloudflare Radar",
219+
"enabled": true,
220+
"action": "isolate",
221+
"filters": [
222+
"http"
223+
],
224+
"traffic": "not(any(http.request.uri.content_category[*] in {2 67 125 133 3 75 183 89 182 6 90 91 144 150 7 70 74 76 79 92 96 100 106 107 116 120 121 122 127 139 156 164 99 9 101 137 10 103 146 11 12 77 98 108 110 111 118 126 129 172 168 113 33 179 166 15 115 119 124 141 161 17 85 87 102 157 135 138 180 162 140 142 32 169 177 128 22 73 82 88 148 23 24 181 71 72 173 78 84 86 94 97 104 105 114 174 93 130 132 136 147 149 154 158 152 26 69 184 81 95 109 123 145 155 159 160 163 165 167}))",
225+
"identity": "",
226+
"device_posture": ""
227+
}'
228+
```
229+
230+
</TabItem> </Tabs>
130231

131232
### Isolate ChatGPT
132233

133234
Isolate the use of ChatGPT.
134235

135-
<Render file="gateway/policies/isolate-chatgpt" />
236+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
237+
238+
| Selector | Operator | Value | Action |
239+
| ----------- | -------- | --------- | ------- |
240+
| Application | in | _ChatGPT_ | Isolate |
241+
242+
In **Configure policy settings**, you can customize restrictions for ChatGPT. For example, to prevent your users from inputting sensitive information, you can select **Disable copy / paste** and **Disable file uploads**.
243+
244+
</TabItem>
245+
246+
<TabItem label="API">
247+
248+
```bash
249+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
250+
--header "Content-Type: application/json" \
251+
--header "Authorization: Bearer <API_TOKEN>" \
252+
--data '{
253+
"name": "Isolate ChatGPT",
254+
"description": "Isolate the use of ChatGPT",
255+
"enabled": true,
256+
"action": "isolate",
257+
"filters": [
258+
"http"
259+
],
260+
"traffic": "any(app.ids[*] in {1199})",
261+
"identity": "",
262+
"device_posture": ""
263+
}'
264+
```
265+
266+
</TabItem> </Tabs>

‎src/content/docs/cloudflare-one/policies/data-loss-prevention/dlp-policies/common-policies.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ The **Allow** action functions as an implicit logger, providing visibility into
2121
| DLP Profile | in | _Financial Information_ | And | Allow |
2222
| Content Categories | in | _File Sharing_ | | |
2323

24+
## Block file types
25+
2426
<Render file="gateway/policies/block-file-types" />
2527

2628
For more information on what file formats DLP can scan, refer to [Supported file types](/cloudflare-one/policies/data-loss-prevention/#supported-file-types).

0 commit comments

Comments
 (0)