Skip to content

Commit 7b5c047

Browse files
pedrosousapedrosousa
committed
[WAF] Add sensitive data detection API example
1 parent 12531cf commit 7b5c047

File tree

1 file changed

+115
-3
lines changed

1 file changed

+115
-3
lines changed

‎src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx‎

Lines changed: 115 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,117 @@ For details on configuring a managed ruleset in the dashboard, refer to [Configu
4242

4343
## Configure via API
4444

45-
To enable Cloudflare Sensitive Data Detection for a given zone using the API, create a rule with `execute` action in the entry point ruleset for the `http_response_firewall_managed` phase. For more information on deploying a managed ruleset, refer to [Deploy a managed ruleset](/ruleset-engine/managed-rulesets/deploy-managed-ruleset/).
46-
47-
The ruleset ID is the following: <RuleID id="e22d83c647c64a3eae91b71b499d988e" />.
45+
To enable Cloudflare Sensitive Data Detection for a given zone using the API, create a rule with `execute` action in the entry point ruleset for the `http_response_firewall_managed` phase.
46+
47+
### Example
48+
49+
This example deploys the Cloudflare Sensitive Data Detection managed ruleset to the `http_response_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed for all incoming requests.
50+
51+
1. Search for an existing [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_response_firewall_managed` phase using the [List zone rulesets](/api/operations/listZoneRulesets) operation and take note of the ruleset ID. This ruleset, if it exists, has the following properties: `"kind": "zone"` and `"phase": "http_response_firewall_managed"`.
52+
53+
```bash
54+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
55+
--header "Authorization: Bearer <API_TOKEN>"
56+
```
57+
58+
```json output {5,9,12}
59+
{
60+
"result": [
61+
// ...
62+
{
63+
"id": "<RULESET_ID>",
64+
"name": "default",
65+
"description": "",
66+
"source": "firewall_managed",
67+
"kind": "zone",
68+
"version": "5",
69+
"last_updated": "2024-07-22T16:04:19.788697Z",
70+
"phase": "http_response_firewall_managed"
71+
}
72+
// ...
73+
],
74+
"success": true,
75+
"errors": [],
76+
"messages": []
77+
}
78+
```
79+
80+
2. If the entry point ruleset does not exist (the previous command returned a `404 Not Found` status code), create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the [Cloudflare Sensitive Data Detection managed ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/) (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />) for all incoming requests in the zone.
81+
82+
```bash
83+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
84+
--header "Authorization: Bearer <API_TOKEN>" \
85+
--header "Content-Type: application/json" \
86+
--data '{
87+
"name": "My ruleset",
88+
"description": "Entry point ruleset for WAF managed rulesets (response)",
89+
"kind": "zone",
90+
"phase": "http_response_firewall_managed",
91+
"rules": [
92+
{
93+
"action": "execute",
94+
"action_parameters": {
95+
"id": "e22d83c647c64a3eae91b71b499d988e"
96+
},
97+
"expression": "true",
98+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset"
99+
}
100+
]
101+
}'
102+
```
103+
104+
If the entry point ruleset already exists, add a rule to this ruleset (with ID `{ruleset_id}`) using the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation. This rule executes the Cloudflare Sensitive Data Detection managed ruleset (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />) for all incoming requests in the zone.
105+
106+
```bash
107+
curl --request PUT \
108+
"https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
109+
--header "Authorization: Bearer <API_TOKEN>" \
110+
--header "Content-Type: application/json" \
111+
--data '{
112+
"action": "execute",
113+
"action_parameters": {
114+
"id": "e22d83c647c64a3eae91b71b499d988e"
115+
},
116+
"expression": "true",
117+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset"
118+
}'
119+
```
120+
121+
```json output
122+
{
123+
"result": {
124+
"id": "<RULESET_ID>",
125+
"name": "Zone-level phase entry point",
126+
"description": "",
127+
"kind": "zone",
128+
"version": "3",
129+
"rules": [
130+
// ... any existing rules
131+
{
132+
"id": "<RULE_ID>",
133+
"version": "1",
134+
"action": "execute",
135+
"action_parameters": {
136+
"id": "e22d83c647c64a3eae91b71b499d988e",
137+
"version": "latest"
138+
},
139+
"expression": "true",
140+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset",
141+
"last_updated": "2024-03-18T18:08:14.003361Z",
142+
"ref": "<RULE_REF>",
143+
"enabled": true
144+
}
145+
],
146+
"last_updated": "2024-03-18T18:08:14.003361Z",
147+
"phase": "http_response_firewall_managed"
148+
},
149+
"success": true,
150+
"errors": [],
151+
"messages": []
152+
}
153+
```
154+
155+
### Next steps
48156

49157
To configure Cloudflare Sensitive Data Detection using the API, create [overrides](/ruleset-engine/managed-rulesets/override-managed-ruleset/) using the Rulesets API. You can perform the following configurations:
50158

@@ -53,6 +161,10 @@ To configure Cloudflare Sensitive Data Detection using the API, create [override
53161

54162
For examples of creating overrides using the API, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
55163

164+
### More resources
165+
166+
For more information on working with managed rulesets via API, refer to [Work with managed rulesets](/ruleset-engine/managed-rulesets/) in the Ruleset Engine documentation.
167+
56168
## Review detected leaks
57169

58170
To check for any data leaks detected by Cloudflare Sensitive Data Detection, you can do the following:

0 commit comments

Comments
 (0)