Skip to content

Commit 8ad0595

Browse files
maxvpthomasgauvin
maxvp
authored and
thomasgauvin
committed
[ZT] Remove single use partials (#24274)
* Remove Gateway partials * Remove learning path partial
1 parent 3c121a0 commit 8ad0595

File tree

19 files changed

+127
-190
lines changed

19 files changed

+127
-190
lines changed

‎src/content/docs/cloudflare-one/insights/logs/gateway-logs/index.mdx‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -195,19 +195,19 @@ When an HTTP request results in an error, Gateway logs the first 512 bytes of th
195195

196196
#### Basic information
197197

198-
| Field | Description |
199-
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
200-
| **Host** | Hostname in the HTTP header for the HTTP request. Gateway will log the SNI in this field if it responded to the request with a Do Not Inspect action. If Gateway does not receive the SNI, this field will be empty. |
201-
| **Email** | Email address of the user who made the HTTP request. This is generated by the WARP client. |
202-
| **Action** | The Gateway [Action](/cloudflare-one/policies/gateway/dns-policies/#actions) taken based on the first rule that matched (such as Allow or Block). |
203-
| **Request ID** | Unique ID of the request. |
204-
| **Time** | Date and time of the HTTP request. |
205-
| **Source internal IP** | Private IP address assigned by the user's local network. |
206-
| **User agent** | User agent header sent in the request by the originating device. |
207-
| **Policy details** | Policy corresponding to the decision Gateway made based on the traffic criteria of the request. |
208-
| **DLP profiles** | Name of the matched [DLP profile](/cloudflare-one/policies/data-loss-prevention/dlp-profiles/). |
209-
| **DLP profile entries** | Name of the matched entry within the DLP profile. |
210-
| **Uploaded/downloaded file** | <Render file="gateway/uploaded-downloaded-file" /> |
198+
| Field | Description |
199+
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
200+
| **Host** | Hostname in the HTTP header for the HTTP request. Gateway will log the SNI in this field if it responded to the request with a Do Not Inspect action. If Gateway does not receive the SNI, this field will be empty. |
201+
| **Email** | Email address of the user who made the HTTP request. This is generated by the WARP client. |
202+
| **Action** | The Gateway [Action](/cloudflare-one/policies/gateway/dns-policies/#actions) taken based on the first rule that matched (such as Allow or Block). |
203+
| **Request ID** | Unique ID of the request. |
204+
| **Time** | Date and time of the HTTP request. |
205+
| **Source internal IP** | Private IP address assigned by the user's local network. |
206+
| **User agent** | User agent header sent in the request by the originating device. |
207+
| **Policy details** | Policy corresponding to the decision Gateway made based on the traffic criteria of the request. |
208+
| **DLP profiles** | Name of the matched [DLP profile](/cloudflare-one/policies/data-loss-prevention/dlp-profiles/). |
209+
| **DLP profile entries** | Name of the matched entry within the DLP profile. |
210+
| **Uploaded/downloaded file** | Information about the file transferred in the request found by [enhanced file detection](#enhanced-file-detection). Details include: <ul><li>File name</li><li>File type</li><li>File size</li><li>File hash (for Allowed requests only)</li><li>Content type</li><li>Direction (Upload/Download)</li><li>Action (Block/Allow)</li></ul> |
211211

212212
#### Matched policies
213213

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,13 @@ Use this selector to filter DNS responses by their `TXT` records.
360360

361361
### Indicator Feeds
362362

363-
<Render file="gateway/selectors/indicator-feeds" params={{ one: "dns" }} />
363+
Use this selector to match against custom indicator feeds.
364+
365+
You can use a [publicly available indicator feed](/security-center/indicator-feeds/#publicly-available-feeds) or a custom indicator feed assigned to your account by a designated third-party vendor. For more information on indicator feeds, refer to [Custom Indicator Feeds](/security-center/indicator-feeds/).
366+
367+
| UI name | API example | Evaluation phase |
368+
| --------------- | -------------------- | --------------------- |
369+
| Indicator Feeds | `dns.indicator_feed` | Before DNS resolution |
364370

365371
<Render file="gateway/selectors/category-options" />
366372

‎src/content/docs/cloudflare-one/policies/gateway/domain-categories.mdx‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,13 @@ sidebar:
55
order: 10
66
---
77

8-
import { Render } from "~/components";
9-
108
Cloudflare Gateway allows you to block known and potential security risks on the public Internet, as well as specific categories of content. Domains are categorized by [Cloudflare Radar](/radar/glossary/#content-categories).
119

12-
<Render file="gateway/domain-categories" />
10+
Cloudflare categorizes domains into content categories and security categories, which cover security risks and security threats:
11+
12+
- **Content categories**: An upstream vendor supplies content categories for domains. These categories help us organize domains into broad topic areas. However, the specific criteria and methods used by our vendor may not be disclosed.
13+
- **Security risks**: Cloudflare determines security risks for domains using internal models. These models analyze various factors, including the age of a domain and its reputation. This allows us to identify potentially risky domains.
14+
- **Security threats**: To identify malicious domains that pose security threats, Cloudflare employs a mix of internal data sources, machine learning models, commercial feeds, and open-source threat intelligence.
1315

1416
You can block security and content categories by creating DNS or HTTP policies. Once you have configured your policies, you will be able to inspect network activity and the associated categories in your Gateway logs.
1517

@@ -71,7 +73,6 @@ Subdomains that have not been assigned a category will inherit the category of t
7173
| Violence | Sites hosting and/or promoting violent content. |
7274
| Weather | Sites related to weather. |
7375

74-
7576
### Miscellaneous subcategories
7677

7778
| Category | Definition |

‎src/content/docs/cloudflare-one/policies/gateway/initial-setup/dns.mdx‎

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ learning_center:
1111
link: https://www.cloudflare.com/learning/access-management/what-is-dns-filtering/
1212
---
1313

14-
import { GlossaryTooltip, Render } from "~/components";
14+
import { GlossaryTooltip, Render, Tabs, TabItem } from "~/components";
1515

1616
Secure Web Gateway allows you to inspect DNS traffic and control which websites users can visit.
1717

@@ -55,7 +55,65 @@ To verify your device is connected to Zero Trust:
5555

5656
## 3. Create your first DNS policy
5757

58-
<Render file="gateway/get-started/create-dns-policy" />
58+
To create a new DNS policy:
59+
60+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
61+
62+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
63+
2. In the **DNS** tab, select **Add a policy**.
64+
3. Name the policy.
65+
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block.
66+
5. Choose an **Action** to take when traffic matches the logical expression. For example, we recommend adding a policy to block all [security categories](/cloudflare-one/policies/gateway/domain-categories/#security-categories):
67+
<Render
68+
file="gateway/policies/block-security-categories"
69+
product="cloudflare-one"
70+
/>
71+
6. Select **Create policy**.
72+
73+
</TabItem>
74+
75+
<TabItem label="API">
76+
77+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
78+
79+
| Type | Item | Permission |
80+
| ------- | ---------- | ---------- |
81+
| Account | Zero Trust | Edit |
82+
83+
2. (Optional) Configure your API environment variables to include your [account ID](/fundamentals/account/find-account-and-zone-ids/) and API token.
84+
3. Send a `POST` request to the [Create a Zero Trust Gateway rule](/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/create/) endpoint. For example, we recommend adding a policy to block all [security categories](/cloudflare-one/policies/gateway/domain-categories/#security-categories):
85+
86+
```sh title="curl API DNS policy example"
87+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
88+
--header "Content-Type: application/json" \
89+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
90+
--data '{
91+
"name": "Block security threats",
92+
"description": "Block all default Cloudflare DNS security categories",
93+
"precedence": 0,
94+
"enabled": true,
95+
"action": "block",
96+
"filters": [
97+
"dns"
98+
],
99+
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
100+
"identity": ""
101+
}'
102+
```
103+
104+
```sh output
105+
{
106+
"success": true,
107+
"errors": [],
108+
"messages": []
109+
}
110+
```
111+
112+
The API will respond with a summary of the policy and the result of your request.
113+
114+
</TabItem> </Tabs>
115+
116+
For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/).
59117

60118
## 4. Add optional policies
61119

‎src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,11 @@ Gateway matches network traffic against the following selectors, or criteria.
286286

287287
### Detected Protocol
288288

289-
<Render file="gateway/selectors/protocol-detection" />
289+
The inferred network protocol based on Cloudflare's [protocol detection](/cloudflare-one/policies/gateway/network-policies/protocol-detection/).
290+
291+
| UI name | API example |
292+
| ----------------- | --------------------------------- |
293+
| Detected Protocol | `net.protocol.detection == "ssh"` |
290294

291295
### Device Posture
292296

@@ -315,11 +319,23 @@ To enable Gateway filtering on TCP and UDP, go to **Settings** > **Network** > *
315319

316320
### SNI
317321

318-
<Render file="gateway/selectors/sni" />
322+
The host whose Server Name Indication (SNI) header Gateway will filter traffic against. This will allow for an exact match.
323+
324+
This selector only applies to traffic on port `443`.
325+
326+
| UI name | API example |
327+
| ------- | ----------------------------------- |
328+
| SNI | `net.sni.host == "www.example.com"` |
319329

320330
### SNI Domain
321331

322-
<Render file="gateway/selectors/sni-domain" />
332+
The domain whose Server Name Indication (SNI) header Gateway will filter traffic against. For example, a rule for `example.com` will match `example.com`, `www.example.com`, and `my.test.example.com`.
333+
334+
This selector only applies to traffic on port `443`.
335+
336+
| UI name | API example |
337+
| ---------- | ---------------------------------- |
338+
| SNI Domain | `net.sni.domains == "example.com"` |
323339

324340
### Source Continent
325341

‎src/content/docs/learning-paths/cybersafe/gateway-onboarding/gateway-create-cipa-policy.mdx‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,12 @@ import { Render } from "~/components";
1010
## Create CIPA policy
1111

1212
1. Go to **Gateway** > **Firewall policies**.
13-
2. Create a policy to block using the CIPA filter: <Render file="gateway/policies/block-cipa" product="cloudflare-one" />
13+
2. Create a policy to block using the CIPA filter:
14+
15+
| Selector | Operator | Value | Action |
16+
| ------------------ | -------- | ------------- | ------ |
17+
| Content Categories | in | _CIPA Filter_ | Block |
18+
1419
3. In **Logs** > **Gateway** > **DNS**, verify that you see the blocked domain.
1520

1621
Your environment is now protected against all of the subcategories listed in [Configuration](/fundamentals/reference/policies-compliances/cybersafe/#configuration).

‎src/content/partials/cloudflare-one/gateway/domain-categories.mdx‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎src/content/partials/cloudflare-one/gateway/get-started/create-dns-policy.mdx‎

Lines changed: 0 additions & 65 deletions
This file was deleted.

0 commit comments

Comments
 (0)