Skip to content

Commit bc1bbdc

Browse files
committed
move posture checks
1 parent 9ca6f12 commit bc1bbdc

File tree

78 files changed

+155
-154
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

78 files changed

+155
-154
lines changed

public/__redirects

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2397,6 +2397,7 @@
23972397
/cloudflare-one/identity/devices/service-providers/* /cloudflare-one/integrations/service-providers/:splat 301
23982398
/cloudflare-one/applications/configure-apps/* /cloudflare-one/access-controls/applications/http-apps/:splat 301
23992399
/cloudflare-one/applications/non-http/* /cloudflare-one/access-controls/applications/non-http/:splat 301
2400+
/cloudflare-one/identity/devices/* /cloudflare-one/reusable-components/posture-checks/:splat 301
24002401

24012402
# Learning paths
24022403

src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ However, if you want to update the Minimum TLS settings for all wildcard hostnam
2424

2525
## Enable mTLS
2626

27-
Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) with a few clicks.
27+
Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) with a few clicks.
2828

2929
:::note
3030
Currently, you cannot add mTLS policies for custom hostnames using [API Shield](/api-shield/security/mtls/).

src/content/docs/cloudflare-one/access-controls/policies/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ Non-identity attributes are polled continuously, meaning they are-evaluated with
152152
| Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/team-and-resources/users/scim/). ||||
153153
| SAML Group | Checks a SAML attribute name / value pair. This selector only displays if you use a [generic SAML](/cloudflare-one/integrations/identity-providers/generic-saml/) identity provider. ||||
154154
| OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/integrations/identity-providers/generic-oidc/) identity provider. ||||
155-
| Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. ||||
155+
| Device posture | Checks [device posture signals](/cloudflare-one/reusable-components/posture-checks/) from the WARP client or a third-party service provider. ||||
156156
| Warp | Checks that the device is connected to WARP, including the consumer version. ||||
157157
| Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). ||||
158158

src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ You can configure access on a per-user or group basis by adding [identity-based
4141

4242
Many Android applications (such as Google Drive) use <GlossaryTooltip term="certificate pinning" link="/ssl/reference/certificate-pinning/">certificate pinning</GlossaryTooltip>, which is incompatible with Gateway inspection. If needed, you can create a [Do Not Inspect policy](/cloudflare-one/traffic-policies/http-policies/#do-not-inspect) so that the app can continue to function on Android:
4343

44-
1. Set up an [OS version device posture check](/cloudflare-one/identity/devices/warp-client-checks/os-version/) that checks for the Android operating system.
44+
1. Set up an [OS version device posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) that checks for the Android operating system.
4545

4646
2. Create the following HTTP policy in Gateway:
4747

src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx

Lines changed: 0 additions & 33 deletions
This file was deleted.

src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ sidebar:
66

77
---
88

9-
Posture logs show the [device posture check](/cloudflare-one/identity/devices/) results reported by the WARP client.
9+
Posture logs show the [device posture check](/cloudflare-one/reusable-components/posture-checks/) results reported by the WARP client.
1010

11-
To view device posture logs, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Logs** > **Posture**. Logs will only display if you have configured [device posture checks](/cloudflare-one/identity/devices/) for your Zero Trust organization.
11+
To view device posture logs, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Logs** > **Posture**. Logs will only display if you have configured [device posture checks](/cloudflare-one/reusable-components/posture-checks/) for your Zero Trust organization.
1212

1313
Enterprise users can generate more detailed logs with [Logpush](/cloudflare-one/insights/logs/logpush/).
1414

@@ -37,7 +37,7 @@ Enterprise users can generate more detailed logs with [Logpush](/cloudflare-one/
3737
| Field | Description |
3838
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
3939
| **Name** | Name of the [device posture check](/cloudflare-one/identity/devices). |
40-
| **Type** | Type of [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) or [service provider check](/cloudflare-one/integrations/service-providers/). |
40+
| **Type** | Type of [WARP client check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) or [service provider check](/cloudflare-one/integrations/service-providers/). |
4141
| **Rule ID** | UUID of the device posture check. |
4242
| **Conditions met** | Whether the device passed or failed the posture check criteria. Evaluates to `true` if the **Received values** match the **Expected values**. |
4343
| **Expected values** | Values required to pass the device posture check. |

src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ To establish a secure, outbound-only connection to Cloudflare:
4646

4747
## 4. (Recommended) Create a Gateway policy
4848

49-
You can configure [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass [device posture checks](/cloudflare-one/identity/devices/), and the second blocks all other traffic. Make sure that the Allow policy has higher [priority](/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence).
49+
You can configure [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass [device posture checks](/cloudflare-one/reusable-components/posture-checks/), and the second blocks all other traffic. Make sure that the Allow policy has higher [priority](/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence).
5050

5151
### 1. Allow secured devices
5252

src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx renamed to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ These device posture checks can only be enforced for Cloudflare Access applicati
1010
| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) |
1111
| ----------------------------------------------------------------------------------------------- | ----- | ------- | ----- | --- | ---------------- | ---------------------------------------------------------------------------------------- |
1212
| [Microsoft Entra ID Conditional Access](/cloudflare-one/tutorials/entra-id-conditional-access/) |||||| WARP not required |
13-
| [Mutual TLS](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) |||||| WARP not required |
14-
| [Tanium](/cloudflare-one/identity/devices/access-integrations/tanium/) |||||| Gateway with WARP, Secure Web Gateway without DNS filtering, or Device Information Only |
13+
| [Mutual TLS](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) |||||| WARP not required |
14+
| [Tanium](/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium/) |||||| Gateway with WARP, Secure Web Gateway without DNS filtering, or Device Information Only |

src/content/docs/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx renamed to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Only available on Enterprise plans.
1515

1616
With a root certificate authority (CA) in place, Access only allows requests from devices with a corresponding client certificate. When a request reaches the application, Access responds with a request for the client to present a certificate. If the device fails to present the certificate, the request is not allowed to proceed. If the client does have a certificate, Access completes a key exchange to verify.
1717

18-
![mTLS handshake diagram](~/assets/images/cloudflare-one/identity/devices/mtls.png)
18+
![mTLS handshake diagram](~/assets/images/cloudflare-one/reusable-components/posture-checks/mtls.png)
1919

2020
:::caution[Important]
2121

src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx renamed to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ The Tanium integration cannot be used with [Gateway device posture policies](/cl
3030
product="cloudflare-one"
3131
params={{
3232
name: "Access integrations",
33-
link: "/cloudflare-one/identity/devices/access-integrations/",
33+
link: "/cloudflare-one/reusable-components/posture-checks/access-integrations/",
3434
}}
3535
/>
3636

0 commit comments

Comments
 (0)