Skip to content

Commit ce486e0

Browse files
pedrosousapedrosousa
authored
[WAF] Update field tables (#24601)
1 parent 2855508 commit ce486e0

File tree

4 files changed

+64
-41
lines changed

4 files changed

+64
-41
lines changed

‎src/content/docs/waf/detections/attack-score.mdx‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66
label: Attack score
77
---
88

9-
import { GlossaryTooltip } from "~/components";
9+
import { GlossaryTooltip, Type } from "~/components";
1010

1111
The attack score [traffic detection](/waf/concepts/#detection-versus-mitigation) helps identify variations of known attacks and their malicious payloads. This detection complements [WAF Managed Rules](/waf/managed-rules/).
1212

@@ -24,17 +24,22 @@ This feature is available to Enterprise customers. Business plans have access to
2424

2525
The Cloudflare WAF provides the following attack score fields:
2626

27-
| Score | Data type | Minimum plan required | Attack vector | Field |
28-
| ---------------------- | --------- | --------------------- | -------------------------------- | ------------------------------------------------------------------------------------------- |
29-
| WAF Attack Score | Number | Enterprise | N/A (global score) | [`cf.waf.score`](/ruleset-engine/rules-language/fields/reference/cf.waf.score/) |
30-
| WAF SQLi Attack Score | Number | Enterprise | [SQL injection][1] (SQLi) | [`cf.waf.score.sqli`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/) |
31-
| WAF XSS Attack Score | Number | Enterprise | [Cross-site scripting][2] (XSS) | [`cf.waf.score.xss`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/) |
32-
| WAF RCE Attack Score | Number | Enterprise | [Remote code execution][3] (RCE) | [`cf.waf.score.rce`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/) |
33-
| WAF Attack Score Class | String | Business | N/A (global classification) | [`cf.waf.score.class`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.class/) |
34-
35-
[1]: https://www.cloudflare.com/learning/security/threats/sql-injection/
36-
[2]: https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
37-
[3]: https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
27+
| Field | Description | Required plan |
28+
| ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- |
29+
| WAF Attack Score <br/> [`cf.waf.score`][1] <br/> <Type text="Number" /> | A global score from 1–99 that combines the score of each WAF attack vector into a single score. | Enterprise |
30+
| WAF SQLi Attack Score <br/> [`cf.waf.score.sqli`][2] <br/> <Type text="Number" /> | A score from 1–99 classifying the [SQL injection][6] (SQLi) attack vector. | Enterprise |
31+
| WAF XSS Attack Score <br/> [`cf.waf.score.xss`][3] <br/> <Type text="Number" /> | A score from 1–99 classifying the [cross-site scripting][7] (XSS) attack vector. | Enterprise |
32+
| WAF RCE Attack Score <br/> [`cf.waf.score.rce`][4] <br/> <Type text="Number" /> | A score from 1–99 classifying the command injection or [remote code execution][8] (RCE) attack vector. | Enterprise |
33+
| WAF Attack Score Class <br/> [`cf.waf.score.class`][5] <br/> <Type text="String" /> | The attack score class of the current request, based on the WAF attack score. <br/> Possible values: `attack`, `likely_attack`, `likely_clean`, and `clean`. | Business or above |
34+
35+
[1]: /ruleset-engine/rules-language/fields/reference/cf.waf.score/
36+
[2]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/
37+
[3]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/
38+
[4]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/
39+
[5]: /ruleset-engine/rules-language/fields/reference/cf.waf.score.class/
40+
[6]: https://www.cloudflare.com/learning/security/threats/sql-injection/
41+
[7]: https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
42+
[8]: https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
3843

3944
You can use these fields in expressions of [custom rules](/waf/custom-rules/) and [rate limiting rules](/waf/rate-limiting-rules/). Attack score fields of data type `Number` vary between `1` and `99` with the following meaning:
4045

‎src/content/docs/waf/detections/firewall-for-ai.mdx‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Firewall for AI is a detection that can help protect your services powered by <G
2020

2121
When enabled, the detection runs on incoming traffic, searching for any LLM prompts attempting to exploit the model.
2222

23-
Cloudflare will populate the existing [Firewall for AI fields](#fields) based on the scan results. You can check these results in the [Security Analytics](/waf/analytics/security-analytics/) dashboard by filtering on the `cf-llm` [managed endpoint label](/api-shield/management-and-monitoring/endpoint-labels/) and reviewing the detection results on your traffic. Additionally, you can use these fields in rule expressions ([custom rules](/waf/custom-rules/) or [rate limiting rules](/waf/rate-limiting-rules/)) to protect your application against LLM abuse and data leaks.
23+
Cloudflare will populate the existing [Firewall for AI fields](#firewall-for-ai-fields) based on the scan results. You can check these results in the [Security Analytics](/waf/analytics/security-analytics/) dashboard by filtering on the `cf-llm` [managed endpoint label](/api-shield/management-and-monitoring/endpoint-labels/) and reviewing the detection results on your traffic. Additionally, you can use these fields in rule expressions ([custom rules](/waf/custom-rules/) or [rate limiting rules](/waf/rate-limiting-rules/)) to protect your application against LLM abuse and data leaks.
2424

2525
## Availability
2626

@@ -86,7 +86,7 @@ Alternatively, create a custom rule like the one described in the next step usin
8686
- **With response type**: Custom JSON
8787
- **Response body**: `{ "error": "Your request was blocked. Please rephrase your request." }`
8888

89-
For additional examples, refer to [Example mitigation rules](#example-mitigation-rules). For a list of fields provided by Firewall for AI, refer to [Fields](#fields).
89+
For additional examples, refer to [Example mitigation rules](#example-mitigation-rules). For a list of fields provided by Firewall for AI, refer to [Fields](#firewall-for-ai-fields).
9090

9191
<Details header="Combine with other Rules language fields">
9292

@@ -114,18 +114,25 @@ You can combine the previous expression with other [fields](/ruleset-engine/rule
114114

115115
</Details>
116116

117-
## Fields
117+
## Firewall for AI fields
118118

119119
When enabled, Firewall for AI populates the following fields:
120120

121-
| Name in the dashboard | Field + Data type | Description |
122-
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
123-
| LLM PII Detected | [`cf.llm.prompt.pii_detected`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_detected/) <br/> <Type text="Boolean"/> | Indicates whether any personally identifiable information (PII) has been detected in the LLM prompt included in the request. |
124-
| LLM PII Categories | [`cf.llm.prompt.pii_categories`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/) <br/> <Type text="Array<String>"/> | Array of string values with the personally identifiable information (PII) categories found in the LLM prompt included in the request.<br/>[Category list](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/) |
125-
| LLM Content Detected | [`cf.llm.prompt.detected`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.detected/) <br/> <Type text="Boolean "/> | Indicates whether Cloudflare detected an LLM prompt in the incoming request. |
126-
| LLM Unsafe topic detected | [`cf.llm.prompt.unsafe_topic_detected`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_detected/) <br/> <Type text="Boolean"/> | Indicates whether the incoming request includes any unsafe topic category in the LLM prompt. |
127-
| LLM Unsafe topic categories | [`cf.llm.prompt.unsafe_topic_categories`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_categories/) <br/> <Type text="Array<String>"/> | Array of string values with the type of unsafe topics detected in the LLM prompt.<br/>[Category list](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_categories/) |
128-
| LLM Injection score | [`cf.llm.prompt.injection_score`](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.injection_score/) <br/> <Type text="Number"/> | A score from 1–99 that represents the likelihood that the LLM prompt in the request is trying to perform a prompt injection attack. |
121+
| Field | Description |
122+
| ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
123+
| LLM PII detected <br/> [`cf.llm.prompt.pii_detected`][1] <br/> <Type text="Boolean"/> | Indicates whether any personally identifiable information (PII) has been detected in the LLM prompt included in the request. |
124+
| LLM PII categories <br/> [`cf.llm.prompt.pii_categories`][2] <br/> <Type text="Array<String>"/> | Array of string values with the personally identifiable information (PII) categories found in the LLM prompt included in the request.<br/>[Category list](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/) |
125+
| LLM Content detected <br/> [`cf.llm.prompt.detected`][3] <br/> <Type text="Boolean "/> | Indicates whether Cloudflare detected an LLM prompt in the incoming request. |
126+
| LLM Unsafe topic detected <br/> [`cf.llm.prompt.unsafe_topic_detected`][4] <br/> <Type text="Boolean"/> | Indicates whether the incoming request includes any unsafe topic category in the LLM prompt. |
127+
| LLM Unsafe topic categories <br/> [`cf.llm.prompt.unsafe_topic_categories`][5] <br/> <Type text="Array<String>"/> | Array of string values with the type of unsafe topics detected in the LLM prompt.<br/>[Category list](/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_categories/) |
128+
| LLM Injection score <br/> [`cf.llm.prompt.injection_score`][6] <br/> <Type text="Number"/> | A score from 1–99 that represents the likelihood that the LLM prompt in the request is trying to perform a prompt injection attack. |
129+
130+
[1]: /ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_detected/
131+
[2]: /ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/
132+
[3]: /ruleset-engine/rules-language/fields/reference/cf.llm.prompt.detected/
133+
[4]: /ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_detected/
134+
[5]: /ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_categories/
135+
[6]: /ruleset-engine/rules-language/fields/reference/cf.llm.prompt.injection_score/
129136

130137
## Example mitigation rules
131138

‎src/content/docs/waf/detections/leaked-credentials/index.mdx‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ sidebar:
77
label: Leaked credentials
88
---
99

10+
import { Type } from "~/components";
11+
1012
The leaked credentials [traffic detection](/waf/detections/) scans incoming requests for credentials (usernames and passwords) previously leaked from [data breaches](https://www.cloudflare.com/learning/security/what-is-a-data-breach/).
1113

1214
:::note
@@ -96,13 +98,13 @@ For instructions on configuring a custom detection location, refer to [Get start
9698

9799
## Leaked credentials fields
98100

99-
| Field name in the dashboard | Field | Availability |
100-
| --------------------------- | ----------------------------------------------------------- | ------------------ |
101-
| Password Leaked | [`cf.waf.credential_check.password_leaked`][1] | All plans |
102-
| User and Password Leaked | [`cf.waf.credential_check.username_and_password_leaked`][2] | Pro plan and above |
103-
| Username Leaked | [`cf.waf.credential_check.username_leaked`][3] | Enterprise plan |
104-
| Similar Password Leaked | [`cf.waf.credential_check.username_password_similar`][4] | Enterprise plan |
105-
| Authentication detected | [`cf.waf.auth_detected`][5] | Enterprise plan |
101+
| Field | Description |
102+
| ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
103+
| Password Leaked <br/> [`cf.waf.credential_check.password_leaked`][1] <br/> <Type text="Boolean" /> | Indicates whether the password detected in the request was previously leaked. <br/> Available on all plans. |
104+
| User and Password Leaked <br/> [`cf.waf.credential_check.username_and_password_leaked`][2] <br/> <Type text="Boolean" /> | Indicates whether the username-password pair detected in the request were previously leaked. <br/> Requires a Pro plan or above. |
105+
| Username Leaked <br/> [`cf.waf.credential_check.username_leaked`][3] <br/> <Type text="Boolean" /> | Indicates whether the username detected in the request was previously leaked. <br/> Requires an Enterprise plan. |
106+
| Similar Password Leaked <br/> [`cf.waf.credential_check.username_password_similar`][4] <br/> <Type text="Boolean" /> | Indicates whether a similar version of the username and password credentials detected in the request were previously leaked. <br/> Requires an Enterprise plan. |
107+
| Authentication detected <br/> [`cf.waf.auth_detected`][5] <br/> <Type text="Boolean" /> | Indicates whether Cloudflare detected authentication credentials in the request. <br/> Requires an Enterprise plan. |
106108

107109
[1]: /ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.password_leaked/
108110
[2]: /ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.username_and_password_leaked/

0 commit comments

Comments
 (0)