Skip to content

Commit d24b28c

Browse files
Maddy-CloudflareMaddy-Cloudflare
authored
[Magic Firewall] Restructure IA (#26096)
* [Magic Firewall] Restructure IA * Adding more files * Add enable managed rules + fix links * Add remaining pages * Fix ordering * Add packet filtering + fix broken link
1 parent 4150276 commit d24b28c

File tree

31 files changed

+2041
-18
lines changed

31 files changed

+2041
-18
lines changed

‎src/content/changelog/magic-firewall/2024-10-02-custom-rule-search.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ The Magic Firewall dashboard now allows you to search custom rules using the rul
1515

1616
Additionally, the rule ID URL link has been added to Network Analytics.
1717

18-
For more details about rules, refer to [Add rules](/magic-firewall/how-to/add-rules/).
18+
For more details about rules, refer to [Add rules](/cloudflare-one/traffic-policies/packet-filtering/add-rules/).

‎src/content/docs/cloudflare-one/changelog/magic-firewall.mdx‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
pcx_content_type: changelog
3+
title: Magic Firewall
4+
---
5+
6+
import { ProductChangelog } from "~/components";
7+
8+
{/* <!-- Actual content lives in /src/content/changelog/magic-firewall/. Update the file there for new entries to appear here. For more details, refer to https://developers.cloudflare.com/style-guide/documentation-content-strategy/content-types/changelog/#yaml-file --> */}
9+
10+
<ProductChangelog product="magic-firewall" hideEntry="2024-06-16-cloudflare-one"/>
11+
12+
## 2024-09-12
13+
14+
**New UI improvements**
15+
16+
The dashboard now displays the order number of custom rules, and improved drag and drop functionality. You can also preview rules on a side panel without leaving the current page.
17+
18+
## 2024-08-16
19+
20+
**Magic Firewall Analytics Rule Log Enhancement**
21+
22+
Customers who create a rule in a disabled mode will see the rule as **Log (rule disabled)**.

‎src/content/docs/cloudflare-one/insights/logs/filter-views.mdx‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
title: Filter different views
3+
pcx_content_type: how-to
4+
5+
---
6+
7+
You can utilize different [Log filters](/logs/logpush/logpush-job/filters/) to only view specific data from Magic Firewall.
8+
9+
## Filter by enabled or disabled rules
10+
11+
Use the filter examples below to filter your Magic Firewall traffic to display events for enabled or disabled rules.
12+
13+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events for disabled rules.
14+
15+
```bash
16+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
17+
--header "X-Auth-Email: <EMAIL>" \
18+
--header "X-Auth-Key: <API_KEY>" \
19+
--header "Content-Type: application/json" \
20+
--data '{
21+
...
22+
"output_options": {
23+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
24+
},
25+
"filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"pass\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"drop\"}]}]}}"
26+
}'
27+
```
28+
29+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events for enabled rules.
30+
31+
```bash
32+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
33+
--header "X-Auth-Email: <EMAIL>" \
34+
--header "X-Auth-Key: <API_KEY>" \
35+
--header "Content-Type: application/json" \
36+
--data '{
37+
...
38+
"output_options": {
39+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
40+
},
41+
"filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"or\":[{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"drop\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"pass\"}]}]}]}}"
42+
}'
43+
```
44+
45+
## Filter by allowed or blocked traffic
46+
47+
Use the filter examples below to filter your Magic Firewall traffic to display events for allowed or blocked traffic.
48+
49+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events where no explicit action was taken, for example, a packet "fell through" Magic Firewall. This example does not have any rules applied.
50+
51+
```bash
52+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
53+
--header "X-Auth-Email: <EMAIL>" \
54+
--header "X-Auth-Key: <API_KEY>" \
55+
--header "Content-Type: application/json" \
56+
--data '{
57+
...
58+
"output_options": {
59+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
60+
},
61+
"filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"eq\",\"value\":\"\"}]}}"
62+
}'
63+
```
64+
65+
The example below only displays fields relevant to Magic Firewall, and the filter only displays events where explicit action was taken. The example includes both enabled and disabled Magic Firewall rules.
66+
67+
```bash
68+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
69+
--header "X-Auth-Email: <EMAIL>" \
70+
--header "X-Auth-Key: <API_KEY>" \
71+
--header "Content-Type: application/json" \
72+
--data '{
73+
...
74+
"output_options": {
75+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
76+
},
77+
"filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"}]}}"
78+
}'
79+
```
80+
81+
## Filter by relevant fields to Magic Firewall
82+
83+
Use the examples below to filter out fields that are not relevant to traffic flowing through Magic Firewall. The example below only includes Magic Firewall events.
84+
85+
```bash
86+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs \
87+
--header "X-Auth-Email: <EMAIL>" \
88+
--header "X-Auth-Key: <API_KEY>" \
89+
--header "Content-Type: application/json" \
90+
--data '{
91+
...
92+
"output_options": {
93+
"field_names": ["ColoName", "Datetime", "Direction", "IPDestinationAddress", "IPDestinationSubnet", "IPProtocol","IPSourceAddress", "IPSourceSubnet", "Outcome", "RuleID", "RulesetID", "SampleInterval", "Verdict"],
94+
},
95+
"filter": "{\"where\":{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"}}"
96+
}'
97+
```

‎src/content/docs/cloudflare-one/insights/logs/use-logpush-with-ids.mdx‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Use Logpush with IDS
3+
pcx_content_type: concept
4+
5+
---
6+
7+
You can use Logpush with Magic Firewall IDS to log detected risks:
8+
9+
1. Consult the [Logpush Destination docs](/logs/logpush/logpush-job/api-configuration/#destination) to learn about what destinations Logpush supports. The documentation will also instruct you on how to correctly format the destination URL for Logpush.
10+
11+
2. Follow the [Manage Lopush with cURL](/logs/logpush/examples/example-logpush-curl/) tutorial to validate your Logpush destination and define a Logpush job.
12+
13+
## Notes on using Logpush with IDS
14+
15+
* Magic IDS is an account-scoped dataset. This means the string `/zone/<ZONE_ID>` in the Cloudflare API URLs in the tutorial should be replaced with `/account/<ACCOUNT_ID>`.
16+
17+
* Consult the [Magic IDS Detection fields doc](/logs/logpush/logpush-job/datasets/account/magic_ids_detections/) to know what fields you want configured for the job.
18+
19+
* When creating the Logpush job, the dataset field should equal `magic_ids_detections`.
20+
21+
* Timestamps by default are unixnano. Consult the [Logpush Options docs](/logs/logpush/logpush-job/api-configuration/#options) to learn what format you can choose that will be compatible with your destination and/or expectations. Note that all options must be added *after* all fields you want from the Logpush job, akin to URL parameters.

‎src/content/docs/cloudflare-one/insights/network-visibility/diagnostics/buckets.mdx‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
---
2+
title: Buckets
3+
pcx_content_type: how-to
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { GlossaryTooltip, TabItem, Tabs, DashButton } from "~/components";
9+
10+
Before you can begin a full <GlossaryTooltip term="data packet">packet</GlossaryTooltip> capture, you must first configure a bucket that Cloudflare can use to upload your files. Setting up a bucket is not required for sample packet captures.
11+
12+
You can configure an Amazon S3 or Google Cloud Platform bucket to use as a target. You can also [use R2](#r2) as a target using the API.
13+
14+
## Set up a bucket
15+
16+
Learn how to set up a bucket for use with full packet captures.
17+
18+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
19+
20+
1. In the [Cloudflare One](https://one.dash.cloudflare.com) dashboard, go to **Network visibility** > **Diagnostics**.
21+
2. Select the **Buckets** tab > **Add a bucket**.
22+
3. Select a bucket service and select **Next**.
23+
4. Enter the information related to your bucket for your service provider.
24+
5. When you are done, select **Next**.
25+
26+
The **Prove ownership** step of the **Bucket configuration** displays.
27+
28+
</TabItem> <TabItem label="API">
29+
30+
Before you can begin using a bucket, you must first enable destinations.
31+
32+
Refer to the [Amazon S3](/logs/logpush/logpush-job/enable-destinations/aws-s3/#create-and-get-access-to-an-s3-bucket) or [Google Cloud Storage](/logs/logpush/logpush-job/enable-destinations/google-cloud-storage/#create-and-get-access-to-a-gcs-bucket) documentation and follow the steps for those specific services.
33+
34+
</TabItem> </Tabs>
35+
36+
Next, validate the bucket and confirm ownership.
37+
38+
## Validate a bucket
39+
40+
After the initial bucket set up, you need to confirm you own the bucket via an ownership challenge. After you validate your bucket, you can begin using it to collect full packet captures.
41+
42+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
43+
44+
1. From the **Prove ownership** step of the **Bucket configuration**, locate the **Ownership token** field.
45+
2. In the **Ownership token** field, enter the ownership token for your service provider.
46+
3. When you are done, select **Create**. The **Packet captures** page displays.
47+
48+
The **Buckets** tab displays a list of the buckets associated with your account. Refer to the **Status** column to see the status of your bucket configuration.
49+
50+
</TabItem> <TabItem label="API">
51+
52+
The `bucket` field should be the URI of the bucket. For Amazon S3, the `bucket` field is in the form `s3://<bucket-name>/<directory>?region=<bucket-region>`, and for Google Cloud Storage the form is `gs://<bucket-name>/<directory>`.
53+
54+
```bash title="Ownership challenge request example"
55+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/pcaps/ownership \
56+
--header "X-Auth-Email: <EMAIL>" \
57+
--header "X-Auth-Key: <API_KEY>" \
58+
--header "Content-Type: application/json" \
59+
--data '{
60+
"destination_conf": "'${bucket}'"
61+
}'
62+
```
63+
64+
The response has a `"filename"` parameter which contains the content of the `ownership-challenge` text. Find the file in your bucket and copy the contents of the file.
65+
66+
```json title="Ownership challenge response example"
67+
{
68+
"result": {
69+
"id": "cc20c2d6c62e11ecbe646b173af3b6b9",
70+
"status": "pending",
71+
"submitted": "2022-04-22T18:54:13.397413Z",
72+
"validated": "",
73+
"destination_conf": "gs://bucket-test", // Ensure you use a bucket that you created and registered in the Cloudflare dashboard.
74+
"filename": "ownership-challenge-1234.txt"
75+
},
76+
"success": true,
77+
"errors": [],
78+
"messages": []
79+
}
80+
```
81+
82+
Validate the bucket by inserting the copied text in the `ownership_text` below:
83+
84+
```bash title="Bucket validation example"
85+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/pcaps/ownership/validate \
86+
--header "X-Auth-Email: <EMAIL>" \
87+
--header "X-Auth-Key: <API_KEY>" \
88+
--header "Content-Type: application/json" \
89+
--data '{
90+
"destination_conf": "'${bucket}'",
91+
"ownership_challenge": "'${ownership_text}'"
92+
}'
93+
```
94+
95+
```json title="Bucket validation response"
96+
{
97+
"result": {
98+
"id": "cc20c2d6c62e11ecbe646b173af3b6b9",
99+
"status": "success",
100+
"submitted": "2022-04-22T18:54:13.397413Z",
101+
"validated": "2022-04-27T14:54:46.440548Z",
102+
"destination_conf": "gs://<bucket-name>", // Ensure you use a bucket that you created and registered in the Cloudflare dashboard
103+
"filename": "ownership-challenge-1234.txt"
104+
},
105+
"success": true,
106+
"errors": [],
107+
"messages": []
108+
}
109+
```
110+
111+
If the `status` shows `success`, the bucket is configured and ready to use.
112+
113+
</TabItem> </Tabs>
114+
115+
The bucket status displays one of the following options:
116+
117+
- **Success:** The bucket is fully verified and ready to use.
118+
- **Pending:** The challenge response was initiated but is pending verification. Bucket verification can take five to ten minutes to finish processing.
119+
- **Failed:** The bucket could not be validated. If this occurs, verify your ownership information.
120+
121+
## List configured buckets
122+
123+
View a list of all buckets configured on your account.
124+
125+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
126+
127+
1. In the Cloudflare One dashboard, go to the **Packet captures** page in Magic Transit or Magic WAN.
128+
129+
To set up a packet capture in Magic Transit: <DashButton url="/?to=/:account/magic-transit/packet-captures/captures" />
130+
131+
To set up a packet capture in Magic WAN: <DashButton url="/?to=/:account/magic-wan/packet-captures/captures" />
132+
2. In **Packet captures**, select **Start a capture**.
133+
3. Select the **Buckets** tab.
134+
135+
The list of buckets associated with your account displays.
136+
137+
</TabItem> <TabItem label="API">
138+
139+
```bash title="Bucket list request example"
140+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/pcaps/ownership \
141+
--header "X-Auth-Email: <EMAIL>" \
142+
--header "X-Auth-Key: <API_KEY>"
143+
```
144+
145+
```json title="Bucket list response example"
146+
{
147+
"result": [
148+
{
149+
"id": "9a993aa6c58711ec89d3037647342e63",
150+
"status": "success",
151+
"submitted": "2022-04-26T16:58:24.550762Z",
152+
"validated": "2022-04-26T17:01:18.426458Z",
153+
"destination_conf": "s3://test-bucket?region=us-east-1",
154+
"filename": "ownership-challenge-1234.txt"
155+
}
156+
],
157+
"success": true,
158+
"errors": [],
159+
"messages": []
160+
}
161+
```
162+
163+
</TabItem> </Tabs>
164+
165+
To learn how to collect packet captures, refer to [Collect packet captures](/magic-firewall/packet-captures/collect-pcaps/).
166+
167+
## R2
168+
169+
To start collecting packet captures with R2, you first need to configure it properly. For all the required details, refer to the [Cloudflare R2](/r2/) documentation.
170+
171+
### Create bucket and API token
172+
173+
1. In the Cloudflare One dashboard, go to the **R2** page.
174+
175+
<DashButton url="/?to=/:account/r2/overview" />
176+
177+
2. Select **Create bucket**.
178+
3. Give your bucket a name > **Create bucket**.
179+
4. Go to the R2 Overview page, and select **Manage R2 API Tokens**.
180+
5. Select **Create API Token**.
181+
6. In **Permissions**, choose **Object Read & Write**. Make sure you also select **Apply to specific buckets only**, and select the bucket you have created for PCAPs from the drop-down menu.
182+
7. Select **Create API Token**.
183+
8. Make sure you copy the **Secret Access Key** and **Access Key ID** values, as you will need them for the next step.
184+
185+
### Create initial request
186+
187+
Create your initial request to R2:
188+
189+
```bash
190+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/pcaps/ownership \
191+
--header "X-Auth-Email: <EMAIL>" \
192+
--header "X-Auth-Key: <API_KEY>" \
193+
--header "Content-Type: application/json" \
194+
--data '{
195+
"destination_conf": "r2://<BUCKET_NAME>?account-id=<ACCOUNT_ID>&access-key-id=<R2_ACCESS_KEY_ID>&secret-access-key=<R2_SECRET_ACCESS_KEY>"
196+
}'
197+
```
198+
199+
The [response](/api/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/create/) has a `"filename"` parameter with the name of a file that Cloudflare wrote to your R2 bucket. You need to download it for the next step. Example:
200+
201+
```json
202+
{
203+
"errors": [],
204+
"messages": [],
205+
"result": {
206+
"destination_conf": "<YOUR_R2_BUCKET>",
207+
"filename": "ownership-challenge-9883874ecac311ec8475433579a6bf5f.txt",
208+
"id": "9883874ecac311ec8475433579a6bf5f",
209+
"status": "success",
210+
"submitted": "2020-01-01T08:00:00Z",
211+
"validated": "2020-01-01T08:00:00Z"
212+
},
213+
"success": true
214+
}
215+
```
216+
217+
### Validate bucket ownership
218+
219+
Refer to the [Validate a bucket](#validate-a-bucket) API instructions for more details on the entire process to [validate your R2 bucket](/api/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/validate/). When specifying the R2 destination for this validation, exclude the secret and access keys from the URL.

0 commit comments

Comments
 (0)