Skip to content

Commit e159729

Browse files
pedrosousapedrosousa
committed
[DDoS Protection] New nav instructions for overrides
1 parent 5d30e0e commit e159729

File tree

1 file changed

+74
-26
lines changed

1 file changed

+74
-26
lines changed

‎src/content/docs/ddos-protection/managed-rulesets/http/http-overrides/override-examples.mdx‎

Lines changed: 74 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,19 @@ head:
88
content: Override examples for HTTP DDoS Attack Protection
99
---
1010

11-
import { Details, GlossaryTooltip } from "~/components"
11+
import { Details, GlossaryTooltip, Tabs, TabItem } from "~/components"
1212

1313
## Use cases
1414

1515
The following scenarios detail how you can make use of override rules as a solution to common HTTP DDoS Protection issues.
1616

1717
### Traffic from your mobile application is blocked by a DDoS Managed Rule
1818

19-
The traffic from your mobile application may have appeared suspicious, causing a DDoS Managed Rule to block it.
19+
The traffic from your mobile application may have appeared suspicious, causing a DDoS Managed Rule to block it.
2020

2121
You should identify the Managed Rule blocking the traffic and change the sensitivity level to `Medium`. If traffic continues to be blocked by the managed rule, set the sensitivity level to `Low` or `Essentially off`.
2222

23-
If you have access to filter expressions, you can create an override to target the specific affected traffic.
23+
If you have access to filter expressions, you can create an override to target the specific affected traffic.
2424

2525
### Traffic is flagged by an adaptive rule based on the location and may be an attack
2626

@@ -34,23 +34,47 @@ In these cases, Cloudflare’s DDoS Protection systems may flag that traffic as
3434

3535
To remedy a false positive:
3636

37+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
38+
39+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
40+
2. Go to the analytics dashboard and apply filters to the displayed data.
41+
<Details header="For WAF/CDN customers">
42+
1. Select the zone that is experiencing DDoS attack false positives.
43+
2. Go to **Security** > **Events**.
44+
3. Select **Add filter** and filter by `Service equals HTTP DDoS`.
45+
</Details>
46+
<Details header="For Magic Transit and Spectrum customers">
47+
1. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
48+
2. Identify the legitimate traffic that is causing the false positives. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
49+
</Details>
50+
3. Scroll down to **Top events by source** > **HTTP DDoS rules**.
51+
4. Copy the rule name.
52+
5. Go to your zone > **Security** > **DDoS** and select **Deploy a DDoS override**. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
53+
6. Select **Browse rules** and paste the rule name in the search field.
54+
7. Decrease the rule’s **Sensitivity Level** to _Essentially Off_ or change the rule action to _Log_ (if supported by your current plan and subscriptions).
55+
8. Select **Next** and then select **Save**.
56+
57+
</TabItem> <TabItem label="New dashboard" icon="rocket">
58+
3759
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
3860
2. Go to the analytics dashboard and apply filters to the displayed data.
3961
<Details header="For WAF/CDN customers">
40-
3. Select the zone that is experiencing DDoS attack false positives.
41-
4. Go to **Security** > **Events**.
42-
5. Select **Add filter** and filter by `Service equals HTTP DDoS`.
62+
1. Select the zone that is experiencing DDoS attack false positives.
63+
2. Go to **Security** > **Analytics** > **Events** tab.
64+
3. Select **Add filter** and filter by `Service equals HTTP DDoS`.
4365
</Details>
4466
<Details header="For Magic Transit and Spectrum customers">
45-
6. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
46-
7. Identify the legitimate traffic that is causing the false positives. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
67+
1. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
68+
1. Identify the legitimate traffic that is causing the false positives. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
4769
</Details>
48-
8. Scroll down to **Top events by source** > **HTTP DDoS rules**.
49-
9. Copy the rule name.
50-
10. Go to your zone > **Security** > **DDoS** and select **Deploy a DDoS override**. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
51-
11. Select **Browse rules** and paste the rule name in the search field.
52-
12. Decrease the rule’s **Sensitivity Level** to _Essentially Off_ or change the rule action to _Log_ (if supported by your current plan and subscriptions).
53-
13. Select **Next** and then select **Save**.
70+
3. Scroll down to **Top events by source** > **HTTP DDoS rules**.
71+
4. Copy the rule name.
72+
5. Go to your zone > **Security** > **Security rules** > **DDoS protection** tab and select **Create override**. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
73+
6. Select **Browse rules** and paste the rule name in the search field.
74+
7. Decrease the rule’s **Sensitivity Level** to _Essentially Off_ or change the rule action to _Log_ (if supported by your current plan and subscriptions).
75+
8. Select **Next** and then select **Save**.
76+
77+
</TabItem> </Tabs>
5478

5579
Once saved, the rule takes effect within one or two minutes. The rule adjustment should provide immediate remedy, which you can view in the [analytics dashboard](/ddos-protection/reference/analytics/).
5680

@@ -91,29 +115,53 @@ The system chooses the mitigation action based on the logic and the DDoS protect
91115

92116
If you are experiencing a DDoS attack detected by Cloudflare and the applied mitigation action is not sufficiently strict, change the rule action to _Block_:
93117

118+
<Tabs syncKey="dashNewNav"> <TabItem label="Old dashboard">
119+
120+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
121+
2. Go to the analytics dashboard and apply filters to the displayed data.
122+
<Details header="For WAF/CDN customers">
123+
1. Select the zone that is experiencing an incomplete mitigation of a DDoS attack.
124+
2. Go to **Security** > **Events**.
125+
3. Select **Add filter** and filter by `Service equals HTTP DDoS`.
126+
</Details>
127+
<Details header="For Magic Transit and Spectrum customers">
128+
1. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
129+
2. Identify the DDoS attack that is having incomplete mitigations. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
130+
</Details>
131+
3. Scroll down to **Top events by source** > **HTTP DDoS rules**.
132+
4. Copy the rule name.
133+
5. Go to your zone > **Security** > **DDoS** and select **Deploy a DDoS override**. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
134+
6. Select **Browse rules** and paste the rule name in the search field.
135+
7. Change the rule’s **Action** to *Block*.
136+
8. Select **Next** and then select **Save**.
137+
138+
</TabItem> <TabItem label="New dashboard" icon="rocket">
139+
94140
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
95141
2. Go to the analytics dashboard and apply filters to the displayed data.
96142
<Details header="For WAF/CDN customers">
97-
3. Select the zone that is experiencing an incomplete mitigation of a DDoS attack.
98-
4. Go to **Security** > **Events**.
99-
5. Select **Add filter** and filter by `Service equals HTTP DDoS`.
143+
1. Select the zone that is experiencing an incomplete mitigation of a DDoS attack.
144+
2. Go to **Security** > **Analytics** > **Events** tab.
145+
3. Select **Add filter** and filter by `Service equals HTTP DDoS`.
100146
</Details>
101147
<Details header="For Magic Transit and Spectrum customers">
102-
6. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
103-
7. Identify the DDoS attack that is having incomplete mitigations. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
148+
1. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
149+
2. Identify the DDoS attack that is having incomplete mitigations. Use the Attack ID number included in the DDoS alert (if you received one), or apply dashboard filters such as destination IP address and port.
104150
</Details>
105-
8. Scroll down to **Top events by source** > **HTTP DDoS rules**.
106-
9. Copy the rule name.
107-
10. Go to your zone > **Security** > **DDoS** and select **Deploy a DDoS override**. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
108-
11. Select **Browse rules** and paste the rule name in the search field.
109-
12. Change the rule’s **Action** to *Block*.
110-
13. Select **Next** and then select **Save**.
151+
3. Scroll down to **Top events by source** > **HTTP DDoS rules**.
152+
4. Copy the rule name.
153+
5. Go to your zone > **Security** > **Security rules** > **DDoS protection** tab and select **Create override**. If you cannot deploy any additional overrides, edit an existing override to adjust rule configuration.
154+
6. Select **Browse rules** and paste the rule name in the search field.
155+
7. Change the rule’s **Action** to *Block*.
156+
8. Select **Next** and then select **Save**.
157+
158+
</TabItem> </Tabs>
111159

112160
Once saved, the rule takes effect within one or two minutes. The rule adjustment should provide immediate remedy, which you can view in the [analytics dashboard](/ddos-protection/reference/analytics/).
113161

114162
#### Alternate procedure
115163

116-
If you cannot stop an attack from overloading your origin web server using the above steps, [contact Cloudflare Support](/support/contacting-cloudflare-support/) for assistance, providing the following details:
164+
If you cannot stop an attack from overloading your origin web server using the above steps, [contact Cloudflare Support](/support/contacting-cloudflare-support/) for assistance, providing the following details:
117165

118166
- Time period of the attack (UTC timestamp)
119167
- Domain/path being targeted (zone name/ID)

0 commit comments

Comments
 (0)