Skip to content

Commit fa4844c

Browse files
patriciasantaanamarciocloudflare
authored and
thomasgauvin
committed
[API Shield] Sequence custom rules (#23690)
* sequence custom rules * desc * bots seq rules * waf * old dash steps * feedback * Update src/content/partials/api-shield/sequence-custom-rules.mdx Co-authored-by: marciocloudflare <[email protected]> --------- Co-authored-by: marciocloudflare <[email protected]>
1 parent 28599f4 commit fa4844c

File tree

5 files changed

+114
-30
lines changed

5 files changed

+114
-30
lines changed

‎src/content/docs/api-shield/security/sequence-mitigation/custom-rules.mdx‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,11 @@ Rules built using these custom rules are different from sequence mitigation rule
2424

2525
<Render file="sequence-rules-availability" product="bots" />
2626

27-
## Example rules
27+
## Build a sequence custom rule
28+
29+
<Render file="sequence-custom-rules" />
30+
31+
### Example rules
2832

2933
Each saved endpoint will have an endpoint ID visible in its details page in Endpoint Management in the form of a UUID. The references below (`aaaaaaaa`, `bbbbbbbb`, and `cccccccc`) are the first eight characters of the endpoint ID.
3034

‎src/content/docs/api-shield/security/sequence-mitigation/manage-sequence-rules.mdx‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ head:
1212
---
1313
import { Steps, Tabs, TabItem } from "~/components"
1414

15+
:::note
16+
Cloudflare recommends creating sequence rules using WAF custom rules. Refer to the [sequence custom rules documentation](/api-shield/security/sequence-mitigation/custom-rules/) for more information.
17+
:::
18+
1519
## Create a sequence rule
1620

1721
<Tabs syncKey="dashNewNav">

‎src/content/docs/bots/additional-configurations/sequence-rules.mdx‎

Lines changed: 41 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,25 @@ Sequence rules is currently in private beta. If you would like to be included in
1616
- Your account must have the Fraud Detection subscription.
1717
- Each zone must configure the endpoints to track via Endpoint Management.
1818

19+
You can [create a sequence custom rule via the Cloudflare dashboard](#create-a-sequence-custom-rule-via-the-cloudflare-dashboard) or [using the API](#manage-sequence-rules-via-the-api).
20+
21+
---
22+
23+
## Availability
24+
25+
<Render file="sequence-rules-availability" />
26+
27+
---
28+
29+
## Build a sequence custom rule via the Cloudflare dashboard
30+
31+
<Render file="sequence-custom-rules" product="api-shield" />
32+
1933
---
2034

21-
## Enable sequence rules via the API
35+
## Manage sequence rules via the API
36+
37+
### Enable sequence rules
2238

2339
<Steps>
2440
1. [Create an API token](/fundamentals/api/get-started/create-token/) if you do not already have one. The API token must include the _Zone_ > _Fraud Detection_ > _Edit_ permission.
@@ -48,18 +64,38 @@ When you enable sequence rules, Cloudflare will start setting cookies for all re
4864

4965
Once you have enabled sequence rules, the rules fields will be populated and you can now use the new fields in your rules.
5066

67+
### Disable sequence rules
68+
69+
Disabling sequence rules will stop the rules fields from being populated. If you still have rules deployed which depend on these fields, those rules may not behave as intended. Remove or disable any rules that rely on sequence fields before disabling sequence rules.
70+
71+
To disable sequence rules:
72+
73+
<Steps>
74+
1. [Create an API token](/fundamentals/api/get-started/create-token/) if you do not already have one. The API token must include the _Zone_ > _Fraud Detection_ > _Edit_ permission.
75+
2. [Get the zone ID](/fundamentals/account/find-account-and-zone-ids/) for the zone(s) where you want to enable sequence rules.
76+
3. [Add the endpoints](/api-shield/management-and-monitoring/) that you want to track in your sequence rules using API Shield's Endpoint Management and make note of the short ID.
77+
4. Disable the sequence cookie using your API token, zone ID, and by setting `enabled` to `false` on the following API call.
78+
</Steps>
79+
80+
:::note
81+
The short ID will not be visible until your account team has enabled this feature for you.
82+
:::
83+
84+
```bash title="API call"
85+
curl --request PUT https://api.cloudflare.com/client/v4/zones/{zone_id}/fraud_detection/sequence_cookies \
86+
--header "Authorization: Bearer <API_TOKEN>" \
87+
--data '{"enabled": false}'
88+
```
89+
5190
---
5291

92+
5393
## Rules fields
5494

5595
Sequence rules introduces three new fields to Cloudflare Rules. All of these fields reference operations by their short ID. Accounts that have the Fraud Detection subscription can refer to the short ID by viewing the endpoint details via **API Shield** > **Endpoint Management** in the Cloudflare dashboard. Accounts without Fraud Detection do not have access to this field.
5696

5797
Cloudflare only stores up to the 10 most recent operations in a sequence for up to one hour. If there are more than 10 operations in the sequence, older operations will be dropped and will not be included in the following fields. Similarly, if an operation happened more than one hour ago, it will also not be included in the following fields.
5898

59-
## Availability
60-
61-
<Render file="sequence-rules-availability" />
62-
6399
### Example rules
64100

65101
The customer must request endpoint A before endpoint B.
@@ -86,30 +122,6 @@ cf.sequence.current_op eq "bbbbbbbb" and
86122
not cf.sequence.msec_since_op["aaaaaaaa"] ge 1000
87123
```
88124

89-
---
90-
91-
## Disable sequence rules via the API
92-
93-
Disabling sequence rules will stop the rules fields from being populated. If you still have rules deployed which depend on these fields, those rules may not behave as intended. Remove or disable any rules that rely on sequence fields before disabling sequence rules.
94-
95-
To disable sequence rules:
96-
97-
<Steps>
98-
1. [Create an API token](/fundamentals/api/get-started/create-token/) if you do not already have one. The API token must include the _Zone_ > _Fraud Detection_ > _Edit_ permission.
99-
2. [Get the zone ID](/fundamentals/account/find-account-and-zone-ids/) for the zone(s) where you want to enable sequence rules.
100-
3. [Add the endpoints](/api-shield/management-and-monitoring/) that you want to track in your sequence rules using API Shield's Endpoint Management and make note of the short ID.
101-
4. Disable the sequence cookie using your API token, zone ID, and by setting `enabled` to `false` on the following API call.
102-
</Steps>
103-
104-
:::note
105-
The short ID will not be visible until your account team has enabled this feature for you.
106-
:::
107-
108-
```bash title="API call"
109-
curl --request PUT https://api.cloudflare.com/client/v4/zones/{zone_id}/fraud_detection/sequence_cookies \
110-
--header "Authorization: Bearer <API_TOKEN>" \
111-
--data '{"enabled": false}'
112-
```
113125

114126
---
115127

‎src/content/docs/waf/custom-rules/use-cases/sequence-custom-rules.mdx‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
pcx_content_type: configuration
3+
title: Build a sequence rule within custom rules
4+
---
5+
6+
import { Render } from "~/components";
7+
8+
You can build an [API sequence rule](/api-shield/security/sequence-mitigation/custom-rules/) via the Cloudflare dashboard.
9+
10+
<Render file="sequence-custom-rules" product="api-shield" />

‎src/content/partials/api-shield/sequence-custom-rules.mdx‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
{}
3+
4+
---
5+
6+
import { Steps, Tabs, TabItem } from "~/components"
7+
8+
<Tabs syncKey="dashNewNav">
9+
<TabItem label="Old dashboard">
10+
<Steps>
11+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
12+
2. Go to **Security** > **WAF** > **Custom rules**.
13+
3. To create a new empty rule, select **Create rule**.
14+
4. Enter a descriptive name for the rule in **Rule name**.
15+
5. Under **When incoming requests match**, use the **Field** drop-down list and select:
16+
- Current Operation
17+
- Previous Operations
18+
- Elapsed time
19+
6. Under **Value**, build a sequence by selecting a hostname for the sequence.
20+
7. Select the checkbox for each endpoint in the order that you want them to appear in the sequence.
21+
8. Set the time to complete.
22+
9. Select **Save**.
23+
10. Under **Then take action**, select the rule action in the **Choose action** dropdown. For example, selecting *Block* tells Cloudflare to refuse requests that match the conditions you specified.
24+
11. (Optional) If you selected the *Block* action, you can configure a custom response.
25+
12. Under **Place at**, select the order of when the rule will fire.
26+
13. To save and deploy your rule, select **Deploy**. If you are not ready to deploy your rule, select **Save as Draft**.
27+
</Steps>
28+
</TabItem>
29+
<TabItem label="New dashboard" icon="rocket">
30+
<Steps>
31+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
32+
2. Go to **Security** > **Security rules**.
33+
3. To create a new empty rule, select **Create rule** > **Custom rules**.
34+
4. Enter a descriptive name for the rule in **Rule name**.
35+
5. Under **When incoming requests match**, use the **Field** drop-down list to filter by **Sequences** and select from:
36+
- Current Operation
37+
- Previous Operations
38+
- Elapsed time
39+
6. Under **Value**, select the edit icon to use Builder and build a sequence on the side panel.
40+
7. Under **Select a hostname for this sequence**, choose all or a specific hostname from the dropdown list. Optionally, you can use the search bar to search for a specific hostname.
41+
8. From the **Methods** dropdown list, choose all methods or a specific request method.
42+
8. Select the checkbox for each endpoint in the order that you want them to appear in the sequence.
43+
8. Set the time to complete.
44+
9. Select **Save**.
45+
10. Under **Then take action**, select the rule action in the **Choose action** dropdown. For example, selecting *Block* tells Cloudflare to refuse requests that match the conditions you specified.
46+
11. (Optional) If you selected the *Block* action, you can configure a custom response.
47+
12. Under **Place at**, select the order of when the rule will fire.
48+
13. To save and deploy your rule, select **Deploy**. If you are not ready to deploy your rule, select **Save as Draft**.
49+
</Steps>
50+
:::note
51+
The fields in the custom rule are populated as a grouped sequence based on the values that you entered on Builder.
52+
:::
53+
</TabItem>
54+
</Tabs>

0 commit comments

Comments
 (0)