From c7458e493306c69027e27976c17cf8ebc17f83ab Mon Sep 17 00:00:00 2001 From: Pedro Sousa <680496+pedrosousa@users.noreply.github.com> Date: Mon, 11 Nov 2024 11:40:59 +0000 Subject: [PATCH] [Docs] Update ip.geoip.* fields to ip.src.* fields --- .../language/expression-builder.png | Bin 21150 -> 5819 bytes .../language/expression-editor.png | Bin 11047 -> 2129 bytes .../http/override-expressions.mdx | 11 +-- .../enable-destinations/splunk.mdx | 87 ++++++++---------- .../examples/send-eu-visitors-to-gcs.mdx | 2 +- .../rewrite-welcome-for-countries.mdx | 4 +- .../examples/redirect-country-subdomains.mdx | 4 +- .../single-redirects/create-api.mdx | 16 ++-- .../custom-rulesets/add-rules-ruleset.mdx | 6 +- .../expressions/edit-expressions.mdx | 6 +- .../rules-language/operators.mdx | 2 +- .../ruleset-engine/rulesets-api/add-rule.mdx | 4 +- .../rulesets-api/delete-rule.mdx | 2 +- .../rulesets-api/update-rule.mdx | 4 +- ...troubleshooting-cloudflare-1xxx-errors.mdx | 4 +- .../docs/waf/custom-rules/create-api.mdx | 4 +- .../allow-traffic-from-specific-countries.mdx | 4 +- .../allow-traffic-from-verified-bots.mdx | 2 +- .../use-cases/block-ip-reputation.mdx | 2 +- .../block-traffic-from-specific-countries.mdx | 4 +- .../update-rules-customers-partners.mdx | 8 +- .../waf/rate-limiting-rules/parameters.mdx | 4 +- .../waf/rate-limiting-rules/use-cases.mdx | 21 ++--- src/content/docs/waf/troubleshooting/faq.mdx | 2 +- .../transform/header-modification-fields.mdx | 7 +- .../transform/transform-phase-fields.mdx | 7 +- 26 files changed, 108 insertions(+), 109 deletions(-) diff --git a/src/assets/images/ruleset-engine/language/expression-builder.png b/src/assets/images/ruleset-engine/language/expression-builder.png index 9c9ce96836eb143a8c7a7e44d2feb54bb346dc24..7b365b4b958414d1d31374f44611d9ee1e1074a0 100644 GIT binary patch literal 5819 zcmc&YXIN8RlR>(GgbtyJ2v}%=pj46Gq$was54?fU5fqT#K?uDUDK7*>DWOUi5&}jb z5>$#b=>k#$3QEZazwgJl`|Y3IAG_yy?wL7L&dl69XYSmaXkw(pbP;qB001!Q>1y5w z04O13e3OonJST_?Um*huzxz7sfVxq>Z{!7)i<+St0DwwmIB}!~04}hZ+%wZ6k;h6s z3=B@ekzin0{R(-#Tn`7sYL{_oU~n1^d_Krb5($?A2E&$XVgJCu@cLyE308~4oiku5 zwad%3DKK!#@=84}EhQxlmXd}`!7bx(DJeMI&dyF_V`E}sVo*@fV~*c3>O3Ka09hn;bMc#|D=M1Bcat?efs) z0(GHa@SD!=#{t2iV4J%09mvBbuP(2S%z=j4pNE6Pt<=}!>g#J$Y`~$gbDzoHrqsh> z%Vh7)W5MTJosXcF4Sb>1MoUmWofQe!g#tju{~Va^?W0==-LFm8)cxxfn9uI7b@6 zuQie>8`vB)!2k0aiBz9f4=}}JNhAPSGUqcaEhWZuuzqFvz9}A@ma^7}k7*vLdPt!=~ZUj@`CEUtn`_;&pmd0*A{R;WPlDwVMjoO;+sc*CSpSL{P4(_Nv zMUs;O*>N0=*9eSH?I`)b0W+X|+5)F2Q49!tpM1`VAh0Bfc*^=+3rDt~YXAqqM+efi(HT z-46G%#L+QpR|hkzEbQo&R?}wcHnex4Y8FupuDfK=o=?z}5NBDH`?((hkA!kums>l2c4@j(&DsT(0 zGah&Px=oy08dl8mecruAFcvpxY0?}O1>p?4vuyM&HTZ+vCFKexV>qorn-yUTd{Z2i zTHv6+-*j}NEz{=^?euLn6HA+Xr_!neL0Gu@Qz#ParY{WB=6*phgw-a{frT=(6X??+ z|CVh+njCHOzH4FyBgFwTqpdWc`Nhw2Z+sc;`{H~jW)JzC8(;Eut!;PaQH^-}Zh~gy z;(|c10B%gJazHu3KDiGc!{z zn(<|38(Dp!l;>*j4}mvPv^>3X?~1i*pWix^3utv(@YyvIohJOT&0gp59c8s(XYrt^ zJS1?LEyP=~y;uVN$2#$e)4}JsPakU&XkDfs>sWI|*Sh;G4NV~Wta&Yj;RQzLE|P_I z$wImX$ng%E+bJQl++8h>av8{P&2@bUVf))O-kz3-3b^9`Ms-Ji=I~pIQw`u%I)wV^ z&-#*BRb~~iwOnAro0END;n{(|mV!xBIzp6eW(OF*O=5gN?WVi`Hu^Ly+{~6mpopjA z@3Xdn!XvJu*5`e<^p?VH?sQYPreohjZ8h~CEcY0bPBiXu=Ghd)AD6UDpifz{$x7Gb z7aHet?5n$OI|Oi=y-ZN6ii5BfVMYxowTm?LK(DzPsVB-H@u~qwT;Yk|hA{+X;Z1aWV_=e4=8_cwT_DhQhU0)e|t7N6>W=p+n9%MK_#>LS``D~k&!05>I|PqI&YE)7pp zh%@eQ_D1sB3q#xDbEWOy)^KB{WqX#B>Z_JSeQX2lvuO}IA5TR&qfuFH0!b9q4yy*`Z6I^o*wL~vA1-OrlcS#- z>z}Z<(eAp8kji&H9P6#1<#ZJ)Sgb9U45Me@YPdmzdSMwb3fiPJXais3BnQ2QC6JR5tB8Nr2xLVQ0$9z#N*{#d+ z+g8_rq}{botTpwQquUagM`qY=58giv<;l!=S9$#>q}okZS-weuO6?I#yS%bSSO(1@ z_Z~;C`3uF=Y)J<##yI0P?1#g-JA&m7)#Jq)feK-E2^9?)GPpQ^hGbH_?O$+d7|6O{ z55!jwp6izr*NC*BzyWrvc zH2b{vW*THl?FAARZvBAyKhz#vxCXx;P2+q0y+ozs-Uz{eZ7aEU<_&=n+|l<%7j3MM z@O}N7`MO`byIFzI`GM!Wo50I$ECTO|_&PPj!ug74_OD;nlKz%YD(E$&fnK%qtTXh> zsTs)QW$#ex9a#r|#yI*$#Egdjf?Qky3wjn$!>h*8r47IDtNKH_9aXScK_`XEq34-( zcs1v)u>wA8Vnmt01YauHN%E|E{4|YO!S}3;yM{?;kn=d`$iVvDc@2u-*WVBT{yzF^ zZJGJP^WLhLA|odkyy(M>GjmuD6K{x?=z)4Y&j|UXjod(|fTA(*`pq&f0jfz0n~B+~ zJq?0S&G3;QL1y<#-~Mf*NEa|9NL4Yg zIX-1eOW<29-Pk=X(IbQqO?tygYhwH_zD`PyzPiq|jfgCa{VEql9et)15-$Q5r%f$V zS?`z9a8c7@EDv(;MPPS%6d=1*ZF^M7R}s`Kxq^q8yT#&OV^|TKDVEIwJw1VxM1+^N z2@Uj$J#(c7u~a~LBW?>mDkb|cV*QM-)1*wwP7uGXm+*W~e9MGOIKJXnXfTP=gI=g6 zXnQk!D9d0xNZS?xT)&gT7YSTgPZyp)`djsk&Fe{uN{L7$WWZCX&iaL%PKt`)YXvv{ z_YaK2h4rFCS#NbN%2{#$hFP=?{Nl#_DkY*b9uDx~MqopVy&^Z<}I?FE- z-Uy4p^E8>+;#_?B#4tbJqt^U(P7i7dH1|~NM7x0ed z#4YmK|v~IHfL1Wki^*Ty@V_H*y~IceIBIEa5%c@n&D(HRcPv&Rs_(Ty+oEl z2ph4_Erj7d$^HSpGsvQzJZL&>y`22-z3qS3@BWWyV`enB=iYvF9+nc95y50BJUxjW zP2{p)v@lHJ56^#D`|Ss!@^l82JKos^C^_F5Az}9di&(O_RqQj*G zkPvbx@uA&cxCqEXi?>~+{E~Di9BEw%_V~EUWc(s<%%d^#OX9<`-$(B-M|Oq%cjJEbDmdKor%?m3`;OC?xbT2@ zURHe@Rl6p@f7N-xzPuEe$yT}da=7qTyPEbke6AsIux?^rkwa8DJgHl% zkTGYsF|WV$k@D&&Vh^8oO91k z(!i-Q{cBF;-y>Psh2B2!8B^Y-DVBZv)4^DkA+GXE*9nejQFwooT=LtlR7ZHQmfp?n zU~*(nAL($6_!TOO^=!_LKP8B#W{4t+SGhtC0e)Gv74$n4OL*$6^ ztMoR|HXiMY>&sXkPxlxd>IJiubLxToS@S}&D)i{b0qKJJ#|;cJF^>6cGK(`}mKiut z5vCW;j*9b5V`g~^8gajoq|u`UbBLgU!wtEI%6Swu1Y^kdKO#qMg1&DxIvST zZVg}gn1Rsy*AP!QkUAm2yOhbd=Ns!*gX^Ep1#V{X{wVj1r@y0rq$bug|7-2RP=jVx z9P@Wrtq9aG&U^IyY5 zf(l2OUP2o{m;~p?z|j*a&PA_u&xWKv^m1-A|If#Z+2Jk3Rf?8=H6+W$zH9Tlw)LUo zf>ItLBS7C~QA~^0R_;@Po^YMvRRoaj3Opt+jXz79P6*TTuD7^|i8P95`Zs0HhNoJiZ7jogPMJUZ!nnc?meNEp zPtSdg45f7wFjw)WHc=> z*xWQZBXR^Y7vooM3f>1by{b`SEoU@;C*3=|a?{c0mNinu(DiiXX7x5PJT|jEggWJJ z!O?ZDkUUXL>$%1EHu}-BVOn31?E?}Q~}2*j+-&)P_uM@xmye-n&w zHR4#3cX)TG8puqo+N|uYqtJC*@(lC*nLTtr^T!8o57E@#D2=@=R#0goxaE4bO==Wk4yj5s)6C0nQQQC7~w^4H1Q70?!|X0sHTy3`p{ZK`bg|2TxdL zFQOZG@Fq_GEzJ^_ouq^4pUM4~fCn}_yMlqmxYBC(d5`piG zOhF|%!u;BrYb3m#g1K>xM<9O581J#WYWnMpHsN9Tv$z;l1`XUHS0#O~!F2<_U$|Y5 zs|IZEQ?VsWB5-X+{K3J!WZLumxp#7DPzuV3c^c^AmEgp%p7wCdepe~~!)?q9QL`lx zY5I%i)}IGTCf~lgW~khH%}}~dHwQUWV~FXV8+QCbn1}>^Q8SkrmO|eVVT3Z#lw{jp#oYP7Z(TVPt$T6KsYcM|x z&;b=9w#))bNhR9JOk{O?I#Y`Odr-7;NeH7mdOv%ZXPexwER#=J(VanC^#qn8B}4Oz zUBd1$)yp$V?3I{rvIP@#;EX00?E~3=sbv3X`Nk|2i%GQoVfw*Fk9$JCx=0VLNG<^TWy literal 21150 zcmeFZWl)^a7A=@SAPEvea1W5+8r(e)++BjZyC=cj-GaL`?u4Mh-Q67;cjj>Ky!rE{ z>Q&8;c~w)>RVk7$P50O5oW1tiYp>lwveKf+2)GC@Uc5m5CMGQZ;sxyCix)3Hynz8% zUVCL{f*&vK!Bo0CgaE_BzyYg z#U^JImEToWRf=Tb)^7=O)7CS1+?BJxhQ-rrh#Mk@MMl0iH{XXx#{EP_7M$$s>+5#0 zrwjS>=g+_pbmlG$kBv^NF=xSD`5!OsjS(G%n4fk3=qPld!M?q{U7o{G^@GYv47p6s z7gSW#(JP8We4RW=95ggE9UUESZ*RHvjg9lihr8b1-h7#i;AC)@ot>SrG-_Y0mzuN4 z&JvT7N_E-@1*9aXLx>Rip5MY~D3!xWibEueA(mK*XX84GY7tkJHoBtC%T}%Vr=zMg6%;sgTFc#f3t| z+brM%&*OfnSc}ly(&Bx0SeM~-TWGu9Z8G5V8YKq@7x#FnC57A7u0Ni3^sjD*Kaa^8r_i`CZFD&$KeBO}L|J%>&!qS>a4 zZMN1c%2&!8BA@cb|x-!ULMRI%vNC_l5NU$HhDiiV1?1h=LBYFlV+8=V7@`rpXv(1LY0(~k^;LG;^1<3 zX*qy^g3`kp^)Z1)EvvLNEb31(i+P?*23>IP2t_)V^E-*6`E)qmx_4vt#FX~n$cJEQ>(c$`=ZdTo`)!Rrj zgxPTGbq0d{$a=ZM;y_f%ei^97PK-VI@d%4T_P1R2S2pXV&i62$KVcPXG0{|!&_J+v zs3M{^C>1MfYiqxmy}Z2C!})wMO#U0ke7a2Ju2`|q?%~!^*fkV+MEyVx|IKBH>BR3q zg+}iuFC@E?k`nC}H@{4{GJFUDyZ0lv(@&$0xoWWXt3aWKKrfEs3_Da!BoMAJgJoTcaizd z2Qv`IePzk--+#P?V173@9!?keDC8jw1+kgMiy>wg=rDt|mh9&TmqiRix5s9+5Ew?P zm(Fghw>^~h#xL;4n{qwOHdwY8%9{PevawA-BZf>ds*;uJ#0QU0Fc@-Up$lp~dm#VM# zMD$$RLI={gu;Q@)Z1hIKvan-NNT;wOj~BG#bi)NvqXqoX(pNCSmPU<7Whnc@A-t_; z5J=*0pY@z$cJ6*FhhtsMb#!z@ZFg3Y1paW`n`rmV&R!qSmqGo-=gQvdusb$2HI>*K zLylsk`%>5yy^HkXvv@2&Dgp+TZ`NrL0sjmOD{Hqf$QDqlDRBb%v}<+(At9kx0+N9> zo#p`BE-o$@M_WDJ4O&ODMfKJ3MfRskk&%$9tE)L3c7CWBNC|(NfPFWzuz-)|xIfiJ zEocx$A|lMA-Q`1_AyN2wO$8^7)3Gm!DL*`1`s!#AHBc@ly4CY8xJ8J{Sd!au9HK88 zT3Inm$m900KZ{ICF9m~2@egK&l<&1>gWc*$c6K&|G}W8gWwS4?_jaczic~b1P0Zt6 zJ{)Wi4wI2)n-@V-cQkwMSaU?7J+Cdg*bVl^D|q-U#z z0lvP!;R7Nr^|5xA(*WGyvsZ|OVB)b^g@%SImRwOH1s5q5JAtGCGKk&_R`V$u$mVdN zD=%c+2w}0&F@-_*mtsn)3@6rz(K&s0YF0rr3`BGkYYpMk^OEouq^x%xUN$)&H`dn& zx)%hBvY1abdq45o-IJsAJw0k9r)2_Ugzjx^kp&lZmZ+3#2kBW@ zlq4izkqLYHqg{o@c_&d&QHgUam4_=1B?jjAi8`#Utts-w%Y9OZ#>>jK;L(0n?%f~T z;(dSBo5E~r2jXF}SmkPe8ifOo<8fy+JNSav(9|@jp~>kG7X>x-p~Nld(6X@?co7#SZ2+{pd%Ac>hvD2`SGvs^47YiDI;q}Eacx~rU+hoE z5#7V6qL#0{C6P^k&Hva?-Em{U5$5LRX2MlZsRLz~vP2LyH0HsHT8|WI`JuJ0 zbZ-PJyuB7_YsY|!kH1i3J`F;PBBS`*+j#HmlT14oG<5VFw;SD(t{!W!G-8+&gV5yU zA^5S$$u8dl^q+)rd){{UEA2jz!p{=%1F0PL0C$A~-lg$*w}J!@mPJ?ROd&f;qa%u{$@!eg>osM%nhjH?SWZ;`IbTz+_oS zE#jk)3@8=Ki`>}Q|Ac|-)ZaAYRfOH_PY~S`41CTIAj3t8lFOv0j?Ghy{~H^#0}C$_ zj4m)IT?$oo(SYUKeNup6C;FF7!bkzO}h zEpkE=TRG)9^g&b#e-&NV($q{%ON;W9h@~K&g2BVXb5K)ML>H`uKp3Z@jVK6ZMEONk zIN8}hVgl~f2uP*q z@9LM?a3$37_XsmzF8yEu?zY6l#GF=%`xy-;XSREJd0`87_Vnm8;=|B!)6>%ByMM0VTxiyH)q>CJUqF-5Oj2w zLD?h**9R{sD5$BWm7SH9^W`C)BSeXhaT- zVKsQh?A#pLr%z&ret?P~V>9qmd2E40qAEcJRxb*_z@5*lGZ6J1Rgq$0R(7`iMlb3H zpXu9ZVq@cNK%y`9Ci{nmjyi+To)d#cEzOv=iAh1V@D{u4>8DEy42o5%I}=kCfUN95uY^9$h;E`?Kt_pq#A$A6}wEc9MmMTGcR`kSAuTHi(uxq)MYe;w3*E4f- zdbmCm4(~awKrLitWu^D>Gt!V8Jq9zga=CU3;OvZHVZXgcr2rP*8$|Mh&%UhPXvZD> zQ)~lde63~|TR;yJXf^V(vzb69>+BSUg#Nf^GaA4K2OAC%GchrdMy*mfSwO9?s|)U> z78L~ujI6DHG31Hi5fPwdy#@)ue5!;)zdQ8g#O9UTXce_`Nxj`BLbnCr`c8Is>h(66 zdWSjTU$>_U+vBY{C{trv)?-o1F@SmkY^Rn z=eURNWrt|LH4tUS2V@ITkf8wkPymM}iOHB`fY|HX8Tvc0OP&6|{e=TJR5AtOOyLa) zgqe{#5YQ<;#_{ooowjnxbNL$spcbkZ-4b%Bs;d)a77Yl;V=DtZkCm0R{*#R>*n~hO z3rkDXYn#vC-PSsTs*H!}bXvKoqPn`!WNTDj|I)J$=uO*O+odH#(v9YnB*>?Ra zsK-Fbkp{|r`r8`p#<#G1h5dtrjAAeTd(VCjJVfP+Ibu!_4I&Z*Li`pbI-REK zO}Hw5Xk;FR1OTy}KR;nfm=S?m2Y8)=r-}Bg8aUZ98N4E9qSjfewH9iHZ5TZ1eBNG= z#4&K1D(-77=et93##`K-EiEkpVLDYnwS@v{N<|X349z0rE$;&mXOx;{2XN=%;gREtP^wYq1xgryWIPyHSfHid{~JGxRf0#tJ^>pFg7yL6CZOWO z8GJ;HdO(QqbBR}<0YwYo-4N`*89_nc0QxZ)RY4%L&8}4;Arb}#8vr@)&UerL<;VFn zG;n-!J#?T3iPkTqXtosp1`P;fkw=>wD=v#hMF z3M;UM07tk1nXQ-Z0iL%# zT&6JlRHA2Hg5ZmqoU1lf0L%i!5Ga;S0D`UQQ^0+?dxn*6pd8x#i~hWZgYCdL=CR!B z$!G+mEMCm(4JWRRe=){06}n($%@*pRd{6h|P0rS){{HZEu+Y8LRXLCs!THp42#})H ztbhL!H6cbdbnLA$c9fQ*;uKgJP&uXU0SM85m7AYWK6w3SU;wG=@piu)0Lt&4IF!*i zIxSqS29SKgW<9Giq-Qd`y8sgcTN$M$jj6^c85tSBe38GPjn4Q316BZVIr*eY}K z9|$_W5lDKq?7tJGNT@9?CdPk^jg2j4i1APREjU@{hlU2>`NyGV;R!|0w?W~)(jp@+ zceK#Z6N+$8}Sa#h8?uVxpp=MY#u5yu6PWc=WG(?)+#Friv9LilpAT zD{IeyaEc||d&2+rk4vZR&maE6NUhDm6s!)6!pKw$J9N`pCaF0lqk%{=g_DKJ!3#f) z9;Z^Nv#rUoHGB3iKdkyW{>#az5!S(FV9fy z?FNVW{Nnul;v)C7r*c>>XGz*I=Yi=ls4B$qqNq8SoNMQc1Ae0nmA5|+wZefK35j?F zvv+vTCkl4q2k4ELHVBsa0CHIF$fvD!+lup@qvM3q!$^a zltID4(Rr0Eipj~P;UsBc-?)0nKYcpsPM6GFmv@aIbysfv@7)!G5B<%_UEiGQf4sK; z@X!Zv#!&yE{0|<@@E>;mKV6Vx-8??_KAdAIjGP1ssHM3XsQ5W{%Ka<&$3*W}wze<{ z2x#MW@9Z}Bl-Qh|3s0W*{_;IFdp)RA-Dfm_&We_(XyM5wD88&0TWK*SPCz+;MlSQs z@BC&=3k_8cUR+WVpUY~YdUrhcG~v(ig5`XjgkQ<}-rnt9EM<02XwvO=Mu$I&PPGf9 zyu6&5e&0Yfyv_AY`R*M-lhd8+L?WbiP=iLJm4ua5IXOWf^5avBod}hz^7Y;EgS51? zJaKUvr|0cr6U{Z|T&ri#xbbk#FAHP>UXSUcMR|etj*e`nMYqh%OnDBDZBT{ZAGhh< zQV+E~T;P%O^>1DsFPC5G!-7=2x_i@TxX+qpd3D4^!0y5z#QTwE7JP!yI_SZT{k?|( ziTA^8nBr&ZH_)@K;c`{T+Fv-tsd5cA{ca>Jg0x*GBVS(wXhv*bBL34#d&fV8yii<@ z(=k4*p>*CF_i5?ZuLBCbrDKeY-yaw*FW=?p}R#cXFwf;8vp~XJ7yRNn0o`)UmYW1thNLHcjWZ82<=ti2E>M>PyCbfL}~TL&BSLj{ATAc8C~a z&ega(`ypVsUGC^wS(TNS>y(&`0-14dcb9#XLggRX-@I#O8d{eS)x5EgzFT#qnaqBY;DpTEUdbMM(l^pmJ;^oYm3v7sTz z^y$YBX{~3GT+i(!GSm5pJv4(MQ=~t>YJ14@Vh@9g&0?Y2c03Ps#q=Pce-YSqaBvV1 zfp0ip(hw1WvImLEu{1U5?C#cEAFkY#QeeAEFrT(Wcq7L7HZxOqpUu+N>04787M=E^ z<>`b$8-s*81=@<_kVeG|g3&7H3~H4!@frj=nT&ThtP6RCmJ#VK(it4olT>@7ECt8o zSkTemcE8)F@OI(m!tXtbYfs0mVjkPxwQP10@yXPk~z1 z7w={2te1&FmxR{`@gQHh6v9u&BO9y4lhU|JtxU*a=kQNQLZjBo$G*UW1a7%^-uXcC z@;={Ti1G4hq|ko;l7Q8EmP9G{BL#)Y`3xf{3J;dcGYZ;2U(Ew$<`2C0(dgOedJio8 zyT5r;)-&%hG0Ebgr3N>SkDIC_{_g zXheil?T{G8yZ+E#4v* zSS*)m-8oq@3MTS7OP40sbn5jh)0AtM?q&HQf@0%`u1{K;)>thw^LwHW!49B?k_OL; zCynLe-m6-#$6H!^E?F)#mr}v!$5Dx$$xoFOhFL1$75;{aOZ<%Sr9C=V;_$GXRORA$ z-gzJJ8}6LDa!?s{_($}nunqr(J2Rgwt1*G{{<+Ac8u0H{&+9k{Na*(8_75A0yu$1d$Zc~!h43!ei&D%A&y_m%)AZgLT zHox1Mw(i^br-vv$eQ*#@r!jS!A1{GPJ25&cr)|AGl%dn6s}IBiuMF;gqtK-#Pw&_8 z@R_{a+zZP(xG!M@wJX-94X&pRW`i-(xEwWar=#oZuK{5Wg8QPZd||Q2Ff!NZ+0@$l zc;8@;h)Kil*)3`N4%X+Fpr8;h-xFop+1WOIiB?^it`EFIzNG7Y=gmeTdWOYYL=++} zE01jdFn=V%PfDvrfuZM0_p>&s-ZC=7pmz?o-u}EGYMcJve#>Gk5cE`a2WD*RUGg3{ zYP1&{$Mc5&R1hKRD~mUEx2epaj`5XMA1!+GIzPfZ)(EuBbd_l}iH6}r?We6I5@?C8 z`d#j+na#T;RaB-sM8g9og95)qG=KPY3zT_lJ-uHBsttCVBO@a{GU;MW=wFeDmMU~R z0EQCxbMUzQNTv>c&2BuDINI60HT@QihL#os(J1Lfm!;l#v#W^QzljO-8*Na^{4S(T zW}{awNmP6!`|`1e^a^zB6H`(oHY0RDI-bu!fO_({P^yvr6&Z_O^I4YzWu;h^f^3!Y zpp{mWx`qY{F2l)X8W;B4&EW{1jbUArz$4K0N>D8cl8O<4eGPhH7~_K$mZ)UH4>jga zpirC~>#N9rVp8sazo1qssj%qUTk8t0HL;?e%-cM(o)~z<6yfHy-=fh&zRfZnC&NyJ zd;K~@E#Mu|Py+q(FW0jY^9gJ&H)gtpMfc0VTfi+JIad?JF{s0Fc#0%<$96m?05#4x zD2!$?S5Kgj^SCTYdUGB;=<#ZK-dpm9V7KjVc=5T=`)c^_NK8WmFX5$j2s))^ks>9e zajb07eXiDYu}MWn6MH=WAqbjYpXRZ$lDRdQtV>#BHl^8WQF!WaC60ha=dm#&a8D}V zs@VWi%6FSU39aOW%vR6gBG@NxV#cQvp-t#|_g4`S9*=XeM@_o`)!Yf z8OEJkLvPw|yVgHQHJ(oUUm;zBDvMId6CM^;Gk`S=Zyt#3MVm5CPL~Cs7m5iVEP+XH zcCsGP;&%Dxw?sootdnO?`%5nMW*dR^uVEDe`0JzkJ+_7Vm`*>1_?<*s>9vX!cja@r zocDYuxttDc9=eesoTzen(Gr5!Bu2^iHJ6>KTTxbhTS5!ibO?@D84e0qtR}zKgAV6p}Io{x)a^) z#NtD4eEe4BCUvKZpk7u$KKY)d1uoDYF89Wr=PwVvydHswvG189nKagS98eh_e+}B8 z;#}fgpoX_~6M+RuCYi}t`T+NWkdRPSizd6UP;GopT{8a_mXqGv9Z)yRKxhGmQD64= z@0Wel7VCwoJy|alKpQaVm67rl(PQHJIO=NS%ZO6#H_yp!te`R+Bo|p-63s0N9=}9x z9>V2(>$$aEU1F)!J_x;&)5&)tV0=k=h$}@4Ob4gp-IIPHnl}{h;3M^54%_3q93Jm) z6mGA=0x9(WeI_nInO*Ga+5`<{Z|M|&dJz4{=2-Ko{ayl<4`5_m8XaUreeas z4-Iyo7kRz1?e?|)px|zP6xPttko3^UiCkxt{FlO3ehqnOxUOfXrKO#G?A1*qrQ?;R z@;D)UQphYWrY4hb%P+fyXGaYA^~M|2WNvE*7TtmEKP>jZ` zKL9XgMNK5tQ3lbmM1?1MbrrOrL;4V)0R;nK`0`QmZ?p%DjnLnHuHD>9)*@8nWRmg+Q++9pl z(x?Y;SgBM!f(T{CeZhFy=NfA_#yd7J@JmW4Kv}EhR!cp-O1H_P8uO_Y^P5V;0*7X2 znE@%xzfhoP$MOMxffo%~C4!gaM0G8%_v){`?IJ+!;eF6HdCE(oUvd!cO&7aw?1&CW zXt#h`tmzV{-hhn?%KYXN_Ec4!IomD+VnVk=I(I`?$N0*@0S%daLS*C|oTd5vd2-q! zfXmq%qkBZQtKQxM-j>F7yo>F!G=?AcPOemg3Mj37ZG&|tnSz+tY$7*dU z8E5|lDA^@#$g{rKt&qI_-QHtVS>*=E&I5Lm_GfxtSJ%Gbux_>HPq!1Ymqa~r#@&}o_A^=_&+3_MR!h-)!#QxV2}A0N0Taif$=q&3-DkW8eJUVGQ|@XgEGbinvJ7TGztD z0tEGbA+CsbD(71aV0y%9%vDNPQI*!im6E%}KDQw{>?<18IvMG4)Zg0rhOOS)j4FVL z7K-)0Ih_Qc5zF>vzRrAm>!{VWKOQ*o#`A|$xx6#=d)|G!u$*tK=U(()c|iwzl|aws zut&30UEz5bp4kzgkB)_f6(Au3TBWYmERK|iZ-TMtjl3Vax4j)ogzlV-htj)50zGGE zXP+jDYKEJf3#=E5FyNnG{Q~8UYJ*u#hR&Ffi)_A=>G?KK`%xkk_ogBSkXv zhtvK20@i2PEN;)k8tekRqrp0X0(0kf4Ok~fK-n{##<$#{KyF%#t2pc(yxr_rjQFI< z?s&^Qbdy|TuHeQm{cm8vVytu7>0rV2>Cv;0N(q>0Xymf46K&TaSIBs5Y3z>j$x)|e z`;*1yR#yJrzfb7j(j5$H)Xgzlm3Z_cqsn1M%L&TH1OxHAg@|~?A{Fqd#6)Q+x2* z_-J*t!2n8PI|GQM$CGw8sCj?@a5R=%rOJ-McYh)jwm0d1b?AQJa+)!iG(0g;DT!my zIlO$ASX#g+f18e0qsD9P-e4(} zBX}@}HkUvkVJOXdxxvRWIO_xEb)m?a>9{d-rD>&UKjy|?n47cgR`UcpWUmrF@AhAp z1e~qzSMQ2LHW@4M*?&J(VoBzDX4hJ(hq!6RK%r2RlL}N)hE!SJ{R_`OL1|pZ zmtp&CZdbb@*7Fy5tPTewnW9%mV-_q0=})mk9Py?zzgK_xh1d+WEVmxc=SS#GPB23t z?Rj~_sc~C)Q34VY<`;c&hW+YCb1m~{HQRv0<={{r<37|IFbX!4KXTwQIca*?p9Qr& zkOA@3kOSxQD@SyCZIAh>QlRC>_aP`1D+=T$C8;rK%->KwSv^}NI!{*h8b!{wG+3>* zTg)aGIP7tOH)d1B6O&50ngZ8{Y%qz(z2o)*R0(LqgB|3rPiaky9`$(C%%`jgIS$%n zeo1J_%0_zg^AjT?Lbp_uY;A3Ug!!K~H4%^w10(Vk(cp!yS4%xA*U&({QvgI@C+tQ; zv_glBTOK?@!ti%prU`vizkGxwB}4f#FmQ2;JjRPY+|seK9)+YY$cmea)|W*~%>V&A zDk>^N#~K2GynP#F0vo-*KW!apD8e)6FICuz!~f?ZNMB~xtzQsltm^vm3JMJh4W?4h z>77Pa1hFN)jo;tdL++u~mj6z}YjagD%f%MDpJqIqesRdRGEf-f%ICqUN(E9`7~_*O zD>o^L{4y3Ccl%~x>SLUhj&|DZW*9^4O4nF$Wdtka<^mTO3xPUGDM<$jfGXaVru)Xp>H{PyC zsxcX>s;eI@)*TON1uXHn)26oZCj(o~dCQ%bod>W)!lU3SmYB#DO2!sZfuLNExX6Y1 z7Y|O%GH*)^?`zZBb22H5FT34*&yDu;hYgqKE_~J#(SKX*v8*^Px-@ZlM#b4;#`^yi zh$$@l_()?Oa>pht9MN|zkp3$)=F&!ZJep}!NewECMh$i6q^;M~)J)!^-Nr8dUYEb2 z{&1jnqxT;fIOoy+(`Pa=vZ9Q`6wA!0LJv3HOOD`)`NHsOdk-)Bs%h)y9GHIyobMLN zF?c)Dhd_P@=(Zsp_Q*3r4W!u5Ak@-Fx^=>^1GuK$R+C@kLLk(xQ4eA+HYdzYQF zn`z}bf`Y#kMP}n_Yn{NYBPef9;uu#M8~XA{2n+8*MfgN1?iASmtH8=#w(HdY$M^8R z6leb@wf6tN@V}6=|3A7wz3e?8$pdQ-7bmAWl`+%*aGg94U}SAHdzag8)w;VV;^z@$ z+;KZxpC$v?M8q;^BLWjf?tdm3o|4GvALeCv##V=)TK(ypJ`UdX-i48; z{ra25;CR@+j~CG*e3Fw*{J*xwFrGsPoOp^?b`JF79F1B0i>2YQ`Wnqc>GEaZ@9AU)jhxY|9(s1WTh=>5d+A5W&764~!?VuZ zbJG)0#)}vhh*Nv+VPbF)EaXgH)~Obtr(S3J;cg?2FOS@^`E-EEW>dFk=}bCI%W-tKt10J#g}FA>)#WyR{#3{rf~r#f zal)fjDlkZ5=3zJnwVy6j&DHk!v$5?J*KA+P(9)Tc1P9Y65~I=9`I+^V&)YV_AdMGv zvWk{ozYe>xTx^5IO6$Vx%mz?+!LbBf2o0{FO)EAQIDyA%u`^kWwFhk6pt;}TbU4TB zd5c8Ai9YHI3~vRZ6PG6^{5*QlKtQ)Hf$>#RShy3IkL0Rc&y0jMXf8pA9asf)yMS4i zbWYDz5j0h$(>QB@rUn|&^a^oXJA<1t>VXab2BqgI2X;X0PCqvvx{5_-iHsreoBSmvM?O3 zuakCT|KFH?D5_tI{&X9~M#6Z1B(l@f3Djx^tnudqzD#6Lgfm|r@U=ViNVVnbEQ|z- z*cH#qx9l`urYHiII*)2XksO*>>DVfTSWK5**J&+T@m`GNnT_(fO^!~Dp+j4~)#&m5 zM9sHu(*5a~pm~aor$~{GGA=e;9I-e)IeJ^FAr<1$UFE#wg7-fBcI5<{CNDpm1>!y^ zn8y*bNQT*DbF~S}w)}R{EDPr{VoB5enlrbrAhG_(NX|-tLGa`u}eEfsD;$QVAPS@YOJis&yT-Nt;exN+kcn_?pvh_B)uQq}I zzuJ6ysIO0)CRCLV_?Upn$oX*25zJo!Dh8U_B0PHgK!D|RItWa41Lh0hmH;~F^xPco z4PG%ACnM_rI1x{!gb>wY@Gm-%%b@qYBJh6bx%{9AT|_42b{R}&A!$VfOfdk3=xguM zXm&tY*r1O0gWo2EfN^?a!U0%Jl!_E@E~a%*ONh8#KJLYA9vn0q4-+!~1CuWzj<^dY zYE16#?nqP&mSB3r)Ksn7WHiUpvjS9-G@)`*p!@>URzW%85MxQb2SIS9dj z0y929eGF=OPTT*~1=sE}jMHSjEZKK``|iqGwI6jA+@=ck4M$f+`!QK00{!A5b0jba z!lr-aafEC>?damMn_V@VUg)Vp1cN-*IW^i4!<(Ph($dQ=11~2ZTQ^Qe7LRqvhjlHB z#U#v4&{>%Xm&(jG<+oxQr~5LdcMdF_<*ap+(TWu*)0Rj0*=8;ElJ3fmEBGlx77Rl+ zw7!(sPJX#jC{lD=xjfpOkECn?wqV%;skE`cgKd26uic&cm}}-KoVk0-6zBSze_546 zIO>}*ial6>(Fd3^rVD$4F_j7o76I?C+sdDxz#xlE#H&g3_PMgh#2OcC5$h<|ArDjJ zUnquWV`BpYZJ{sUH?<4BypT#}Zh!Ubi_y*9T}lc$54s;J3~QinN2OtZqysQ^mxCdO z8Odk>jlj5|E1DIk1l%K+r<)RTibrxXGUYDNHEr#&6mmt&IhsczXJ_XF#gZDJd+Y1#mjo&Vz;khM=$ia&m?`gtVjE4A zs40|)fq?sDuCAV31wWzURa2gE-r0`##9&}jwcxLpMDGc+G|qOeCEFQ4jsmTDstk$x zS(e~EMtj-!dGLLju~psi>_p$hrvO##qS#04yBVxYx;*MQW;C?OF;>fBEIzAaPWzsV zob&QRQ@w%&`P?z{<(zB<*5C4!RldH$P>CNoYXNET6p8cX6oQi8&ua|q&{Rbulam-1 zz*@`*{Bz9Aic|dI_)lqEo}Qit%D(z?oz;o_$iG;=)X9Ql2t4DNt+JVd&zWkvY!Rqw zoQ`|GzG31eenHD#cZ0*j)<92OGj;sz>+-B!y3d%PP<2(CbyOrWUqHa5(Gc*%006~~ zIaq3$|NB=kIrFQ}OZ^|94+^>$3$32>Q&Y-{RGFXICC1FQwgL~>e-?;__awf8ePMx+ zuL4ZP6J}(mJ zB1KQhl_)jX8BXXsiygju_YUllAOvJ9Y^0TDr2<(2$g^*5)VbhC;V5-RWJRy4oX3gn zJ7qsvI;ld6#OXKRT09@VtQBjueAx_6&RXL7c%S%i)?Vs8<8k|QPeV+p?rCHYOHGHW zK+H5Hl3pb|U8*!b!ffm$AdB3pK2M$!oni21jGUcYoU^f~{2o;SF?kEUD>TxP+?^T7I+!xE$r?ET zgLkX^z|kff0YUCI2I&BUL%TWTDuBpqWa`n{SNuQm8aUlY59MHBp+QW<-Ye(wB4WAH zTuy7;&GWbyP|{_JX_8s)?)=;WC#Q6l{Q0S6+jYK+iYep|)glCdsU2mRI-XzQz!DXoyT` zVEEZ73fqK?TOaAH_-FjI!f)X@*=H!;8%K3dl@f~xe!Q-iWZA&n3C6fWxQl!haR~^X z$0|T$i{z_@np%y?s2)&8*ADZ6$F>{@#DJd$AmQkJ|Ni^7z9Aa8PXQnTfprWFfq;}k znh=4@f^fm(b`F}v)_{pbIRmY{*=AKxQO~@f9R?YXRTKCCiM;RSvN}brgA&1bEC^=^ zKfq_;e5>)ev9r(tZWwv9iXT&Y6F*md6_tOIfkTO4*)8_H!yg$;B{iLHt1NCrs?;6a_!)|IJd^R821UM3k1QzBGT{{3+kPHGJCWtrNd}x zdXIodM`>`mT&Xp0%Eod8k1Cq5y7fszNpR>;GYf(pw??G_zHMi|Yt0@6i zW0u!TwHQNO%?EWW=Zx;t;D}eyq^e95i#w$h96u?1c0OKdJ(EGvacZBDb>{ES5v7VQ zRUDffO`dC_JALTIz%sI^8&06^sc=%tb;Xe?ZG(-YDM^fs{O!?JSm^>l53uIvA)Bs( zf`U|z@oOGIRaNZD19F+F?~A}JJGp(}7Z~`4h6aPzN9p4rPo6?0va|xQG=Y-As4fhA zelfbg*?RU{V(Z=J9)ek?Np?y>LC4wp>&VDC?yGD1BsIL;j^R+)JlTV`lYtrO$>P`{ zB2)t7g7TPyFz;NM+CpD(9_F=m(K!HI7&rv^#o1x1^l?n>)7H4;f)_&iyp+FyX_XT) zIWu#8CK>9;hXRch4}8tT(_;NTHpbE>xdK7xd9)!)KAD&>8X5ZIMJaB*oMPC-91&J~ zFF)JGdz1_dg@61q+cBjAm2pKCg_6k7NT>#I9O;2!<(y~hAP|0c=L%B&3L%QuM;;IM zEYA${*-Cn41@s&6FofUwkAOpRqZ>~CtmH%!{jV=L^6~K!6EnVi`b;Kn`20&Gw|464 z>T}=5-1)Rh@rg1%2|UjdfOo&$*)iGQ*%9+AkG^F8NK70>{2vb?1uXG*QX>h!@+|3a zKk|F@5CsKu`@w|PIE&z=<&P!y)Nz`?_} zoSsA?#7^GdKj_pq=)$C(UY14_NVchzb9;C!>8=G;Ntl=<7CcV~_N9N}>FMd}68TDo zHU-3^sS=H+l~q#kGHE>Cy8D-D@&dKsX$&6G2zE|qQ->{gm-=fnP&6!h9n82QV71d} z^FqVH3F@aOCKf1?>R;9Gd2F#`VPv#@=$0Cyqmw^;Eq1wQ9sKOvtTG)=WE4u46!5s8 zHckL#Xj^e0x4YSq`8<9+lUsxwRD0c77ZO-0B}b2TK@Ym^k!f4xVi?#q}+Bsw{`mnVYJW zTM-m~)PUOB%E^t&6VG1+umNuX1IYv!4;Shf|o$zdw1sfr1!H zR4RzFu6I4s-X?Qf>N(GPymV8h)kaKp+lCfhO$$-W&Y_emR4g^an8vaiqLcZL zo*@_C*Lep8QUsUtaiLoFSK#)^r2;PExZ-Ke1|#Q(t-%jn!6}K@A-5|lE8qhzH#^Sv z72O9Zv*q*l>xb5+Q((cLssxH{jhB51nA=d_zRy1n@E zho9?i9}^P}LOCE_$g_%yT0B+KWP7Fzx-Zo=HQ)x_H?D01n!;<$)Yn~Nw#u}e*Sl#I z#+x3>%P`~ngvwf1JuwrAMq4mJ<9Udtm zLFe&)YffGLno48pgJ^J!|4+mHc-pg+l=WiJx_#1a@y`as-4Ut;`u&2Km@{AEt7#Or zVxWw{tzKTeQ1(@MjQ@aD&bF5a+17QBOltXZ{Vc@O-EiPTBm{KFQ4_(bE;liZJMPdY z6a!5IXfL!k511KqCE{(IYz3I<?R9Ff=r3j1A8$F{`1uQCu+#M6{zTbl>4l}Xt9hNa(at>EGb1TfOGp$J{X&Vk zB38;I+X&lG5?bcjB9~4H2~|7)@}KRrh?sF$d{Xsr%|N5&X3u=LNvhtyF+oZjw-cN7 z_)>WI+ZoESPw#Lb^_sJlaHrcn3$b&g>LH6P1v*54>FutKyl=u|v-ko30$v&$mxHTG z5qR86ayON@++ksTfGK1`*R_%+B?ZH48!o`Rh$$F@mP%QMK;7?sM3BdgWSk0?Q=R$n66T-%tgD zDj04(QSmcVSN=7RTPXEJ?xqaw2o>ZSgcYGkrG z^Okxv*u8#7_*EFKKd1BVa2~JD3K@sl=H$;~iDTM83=9WOPtJwWt)^?Ge2Df*g{R7tihG8&7`EC+D%x-ED6Eh1-L~XGXO` z0Z4*a!5Zs@)uK?RUkIvSQ<)B0{F!IOsPr#_gBwcKA14|&Wq{jhvRGkzbe%jHj@j#I z&hR$FJ8^4pzCl4$a>cwaXIVJak315$h&;nQO>7Vc??(oT=^p2` zNkxF%OE(C0j4dyR)-Z%18`F-HIjg1c5gpm5L7iMMjnj(y!A78!% zB^e__LRcJ+j;v2fi1 z3vUQL)HM2+(#h`2py%rVgoI6wk55id zE6}98@(IBA_qT=E%5x}*wG_1>x7U9jlT2)mc5fN<;H_LM@rE%7#vZ9rT0{JW0xkIuPT8)a+ zLuvBf%H)nWl2WLZ%Qv^;hF$HgrzajKJ5kt}2yxU(m1S}S>m49|^edb<=U7braVrRr zOc^R-`<|($8abLh_nOPOiYI6AdduBdtbg}nQ}`R>o3p1Yk9)lTqnB%cXS$8UyiQS4 z4wa}OAx%065pqa!juw%eI$+LgM3_$IFh;C|XesCH^{Pb z$(YoNOfJWL;Yt_bic?|gsX9F<^q`$<%Rc(Ixj7o`s{a{R-Ev(Wo!RMX4>!^0$Yu{U z6csUQU*22fQx~6EP2X5qgU^}xqRKd9W_z8}WsQNkMaV@Py1itgD|qA{AIA!5zEWv{ z{@sC$EhrXsn(r)EU|5$E(vLr}x}vU*=gM(Go7q!74YmU@`~9bgw(X<3|%E&y_gf|Xym z?ED?7s&}Lm)m~^>0!9Kp-6%WpnXarX0_k_<2?9qI#_~%;S$yC4U0l` z3fs9$5cEE$w3EUv7&_`|qhUk;NCtbVp~09E8mbxGB=ea|WSI7?At-bIzCB7G3dB&F zA3itGpCgbYi{Jd}%h(R!8S49-I(#BGQhUM$Vbs0WkFK z?ys%Dj9&*qKBh;V&aX<81c({vfXhOXozGpnhB4sWoga%GAqLVQx!OuP*^7su_6ysf z@qBe3X^{P}CuQ?Kk6LKJbWP(zXV&hx$$?;feI`J;L;uv?yi^lkxb5^c<^&%YlN@27d`px=IG}M(?bNN;8qjss$iP-pLYwnaH4tgeFDt{SmXNC zWJI;|oV>?d6ElK=4cqJJ^RU9tZEYQ^EZU0(X!uDyWA-sFTRA<2(h}gM%{u1&IADm04tCc0<42wnEvpf z{L-Kt4dDClA#K63`bs;oN2VB}!XtU^LE7?n_4W3#$EnbO2+du@r&n&=w5g!U56?B; zK0Dmv&G1?ijO|7K9I0Q^ z+)tph`vx{_fR~3yER~?(7T-4;%Pe@*LMZX2W$pT1^j=@?r-g`zT7Vb}4((DNnM|Hk zcxnMD>~5RdA6^FZ-E*^QkyS677D-WQ%TBk5_m{RODwbj%Gp&>&JS4&ZeT@|tpmJyW zF9_%1tLshs&0W}^GfXsJCl*of1zyUMLtLPds7d4ngqs-?1#hQ4(`Gaw8^ss zB*x%-mY0bMhQ0noSyEKxkhgAvQV+PRaLBC$(8-a6N=sYM=>wEo(f#||G!jg#j{^d6 weM}v`9n&~jIC^TU+5a;$fAoz;%118bSg$Gf_G_#j$dnX0ebU*c*2?eJe~i1>hX4Qo diff --git a/src/assets/images/ruleset-engine/language/expression-editor.png b/src/assets/images/ruleset-engine/language/expression-editor.png index 476877c77232129d98d74491a25c3c6ab75b57ce..05fbf42a77df1a472ef34aa759cdb6bbe11294cd 100644 GIT binary patch literal 2129 zcmd^Ai&xTF9{(wpmT6g;V`dYInPoNTSZU=0Yk~1mkSRqvnTZLe<)eJyV<*z1Zi>L@ zXlkDu-|M+_po{Ja35Cf|4| zbd`?xpY#nl4z6H|6)yw|r7eX*uu}|RT3HGZz=&Hw5X+kaFhWov!D57yyjDsl*aAu^ z7$H{Y>68HRl1UJ3=@f%Hu~0h66SE2>l$GsMSd5s$n`%)=COgG_Z$EpId(~<+kH^c- z&Q3~78XO$V$jGR#uU9ISA}X9vB?mz{HxiyF0_9Z%_)644ln2*=z@7M48p+j}Rs^bu zOV#BfaDuC|65s^6D31Wo%YzdLkpvx@nwlmqU24@maLpCenK%G26|M}u)|mSj0l;t- z`j}ThV#xGxDt;5vB4aiK?IrZ7*?oG^-^Re`FWGkoFI@I{0V1bdBf2`GQT2$prsFDY z1IKszW!zpz6zbz>NBfM^0wl2ImX zZ!Co}fkb&`B%{ir`Fn08hxJKmdx!X=!!&aoiKI=7&??KKgZxJmzjm_MEyf23MyExV z-!fZ;*@p|$DVj~!92%Efgf6631g%zb=MpNdt?L_I<1*Iu@Fo+I@&%u= z=Zh=e>9>Oi_zBe`b!rh#HpqxOn7|mwds@z!o{8cImY+d29Ofa#^xvOO(6yNon+6wA zC3X0konPPnp~|zXX9Qq9Twp~6AWHh2Fwg;*2l>2&v`t^5(X40N4f|Uoe;O}V@GuS~=KZy}jiM`mzQ ziS4=WjHmbd+;6ZdmLK8OG4dlM9sQQ*JF!X@U#@K>Mn)7R&e63w!8GbeyRbxv zp3xd3Pn0Ks&<7k}i$@QuEI?a5ppG=3thE3*RkD#!iNyK!tFr`a#5!UV#J&p|CNJ9k3k$RPVnR=#zIcE5c;B z5Fx!tu*%Ul4pkAv{X89CDpi-iZF@LSaWF=EDmXzNrMS8S8-_|U+INWA)9^)*5QlUv z>YH777FAkiyhv&`K>Y+RHFS+jC|9XgdQZ+v$L z&F?)AFG0BNe%C{zZFcwFM~7uThWCbYjCbQh`-9287B#O@XJ_lS&`L`00uEyS8*+gKFX_wgOd9MyRKFwrsHeia5Zb~-BDd1%r4*-?#l%|SHou~jE(3pSOi zIQ_HK6`uba`Br>`&E&)`!cF<7%$ce*yj(r#bTzrjjCE?H&J6;$4ecpGX!OeY>N4if`1hX@p0zTtR(KCdf z)qvPy)TH8`QQb7fY#;G5G9WibZm#oC3J`Ytya>>ZY4_2s=; zz&yL*2ne)R z>U*~n77ZbR*I$}!GbQ+Wq%${}!6%~El{}=~x H{+B-hv}DwH literal 11047 zcmeHtXH-*NyDjSL%ZG@(f`~{Hq(}?Wt3*Y5lirDR3B41l4G`&p(3^A;AW{N`s-pBF zy@Qm{dvAfe^qe!sJ!9N^$GPX%{c(SgwKLdjXYI9~_00Lqxx${SD^Og!dyRyIghEO2 znHCAjl__xD_^-?0GgKpv2{f17wG^I`ly);LgD-#CK2du@LQ)n@erA3Zd?#~JG;}8+ zx$*7y-zAy{%CAUBxa*XjJ<;(oTc7kc(IZ^6xQez@$^9e8@Jn%mM}%5ILa0KuD>nH) zpL=4_v1fF7xiFu1RApMS-zMtAwQCR;mJbiI$`3cM3~xuhqjw$bonAdAxCUWYB^ON= zC5Hnpwi`CO1BBI7RD>>p0c^p9`p=oc#h0KDFK>W$>2favXntPJmHe98_H*ani=it+bzrMbe@>+YCMr_Q^j6JijviZq<0byp&>`E1z#=9$E z=sEq`Ie$)1!!Tf!(#{d`yM1{oQsUz8f`ca;0*rBK(g;C5K0Z;=gSF8LH2cGc4_R2g zHZ|ouetj8D72f&7J_97@b_nWP^cyXA9y}!TVjNRXJlj;5ukaQv0$2h1;_RuHVk6) z6ZK_p26|Q$QKwx% zKtPL0#^2}h<1a1DL2K*llSSH`O@-h0SBIe&XS)kvvK&U9|2?<5igA1>fJf{u{QM|u zT=|ma{@P@1b!KKJ9O^dze(xAOx)iL1<9L-I5*BzYH>O`|!nM9xw;QE1H#?h4h?Qq0 zc1X9%?Qc$BbS4W;`|n1sIe+%Ll1yjU=tgJKltpWw8DLhcKlhzsH&A>zJ5luoMEitpZ1 zYFUV0C6?)*>&#b zeff!6Zw-5}MSs?(W#dmIO|0*?Wl>#Xzph(susz=vw<2m!_C7y9KRE}V+ted-s)|gQ z=Ts_;CMG<3p2YWp)F1!3N=z~ z*>b}(>-96)(RC1`A?5S>Waa2MaCaoV7{sz=?>$$T<8Y~|prW_8H#0M{5@v;iVboC6 zak{~@JU=e3A4~+>7IA+VR?a0UX>=0*{Aj&;Iwdt#<#VQhWpklsj*hNHnU0wA6tCYx zAe*2iRhBgq+k*}#0o_)@z<|=d=i}_Kf-C*f3$llbtm*I zRcj?Q<#8KZzt9q$AjOudEIeyRdP9%rOZSPv2%2Cx}F!pc% zrntc<$%eU%;Ge%tk%M}(#t|Gw&Dp-Aq_s)!Tz8X-iWQHzI48oH--4xzF+bbu*AP7C z)AILB*yXP_2)DWh*B3xep$gMsz^1csbFYBCT2@wuy!=R7nt_oKcSTh-*Yr)S z)hd|Vv9YmsO=L`NKzEu1a-NNq-{iB)`Ps2nOfmme&-j=rQO7YhIu)vqI)`hcIb-hk zW>mFO(p0DnVp-+b)|G5f2cs3XDvQXwU~Ot&_OiAikSlD_Xf?rze6`e4<7)L;Q}Bv} z?0nT^WG}2HD=Q1^`-}6_P2$OZ9QwM_39Q_z?Pz;0uLkU^hQh8ReE#c9r~gE6pGl1}lB~yJN|_7lX3hR%)}Wt2~=o zoe?Iuzg!Wv1sa)!;#L!7BvDmJY?mw15TjS}`Umq}JBTBrgW+)KNAmMae{T&7*p&Hl!AflarH{$OQL& zw#KpXag~qeO(8qzsP^Q)MD|JO=;`U(ytJMx6b*xP97b1ZsfyKF|#u&*T#^0xVpxECEB1a?`?tM03d|s=)%pC|q0nLE-7I!8=wXYF{LUG&5a0?6TnDOWo#xy)B{n@E1Pgq;y zwf2;6%cnC|WfMqzp!xLL%0Dccx-|0-5U9=)w1fiO^1kL_W@|*AbL)~?b}qLq#%Fuh zh^vK;oSZyv7$oC%%qJWU#a7ZTp&ihjDyFdywnO@5P1{ z;9o7x%{B~&_Y4-69Q46 z{Fp&6(V3*27UE}#L?Q*D#?OOw_QRE8kEJYe2FQPvdU|J`aGc_X&5QwT?=AP&daZN! z8fG6e2c5;bPP}c8=elo9%WpP;g+UEJm6+BZfS4StdQ?;IcL;#HYicU6FIR~Nz-hTv zSQU$uL>(Tmgr3^aXYLvr8f0(iMI98?)%AK!6rWt41{k7(;yLj>we0a_uN$#D>kI%$!D`7W~~M9yq96Bx+I$dCsan!@@p z2bHPFurR=?V$=A-FX5Iyf>7UQJnl}H67mw3aQXFWMw9dDjd*>})u@M^Z(|hsu!1aT z4g3m#VFnq0gCP>CjcSKcxAQXu!W~N7>(|VYZ_8LAE&ulI+tX%jgGKa*56DN9OwtCW zCU}TxO=qfD&%}huiKd^-->8aI0Qdl4so0fU*)d*n>U`LhM(Drx7uwl7<`rka7}m#d zt0QGOGaCls<`=i1^=l*nGT4V2%UcYlMvfQ}YRRb2y^l1KWwbSHSxpl`-i7`K{L3)=0D$!xy zEa|<$i&aU41ORqIN^w`%VdPopROr^u_sbLx5jXBPIJ(;Hjh1JXP`O z-tzrWN(S-g94x%Ns_M5G86R1E|5x${fVCKyLHl{gq5hO>TZ5o!Bk>>=hr@Nk8v}^| zJ<0(u+n#Gtfs6TzGQGWS@b@Q+AJ-5aU{7;m$3m{JG#xZiLR*)u%GyS_Wup;(G~?rRSE7g8omf+vAS`kpbD1 z{fpAw1O|>p_|L4@4gkjoe$&r7A6G!g0njREqfB^S>oOhGqZf4APw3=x zCV-sEzWg^SsrTAQnf-8Sd0R(^$`Fa5r=X(JIMsLd28_t7m|Moh1_D7r7iy`Zh5+Hd z4D6b-b#>gax^%Av{fPPP9`7QOJWaxVp)HP+f^tG9Mc9t@N`vQWLh&_ZT%5HS{;%U- z!SCL+azBN9G_Cbo+2)sUcXLDPCZ_~(De6L=@!0`3VNKxDPA|LvyKZXU`{;dH+7x6p z5izmqii-Y~o<6Y0XXobFBdv+bBHY}{j(saV@-JT&rWLx(d|UCQrltl=+jX%!9aKn| z(;x2lL+QdJB04jnjkiE{+*n<$^;p*O?D!CqGmjPuO3g?%@l#b*t*YK;vuZtfY&hSF znKzOZVP&1=;xIxqMo<{YJ{ByHKxauNr+=!jlVlM7{ zB8Y{BORoL&>f1fzgpCV!;MyNVtQcVKUe5PnehV`E$c>v zs{k`<4qp5k#mpEHT^Yqa9kH-adTqhzG*;Gvt4hv({#?ht;74e?@|0KppTTGeN)+KB}Zj?9GynVfMsC>0L zAaM9x+U1Gl#lhkIMyEqcJdJLi4ogwH46Ji1y=Um80IJbBy)@ih>o6oEq;5Uyy`8Z3 z(6)Z__}BZV$Bu(ItMMa3U43_ys1|Cclv=+L=IYTq)Zfw_eA~OLz$>Y`m!DVAW^tPb zdOkBp@1fFdHnRLxaot@;r#nzc(5wAJPS9HIKh&8zA9E{;irVt%y%qRIunTHuo(m`6 z_zLQI@S)S;^um^ltAi@7a*ijf7ROXq!)cW>U*kxxG#Uq5b)Az73fXaRXqJU}^4vll zIPhzC^+j$aIR`>nBl&6Em7xl^{q27j_TNsd`-=vIqWfWc zOfFH~wAtG7ef8aq4L42I-78&#M4G1Pjd4TP(G=S zIV;bPEiVw8${UkLI_UZ39l21WtBgBNfVC=WC1QB=CyGw#QB+jg<@I8ZxFN1O!!?5) zpS}DiF>-twO=bA%^XFODv;4x9%cYNCi8WkBMd-;9>kr>^2Us=-(b`j8qrLJtE4kn5 zmybYlavdeGKj#7@lZ?#phc*{C))OsbU_ z50-#nZa+)RY&5b9YqUX>W#T$MdH3K(Kk-^s;|m z$SgS}McJmFK0RwtXd*I9Y`&W^Ri9zHJ_DB*{QY}Ff0e?sADjib%JCjRaOVpnFQuZo8m`-8Fodqvd_}dKxdZwKX)^SY(v#Q57{wX02Zb2KX=WE3u)36W8*1Z zx}5!1ERyuvK1a*ZxP9)N_@k^!w@ekTBYr}yer#0S)ZG4Rez;J4NYUVlJ?>bJrV9(x zIN8EPo@$r^4L9sFZP2NciJ85MA3a9W%n1MjSxq3PjKJ|>x~STFy1 z;Hfk`?sb_=j|thui@v|<@Yi>gm+I%^b(Grv#NGl<`rzp5rg$L1N%c+I_D)x=nh-=H zao*RqREmq56_diJz+Z1x|5^Ap_Y33PtjSDL$V9kWe226zL}xv%1SHAn)l?Z0vRU%# zv;-cl^=61rqK^*%xG(OV6^bX$0{R;=hb`yi^cOWgLag~3tMI{&8s!{RFygB}f*r>{ z=6mvG*?ylJ->8j^NG`II(@2b?byA)iyYkx3&aS*MXA+96#3vidQQ9s$wjI23Y=O{t zdL0#76XpjhUBhowIvaFjo;~3VtrNR%>7DVpuMoZ+KD;>*rc|hf{#iLFL*;HtK61mS zIwaEbL~W4D-QJJJl`rP}=$pf-u$Y*;S7j{w_cvVyLDQZKZcCFlun1i~(+A`7%T|*g zzpPlBfOzz~hRf&a)5g(e+;e7GR^|%2 zy8hjv30!*jBqXexQ>X>``gTLRc+drp+CNyN_7H-N)vt!i;e7Kve(ty0@cVsl<}8uA zbL2!UPq-Zfl`e}nK2MDm=bsK6Xe@SlwQ!Y zur@9?nju4*dy8>43Grzu$dr_0J-;iKiOE7vF9A#R*)U8>#n*~|zWu37l-!0skv)Df zts~fxNkukv=OV-e!c=(8U8p~F!7Ucw(^;<8B%xrnyjbRr|5X04C#6FU0@iqxz=l<6|dJmPo$JFs94Y_$)-;gb#@v)e^ip~*W07ZO+i87*t^rUwY8<0 z)52@;`MG^PKNr_BP-u~3bF*%!v0AUy2K&Pe6h@EY?pgAX2h7SUR}YNUr%c*TI8(|w zW8Sm`sT932X+Ko_QP(2}_yhqm#|D_CsoM21sKWBZ*RM~^);F~yStTS8JJr*oj#Cy} zi?S)g_U8-6&c_T;2pv&(^8^Pg;tASc5nI}|n;yhm{Jhb6uYPoVR0(<`xkfAGIwO$a zB}%~0Ze2!Xzhq)!YIwPg#Wo(K==J2v?JjI=Y#0%el~h#vmGN_Wxr!ZPQ$M+DI6sPt zit1s`6x^Uq;EF20q_~)YahI%Q@cVo%*YxQrX|Z8FeDDK-x;Z-Thx|bO17qWH7%iW$ zh=?iPKlxT&{i@pWOz8N`%$NWN$MKGY_#po-@$$9#0GFQJZHo(Itj>yW}`kQhwd(O$e5T_?ERV8#M5stm$mW&PXk8Zg~h379ytHZYFN9_+>91;nqcz_6mU4&nDqN# z6?5?A%j2SU-qEqKzph?Qm+%`ZdKH(RUgB`Fw#%|h%llABBwR!Bj*!jTp>~0hK~kem z)mrGJU+dudXf0N5*G3_l@$_t$g-0Lj=IP0&SDeIv;}3B4?}3TK zaLTAU#4cJ*;=#O@qK!uBKvR=!z<9u1GX)~GfkAYjUnoFNCH}!pYI@_3PZ6}VwA9r7 zd5uI-moFp=3N6pI!zG{4EUbdw7#}>UvQGzWO}^z+4d|ffViJ5WIOF& zVXX{T#!fM3LW9i49lrlGZ(>ubb|NO^ST;B}oOTa2R}H4}I>3%IjNOg=zymCUxV1R=U{vfB_Tbcq6!TPk?u}lspwY~l7MdVSrdqETsBz5?* z4FnEtx>6vpGKSs1K8mw1E|Jb+R z6oo8KdfY3KH>nt42;5Wy@f3Fg1xai4fKjSaIYbF8PGBNsrLxhOt!#+DfCFG^>Mveo z?J?8Q6``T3>0{Un5-!CXr9@>@7;JiEMEp2BEX=OIYLcJ)c6&Yx>^h_POPA)2<%5k$ zPCuZ{*zZ?Xz7n#XS{>2ESdEl>+E4mU#m0K;crH6PirEdBpekq>7)&tTJT3nIz`7$8 z5KmO9wYq241ds5$3z!4<#hz+E>|5^XhJaf2Nqt#aXJy07W!`T?`m#mChVP2u5kdj| zR~EW5r%Q=`$%i^tfi_+0LBm!$&JBZ-4<9Jv=q=aQQmY;8dUw>45h6{A5L4vj+1Z)k z4PRlmLFWC965Vs91rwWcyWQK7X3o4<@!3GWhmSMa3@iavHL9N*AWjd8!Qx;p$R2Xj zun+Nsb6p)dv2{>dfKpYx>oeTwv5nMg>yG^S6DWC-l9FgR4m~z}uK)He!4u?gBb*ao zkaIn#QavhBs61gaysyYE7ks$X+T8r(LC=#PA83G8N1sAJaG3Dw0m4YPqQ;-_p+4Od zcM7|rasgE*ewIeHK? zH#Y~AYNIL#It@xn$G5Jd8N`)A%pt&?@$*L_O^^KcA+E|_7@!eRuV@|WE9QLl*`O0ON) ze}2h`tA1@W2^K!dDlF`=&ulMfJDcs~1Z;-BQuOJKHT~er$K**VDG;Nrjw-&?!OZWq zQH+wU9JaQL+6C%Gliz_K5{E=G`6~GR3MMa4!O9QM&sy=e%sDF4_|H_tV`+mZO{IY zek5(vlZtf)aHzfj8>0rcsT0sic z?1S%0u&aOny)jnrw^4T-N#E#Xmwe7xCmuNaeT!e=I@rZ19;4g*gym%dfnB!7|F~R- zl0kX|oMou6?aw46HjQF*iu{+h%*hC1&LMo~o?#L9>ah;iV{A8%m&z;!b?C;^@a|VG z_tA>N*XV-i@`6@&0vG9^#I^Z(orb!^p*=-G$zo$Mq6`Bf8pyrcT3YHSC+a6F_H=K@ z2(hgu^*hSxWpm9%L6M3!9Ng_&;;nn`ZS1X=5-?Gqv5AUZHxRLjCt8Y3m&d1T(8nJ1nlRkzEr64|i zRF^mX>JqSk)He4TzFr}%ay%_9{zuelY|U)I5r93F?5dyN;pXu0)>8E9u(SV2eJu{R zkA%^VPdi_ypkNdWe3R=1+*^rdV`m(Ew_6GxS60Ev#&(@i=4?bDQyQ^T`Etqxf>xSq zwv>;C6V>ULO8`cJ4gX|_M9O;|$z#-bpkcV%su_B5Vn1Kl8x|HOsDd3T8E*_~Jo@|@ znB4RYb7De5sZzF8GesOvZ5luhi{nslJtoakzG0il-ZC85s5!mYk(4TCf1ugJr1hLs z2APzUw3+YUXt}74pk~kND7Wn_jAd6z@UQKv-I*#1$Xx{PPXyy5`AO5==Z@ozhk6*j zbSck)mEUPF8l*vLxm_TMLtuEf8GgKPYvnU{%4p>JSk>T)q2jEtziIm59-WZWyAbs| zV(MTG6pNEIX6u9xuy6hx4;zZ>Rab}kESlX&P-et$y?{m7Z4)IAizrMWe{g0hm zw94%}Ux!O2M#ejg2xNZb*RHJ$SPxayVB~FyxI2tY zH<=h1{LhZaETQF{qKSa#xXk6NLDe(M0-OHc^bNXb)fyQeudS)EQL906+zT*5nC_d?Olgq zpe%+5;t~>%5D;2DJ-rMjroNfD!z!=I6Yud#mc%P0uV{Oy<=n|qU}|YGskYWf4A6|2 z7#G6I;MMTkOi~LuxP@>ZoOUe_R>oAhXIT3wJ_Kz$5 ze_X>~1CiZdKzxfe?Kgrw^YW^y_Y26?1+!pwPs2l&99+Co*eU+E8gZ-gzi_vM7czvKVm(BS{elXFf1{QW*<`9Hz&%2wU&7?fI-A8!7MfM28SY7p9gyQFKkhS19A z0OUouxs~hvIbOLWxah{E@+Bdu1Z_wc`CC(Xiw%BB1LBS(dg-+Z#F}h`szO&qPd*2M zz`7{}sBiuFqX^t7UvLW>`d$2Enu}HY`}!&^Zj;_1(zp@jyH<23!)pu;3|^M}ehgFa zyPaS5EXa<@54TE<3lfG> @@ -63,34 +60,33 @@ Unlike configuring Logpush jobs for AWS S3, GCS, or Azure, there is no ownership To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields: -* **name** (optional) - Use your domain name as the job name. -* **destination\_conf** - A log destination consisting of an endpoint URL, channel id, insecure-skip-verify flag, source type, authorization header in the string format below. - - * **\**: The Splunk raw HTTP Event Collector URL with port. For example: `splunk.cf-analytics.com:8088/services/collector/raw`. - * Cloudflare expects the HEC network port to be configured to `:443` or `:8088`. - * Cloudflare expects the Splunk endpoint to be `/services/collector/raw` while configuring and setting up the Logpush job. - * Ensure you have enabled HEC in Splunk. Refer to [Splunk Analytics Integrations](/analytics/analytics-integrations/splunk/) for information on how to set up HEC in Splunk. - * You may notice an API request failed with a 504 error, when adding an incorrect URL. Splunk Cloud endpoint URL usually contains `http-inputs-` or similar text before the hostname. Refer to [Send data to HTTP Event Collector on Splunk Cloud Platform](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector) for more details. - * **\**: A unique channel ID. This is a random GUID that you can generate by: - * Using an online tool like the [GUID generator](https://www.guidgenerator.com/). - * Using the command line. For example: `python -c 'import uuid; print(uuid.uuid4())'`. - * **\**: Boolean value. Cloudflare recommends setting this value to `false`. Setting this value to `true` is equivalent to using the `-k` option with `curl` as shown in Splunk examples and is **not** recommended. Only set this value to `true` when HEC uses a self-signed certificate. - -:::note[Note] - -Cloudflare highly recommends setting this value to false. Refer to the [Logpush FAQ](/logs/faq/logpush/) for more information. +- **name** (optional) - Use your domain name as the job name. +- **destination_conf** - A log destination consisting of an endpoint URL, channel id, insecure-skip-verify flag, source type, authorization header in the string format below. + + - **\**: The Splunk raw HTTP Event Collector URL with port. For example: `splunk.cf-analytics.com:8088/services/collector/raw`. + - Cloudflare expects the HEC network port to be configured to `:443` or `:8088`. + - Cloudflare expects the Splunk endpoint to be `/services/collector/raw` while configuring and setting up the Logpush job. + - Ensure you have enabled HEC in Splunk. Refer to [Splunk Analytics Integrations](/analytics/analytics-integrations/splunk/) for information on how to set up HEC in Splunk. + - You may notice an API request failed with a 504 error, when adding an incorrect URL. Splunk Cloud endpoint URL usually contains `http-inputs-` or similar text before the hostname. Refer to [Send data to HTTP Event Collector on Splunk Cloud Platform](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector) for more details. + - **\**: A unique channel ID. This is a random GUID that you can generate by: + - Using an online tool like the [GUID generator](https://www.guidgenerator.com/). + - Using the command line. For example: `python -c 'import uuid; print(uuid.uuid4())'`. + - **\**: Boolean value. Cloudflare recommends setting this value to `false`. Setting this value to `true` is equivalent to using the `-k` option with `curl` as shown in Splunk examples and is **not** recommended. Only set this value to `true` when HEC uses a self-signed certificate. + +:::note +Cloudflare highly recommends setting this value to false. Refer to the [Logpush FAQ](/logs/faq/logpush/) for more information. ::: -* ``: The Splunk source type. For example: `cloudflare:json`. -* ``: The Splunk authorization token that is URL-encoded. For example: `Splunk%20e6d94e8c-5792-4ad1-be3c-29bcaee0197d`. +- ``: The Splunk source type. For example: `cloudflare:json`. +- ``: The Splunk authorization token that is URL-encoded. For example: `Splunk%20e6d94e8c-5792-4ad1-be3c-29bcaee0197d`. ```bash "splunk://?channel=&insecure-skip-verify=&sourcetype=&header_Authorization=" ``` -* **dataset** - The category of logs you want to receive. Refer to [Log fields](/logs/reference/log-fields/) for the full list of supported datasets. +- **dataset** - The category of logs you want to receive. Refer to [Log fields](/logs/reference/log-fields/) for the full list of supported datasets. -* **output\_options** (optional) - To configure fields, sample rate, and timestamp format, refer to [Log Output Options](/logs/reference/log-output-options/). For timestamp, Cloudflare recommends using `timestamps=rfc3339`. +- **output_options** (optional) - To configure fields, sample rate, and timestamp format, refer to [Log Output Options](/logs/reference/log-output-options/). For timestamp, Cloudflare recommends using `timestamps=rfc3339`. Example request using cURL: @@ -185,8 +181,6 @@ If your logpush destination hostname is proxied through Cloudflare, and you have 2. Select **Create rule** and enter a descriptive name for it (for example, `Splunk`). 3. Under **If incoming requests match**, use the **Field**, **Operator**, and **Value** dropdowns to create a rule. After finishing each row, select **And** to create the next row of rules. Refer to the table below for the values you should input: - - | Field | Operator | Value | | ---------------- | ---------- | --------------------------------------------------------------------- | | Request Method | `equals` | `POST` | @@ -196,21 +190,18 @@ If your logpush destination hostname is proxied through Cloudflare, and you have | AS Num | `equals` | `132892` | | User Agent | `equals` | `Go-http-client/2.0` | - - 4. After inputting the values as shown in the table, you should have an Expression Preview with the values you added for your specific rule. The example below reflects the hostname `splunk.cf-analytics.com`. ```txt -(http.request.method eq "POST" and http.host eq "splunk.cf-analytics.com" and http.request.uri.path eq "/services/collector/raw" and http.request.uri.query contains "channel" and ip.geoip.asnum eq 132892 and http.user_agent eq "Go-http-client/2.0") +(http.request.method eq "POST" and http.host eq "splunk.cf-analytics.com" and http.request.uri.path eq "/services/collector/raw" and http.request.uri.query contains "channel" and ip.src.asnum eq 132892 and http.user_agent eq "Go-http-client/2.0") ``` -5. Under the **Then** > **Choose an action** dropdown, select *Skip*. -6. Under **WAF components to skip**, select *All managed rules*. +5. Under the **Then** > **Choose an action** dropdown, select _Skip_. +6. Under **WAF components to skip**, select _All managed rules_. 7. Select **Deploy**. The WAF should now ignore requests made to Splunk HEC by Cloudflare. -:::note[Note] - -To analyze and visualize Cloudflare Logs using the Cloudflare App for Splunk, follow the steps in the [Splunk Analytics integration page](/analytics/analytics-integrations/splunk/). +:::note +To analyze and visualize Cloudflare Logs using the Cloudflare App for Splunk, follow the steps in the [Splunk Analytics integration page](/analytics/analytics-integrations/splunk/). ::: diff --git a/src/content/docs/rules/cloud-connector/examples/send-eu-visitors-to-gcs.mdx b/src/content/docs/rules/cloud-connector/examples/send-eu-visitors-to-gcs.mdx index 42f9530d7a36c5..82be8d29b07a6c 100644 --- a/src/content/docs/rules/cloud-connector/examples/send-eu-visitors-to-gcs.mdx +++ b/src/content/docs/rules/cloud-connector/examples/send-eu-visitors-to-gcs.mdx @@ -18,7 +18,7 @@ To route requests from visitors in the European Union to a Google Cloud Storage 5. _(Optional)_ Use the [Rewrite URL](/rules/transform/url-rewrite/) feature of [Transform Rules](/rules/transform/) to adjust the URL structure. For example, you can [create a URL rewrite](/rules/transform/url-rewrite/create-dashboard/) that changes `/eu` to `/` to match the URI path-style URL structure. 6. Click **Next** and enter a descriptive name like "Route EU visitors to GCP" in Cloud Connector name. 7. Under **If**, select **Custom filter expression** and enter the following expression: - `(ip.geoip.is_in_european_union)`
+ `(ip.src.is_in_european_union)`
This expression targets traffic from European Union users. 8. Select **Deploy** to activate the rule. diff --git a/src/content/docs/rules/transform/examples/rewrite-welcome-for-countries.mdx b/src/content/docs/rules/transform/examples/rewrite-welcome-for-countries.mdx index 61ca7826b26f60..d7871173e7c2a6 100644 --- a/src/content/docs/rules/transform/examples/rewrite-welcome-for-countries.mdx +++ b/src/content/docs/rules/transform/examples/rewrite-welcome-for-countries.mdx @@ -22,7 +22,7 @@ To have a welcome page in two languages, create two rewrite URL rules with a sta Text in **Expression Editor**: ```txt -http.request.uri.path == "/welcome.html" && ip.geoip.country == "GB" +http.request.uri.path == "/welcome.html" && ip.src.country == "GB" ``` Text after **Path** > **Rewrite to...** > _Static_: @@ -40,7 +40,7 @@ Text after **Path** > **Rewrite to...** > _Static_: Text in **Expression Editor**: ```txt -http.request.uri.path == "/welcome.html" && ip.geoip.country == "PT" +http.request.uri.path == "/welcome.html" && ip.src.country == "PT" ``` Text after **Path** > **Rewrite to...** > _Static_: diff --git a/src/content/docs/rules/url-forwarding/examples/redirect-country-subdomains.mdx b/src/content/docs/rules/url-forwarding/examples/redirect-country-subdomains.mdx index db4375b2af2091..f0b0c1e4f5e0dd 100644 --- a/src/content/docs/rules/url-forwarding/examples/redirect-country-subdomains.mdx +++ b/src/content/docs/rules/url-forwarding/examples/redirect-country-subdomains.mdx @@ -22,12 +22,12 @@ This example single redirect for zone `example.com` will redirect United Kingdom **When incoming requests match** Using the Expression Editor:
-`(ip.geoip.country eq "GB" or ip.geoip.country eq "FR") and http.request.uri.path eq "/"` +`(ip.src.country eq "GB" or ip.src.country eq "FR") and http.request.uri.path eq "/"` **Then** - **Type:** _Dynamic_ -- **Expression:** `lower(concat("https://", ip.geoip.country, ".example.com"))` +- **Expression:** `lower(concat("https://", ip.src.country, ".example.com"))` - **Status code:** _301_ diff --git a/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx b/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx index 256685b1e56f3a..1bcee6b7b0b3c6 100644 --- a/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx +++ b/src/content/docs/rules/url-forwarding/single-redirects/create-api.mdx @@ -38,13 +38,13 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets \ "phase": "http_request_dynamic_redirect", "rules": [ { - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") and http.request.uri.path eq \"/\"", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") and http.request.uri.path eq \"/\"", "description": "Redirect GB and FR users in home page to localized site.", "action": "redirect", "action_parameters": { "from_value": { "target_url": { - "expression": "lower(concat(\"https://\", ip.geoip.country, \".example.com\"))" + "expression": "lower(concat(\"https://\", ip.src.country, \".example.com\"))" }, "status_code": 307, "preserve_query_string": true @@ -68,13 +68,13 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets \ { "id": "235e557b92fd4e5e8753ee665a9ddd75", "version": "1", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") and http.request.uri.path eq \"/\"", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") and http.request.uri.path eq \"/\"", "description": "Redirect GB and FR users in home page to localized site.", "action": "redirect", "action_parameters": { "from_value": { "target_url": { - "expression": "lower(concat(\"https://\", ip.geoip.country, \".example.com\"))" + "expression": "lower(concat(\"https://\", ip.src.country, \".example.com\"))" }, "status_code": 307, "preserve_query_string": true @@ -107,13 +107,13 @@ https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id} \ "phase": "http_request_dynamic_redirect", "rules": [ { - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") and http.request.uri.path eq \"/\"", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") and http.request.uri.path eq \"/\"", "description": "Redirect GB and FR users in home page to localized site.", "action": "redirect", "action_parameters": { "from_value": { "target_url": { - "expression": "lower(concat(\"https://\", ip.geoip.country, \".example.com\"))" + "expression": "lower(concat(\"https://\", ip.src.country, \".example.com\"))" }, "status_code": 307, "preserve_query_string": true @@ -155,13 +155,13 @@ https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id} \ "action_parameters": { "from_value": { "target_url": { - "expression": "lower(concat(\"https://\", ip.geoip.country, \".example.com\"))" + "expression": "lower(concat(\"https://\", ip.src.country, \".example.com\"))" }, "status_code": 307, "preserve_query_string": true } }, - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") and http.request.uri.path eq \"/\"", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") and http.request.uri.path eq \"/\"", "description": "Redirect GB and FR users in home page to localized site.", "last_updated": "2022-10-03T15:38:51.658387Z", "ref": "235e557b92fd4e5e8753ee665a9ddd75", diff --git a/src/content/docs/ruleset-engine/custom-rulesets/add-rules-ruleset.mdx b/src/content/docs/ruleset-engine/custom-rulesets/add-rules-ruleset.mdx index 48cb2bcca19ae1..67677abffbf788 100644 --- a/src/content/docs/ruleset-engine/custom-rulesets/add-rules-ruleset.mdx +++ b/src/content/docs/ruleset-engine/custom-rulesets/add-rules-ruleset.mdx @@ -32,7 +32,7 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{custom_rule --data '{ "rules": [ { - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0", "action": "challenge", "description": "challenge GB and FR or based on IP Reputation" }, @@ -57,7 +57,7 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{custom_rule "id": "", "version": "1", "action": "challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score \u003e 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score \u003e 0", "description": "challenge GB and FR or based on IP Reputation", "last_updated": "2021-03-18T18:25:08.122758Z", "ref": "", @@ -133,7 +133,7 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id} "id": "", "version": "1", "action": "challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score \u003e 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score \u003e 0", "description": "challenge GB and FR or based on IP Reputation", "last_updated": "2021-03-18T18:25:08.122758Z", "ref": "", diff --git a/src/content/docs/ruleset-engine/rules-language/expressions/edit-expressions.mdx b/src/content/docs/ruleset-engine/rules-language/expressions/edit-expressions.mdx index 47e380c0d2fb4f..611eb68414bdf8 100644 --- a/src/content/docs/ruleset-engine/rules-language/expressions/edit-expressions.mdx +++ b/src/content/docs/ruleset-engine/rules-language/expressions/edit-expressions.mdx @@ -27,7 +27,7 @@ The Expression Builder allows you to visually create rule expressions by using d The **Expression Preview** displays the expression in text: ```sql -(ip.geoip.country ne "GB") +(ip.src.country ne "GB") ``` The Expression Builder will [automatically escape](#escape-special-characters) the backslash (`\`) and double quote (`"`) special characters in string literals. @@ -63,7 +63,7 @@ The following rule expression will match requests from any visitor who is not fr contains "/wp-login.php") or (http.request.uri.path contains "/wp-admin/" and not http.request.uri.path contains "/wp-admin/admin-ajax.php" and not http.request.uri.path contains "/wp-admin/theme-editor.php")) and -ip.geoip.country ne "MY" +ip.src.country ne "MY" ``` Only the Expression Editor supports nested expressions such as the one above. If you create a rule with nested expressions in the Expression Editor and try to switch to the Expression Builder, a dialog will warn you that the expression is not supported in the builder. You will be prompted to **Discard changes** and switch to the Expression Builder or **Cancel** and continue working in the editor. @@ -88,5 +88,5 @@ Filter parsing error (1:313): ((http.request.uri.path contains (http.request.uri.path contains "/wp-admin/" and not http.request.uri.path contains "/wp-admin/admin-ajax.php" and not http.request.uri.path contains "/wp-admin/theme-editor.php")) and -ip.geoip.country ne "MY") ^ unrecognised input +ip.src.country ne "MY") ^ unrecognised input ``` diff --git a/src/content/docs/ruleset-engine/rules-language/operators.mdx b/src/content/docs/ruleset-engine/rules-language/operators.mdx index a37c10e26f8c46..95882247ee1e31 100644 --- a/src/content/docs/ruleset-engine/rules-language/operators.mdx +++ b/src/content/docs/ruleset-engine/rules-language/operators.mdx @@ -415,7 +415,7 @@ You can nest expressions grouped by parentheses inside other groups to create ve ( (http.host eq "api.example.com" and http.request.uri.path eq "/api/v2/auth") or (http.host matches "^(www|store|blog)\.example\.com" and http.request.uri.path contains "wp-login.php") or - ip.geoip.country in {"CN" "TH" "US" "ID" "KR" "MY" "IT" "SG" "GB"} or ip.geoip.asnum in {12345 54321 11111} + ip.src.country in {"CN" "TH" "US" "ID" "KR" "MY" "IT" "SG" "GB"} or ip.src.asnum in {12345 54321 11111} ) and not ip.src in {11.22.33.0/24} ``` diff --git a/src/content/docs/ruleset-engine/rulesets-api/add-rule.mdx b/src/content/docs/ruleset-engine/rulesets-api/add-rule.mdx index 0f35c748bac4c0..3967336ba648df 100644 --- a/src/content/docs/ruleset-engine/rulesets-api/add-rule.mdx +++ b/src/content/docs/ruleset-engine/rulesets-api/add-rule.mdx @@ -38,7 +38,7 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/ --header "Content-Type: application/json" \ --data '{ "action": "js_challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0", "description": "challenge GB and FR or based on IP Reputation" }' ``` @@ -65,7 +65,7 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/ "id": "", "version": "1", "action": "js_challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0", "description": "challenge GB and FR or based on IP Reputation", "last_updated": "2021-06-22T12:35:58.144683Z", "ref": "", diff --git a/src/content/docs/ruleset-engine/rulesets-api/delete-rule.mdx b/src/content/docs/ruleset-engine/rulesets-api/delete-rule.mdx index e3922e0ac07761..a955c66661241f 100644 --- a/src/content/docs/ruleset-engine/rulesets-api/delete-rule.mdx +++ b/src/content/docs/ruleset-engine/rulesets-api/delete-rule.mdx @@ -45,7 +45,7 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id} "id": "", "version": "2", "action": "js_challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0", "description": "challenge GB and FR or based on IP Reputation", "last_updated": "2021-07-22T12:54:58.144683Z", "ref": "", diff --git a/src/content/docs/ruleset-engine/rulesets-api/update-rule.mdx b/src/content/docs/ruleset-engine/rulesets-api/update-rule.mdx index 221ec6dca0d003..db76972422624d 100644 --- a/src/content/docs/ruleset-engine/rulesets-api/update-rule.mdx +++ b/src/content/docs/ruleset-engine/rulesets-api/update-rule.mdx @@ -35,7 +35,7 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id} --header "Content-Type: application/json" \ --data '{ "action": "js_challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0", "description": "challenge GB and FR or based on IP Reputation" }' ``` @@ -53,7 +53,7 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id} "id": "", "version": "2", "action": "js_challenge", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0", "description": "challenge GB and FR or based on IP Reputation", "last_updated": "2023-03-22T12:54:58.144683Z", "ref": "", diff --git a/src/content/docs/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-1xxx-errors.mdx b/src/content/docs/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-1xxx-errors.mdx index d5c777e500b336..510be074971bff 100644 --- a/src/content/docs/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-1xxx-errors.mdx +++ b/src/content/docs/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-1xxx-errors.mdx @@ -490,11 +490,11 @@ Make sure that the rewritten URI path is not empty and it starts with a `/` (sla For example, the following URI path rewrite expression is not valid: -`concat(lower(ip.geoip.country), http.request.uri.path)` +`concat(lower(ip.src.country), http.request.uri.path)` To fix the expression above, add a `/` prefix: -`concat("/", lower(ip.geoip.country), http.request.uri.path)` +`concat("/", lower(ip.src.country), http.request.uri.path)` --- diff --git a/src/content/docs/waf/custom-rules/create-api.mdx b/src/content/docs/waf/custom-rules/create-api.mdx index b5585750864081..8013d0ac0ccf87 100644 --- a/src/content/docs/waf/custom-rules/create-api.mdx +++ b/src/content/docs/waf/custom-rules/create-api.mdx @@ -39,7 +39,7 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/ --header "Content-Type: application/json" \ --data '{ "description": "My custom rule", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") and cf.threat_score > 10", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") and cf.threat_score > 10", "action": "challenge" }' ``` @@ -58,7 +58,7 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/ --header "Content-Type: application/json" \ --data '{ "description": "My custom rule with plain text response", - "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") and cf.threat_score > 50", + "expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") and cf.threat_score > 50", "action": "block", "action_parameters": { "response": { diff --git a/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-specific-countries.mdx b/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-specific-countries.mdx index c09a06eb0a5166..164127a025db58 100644 --- a/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-specific-countries.mdx +++ b/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-specific-countries.mdx @@ -3,9 +3,9 @@ pcx_content_type: configuration title: Allow traffic from specific countries only --- -This example blocks requests based on country code using the [`ip.geoip.country`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrccountry) field, only allowing requests from two countries: United States and Mexico. +This example blocks requests based on country code using the [`ip.src.country`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrccountry) field, only allowing requests from two countries: United States and Mexico. -- **Expression**: `(not ip.geoip.country in {"US" "MX"})` +- **Expression**: `(not ip.src.country in {"US" "MX"})` - **Action**: _Block_ ## Other resources diff --git a/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-verified-bots.mdx b/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-verified-bots.mdx index 6e148833ccd160..d02d6026b6cc25 100644 --- a/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-verified-bots.mdx +++ b/src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-verified-bots.mdx @@ -10,7 +10,7 @@ This example challenges requests from a list of countries, but allows traffic fr The rule expression uses the [`cf.client.bot`](/ruleset-engine/rules-language/fields/dynamic-fields/#cfclientbot) field to determine if the request originated from a known good bot or crawler. -- **Expression**: `(ip.geoip.country in {"US" "MX"} and not cf.client.bot)` +- **Expression**: `(ip.src.country in {"US" "MX"} and not cf.client.bot)` - **Action**: _Managed Challenge_ ## Other resources diff --git a/src/content/docs/waf/custom-rules/use-cases/block-ip-reputation.mdx b/src/content/docs/waf/custom-rules/use-cases/block-ip-reputation.mdx index 69076aec337393..7851d205a0de1d 100644 --- a/src/content/docs/waf/custom-rules/use-cases/block-ip-reputation.mdx +++ b/src/content/docs/waf/custom-rules/use-cases/block-ip-reputation.mdx @@ -9,5 +9,5 @@ import { GlossaryDefinition } from "~/components"; This example blocks requests based on country code ([ISO 3166-1 Alpha 2](https://www.iso.org/obp/ui/#search/code/) format), from IP addresses that score greater than 0. This is equivalent to setting the Security Level in **Security** > **Settings** to _High_. For more information, refer to [Security Level](/waf/tools/security-level/). -- **Expression**: `(ip.geoip.country in {"CN" "TW" "US" "GB"} and cf.threat_score gt 0)` +- **Expression**: `(ip.src.country in {"CN" "TW" "US" "GB"} and cf.threat_score gt 0)` - **Action**: _Block_ diff --git a/src/content/docs/waf/custom-rules/use-cases/block-traffic-from-specific-countries.mdx b/src/content/docs/waf/custom-rules/use-cases/block-traffic-from-specific-countries.mdx index f4ed5fbc1ca23d..c086ffb10947a9 100644 --- a/src/content/docs/waf/custom-rules/use-cases/block-traffic-from-specific-countries.mdx +++ b/src/content/docs/waf/custom-rules/use-cases/block-traffic-from-specific-countries.mdx @@ -3,9 +3,9 @@ pcx_content_type: configuration title: Block traffic from specific countries --- -This example blocks requests based on country code using the [`ip.geoip.country`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrccountry) field. +This example blocks requests based on country code using the [`ip.src.country`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrccountry) field. -- **Expression**: `(ip.geoip.country in {"KN" "SY"})` +- **Expression**: `(ip.src.country in {"KN" "SY"})` - **Action**: _Block_ ## Other resources diff --git a/src/content/docs/waf/custom-rules/use-cases/update-rules-customers-partners.mdx b/src/content/docs/waf/custom-rules/use-cases/update-rules-customers-partners.mdx index e80a31b928b3de..e7b2bc70520c1e 100644 --- a/src/content/docs/waf/custom-rules/use-cases/update-rules-customers-partners.mdx +++ b/src/content/docs/waf/custom-rules/use-cases/update-rules-customers-partners.mdx @@ -22,12 +22,12 @@ If a customer or partner is large enough, you could set up a custom rule based o This example uses: -- The [`ip.geoip.asnum`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrcasnum) field to specify the general region. +- The [`ip.src.asnum`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrcasnum) field to specify the general region. - The [`cf.bot_management.score`](/ruleset-engine/rules-language/fields/dynamic-fields/#cfbot_managementscore) field to ensure partner traffic does not come from bots. Example rule: -- **Expression**: `(ip.geoip.asnum eq 64496 and cf.bot_management.score gt 30)` +- **Expression**: `(ip.src.asnum eq 64496 and cf.bot_management.score gt 30)` - **Action**: _Skip:_ - _All remaining custom rules_ @@ -39,12 +39,12 @@ Access to [Bot Management](/bots/plans/bm-subscription/) requires a Cloudflare E This example uses: -- The [`ip.geoip.asnum`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrcasnum) field to specify the general region. +- The [`ip.src.asnum`](/ruleset-engine/rules-language/fields/standard-fields/#ipsrcasnum) field to specify the general region. - The [`cf.threat_score`](/ruleset-engine/rules-language/fields/dynamic-fields/#cfthreat_score) dynamic field to ensure requests are not high-risk traffic. If a request meets these criteria, your custom rule skips [User Agent Blocking](/waf/tools/user-agent-blocking/) rules. -- **Expression**: `(ip.geoip.asnum eq 64496 and cf.threat_score lt 14)` +- **Expression**: `(ip.src.asnum eq 64496 and cf.threat_score lt 14)` - **Action**: _Skip:_ - _User Agent Blocking_ diff --git a/src/content/docs/waf/rate-limiting-rules/parameters.mdx b/src/content/docs/waf/rate-limiting-rules/parameters.mdx index 9a4f63029f46bf..5d3a82a8d8f57a 100644 --- a/src/content/docs/waf/rate-limiting-rules/parameters.mdx +++ b/src/content/docs/waf/rate-limiting-rules/parameters.mdx @@ -46,8 +46,8 @@ Use one or more of the following characteristics: | **Query value of** (enter parameter name) | `http.request.uri.args[""]` | [Missing field versus empty value](#missing-field-versus-empty-value) | | **Host** | `http.host` | | **Path** | `http.request.uri.path` | -| **AS Num** | `ip.geoip.asnum` | -| **Country** | `ip.geoip.country` | +| **AS Num** | `ip.src.asnum` | +| **Country** | `ip.src.country` | | **JA3 Fingerprint** | `cf.bot_management.ja3_hash` | | **JA4** | `cf.bot_management.ja4` | | **JSON string value of** (enter key) | `lookup_json_string(http.request.body.raw, "")` | [Missing field versus empty value](#missing-field-versus-empty-value) and [`lookup_json_string()` function reference](/ruleset-engine/rules-language/functions/#lookup_json_string) | diff --git a/src/content/docs/waf/rate-limiting-rules/use-cases.mdx b/src/content/docs/waf/rate-limiting-rules/use-cases.mdx index ca19c06624b16d..ade2f71246cca0 100644 --- a/src/content/docs/waf/rate-limiting-rules/use-cases.mdx +++ b/src/content/docs/waf/rate-limiting-rules/use-cases.mdx @@ -6,10 +6,9 @@ sidebar: head: - tag: title content: Rate limiting rule examples - --- -import { Example } from "~/components" +import { Example } from "~/components"; The examples below include sample rate limiting rule configurations. @@ -20,12 +19,12 @@ The following rule performs rate limiting on incoming requests from the US addre Expression:
-`(http.request.uri.path eq "/login" and ip.geoip.country eq "US" and ip.src ne 192.0.0.1)` +`(http.request.uri.path eq "/login" and ip.src.country eq "US" and ip.src ne 192.0.0.1)` Rule characteristics: -* *Data center ID* (included by default when creating the rule in the dashboard) -* *IP Address* +- _Data center ID_ (included by default when creating the rule in the dashboard) +- _IP Address_ @@ -40,9 +39,9 @@ Expression:
Rule characteristics: -* *Data center ID* (included by default when creating the rule in the dashboard) -* *IP Address* -* *HTTP Header* > `x-api-key` +- _Data center ID_ (included by default when creating the rule in the dashboard) +- _IP Address_ +- _HTTP Header_ > `x-api-key` @@ -57,8 +56,8 @@ Expression:
Rule characteristics: -* *Data center ID* (included by default when creating the rule in the dashboard) -* *IP Address* -* *HTTP Header* > `user-agent` +- _Data center ID_ (included by default when creating the rule in the dashboard) +- _IP Address_ +- _HTTP Header_ > `user-agent` diff --git a/src/content/docs/waf/troubleshooting/faq.mdx b/src/content/docs/waf/troubleshooting/faq.mdx index a851bbb9bef397..36a514e5a18d17 100644 --- a/src/content/docs/waf/troubleshooting/faq.mdx +++ b/src/content/docs/waf/troubleshooting/faq.mdx @@ -137,7 +137,7 @@ Block Amazon Web Services (AWS) and Google Cloud Platform (GCP) because of large - Basic rule, no exclusion: - - **Expression**: `(ip.geoip.asnum in {16509 15169})` + - **Expression**: `(ip.src.asnum in {16509 15169})` - **Action**: Block (or a challenge action) - Rule that excludes IP addresses from being blocked/challenged: diff --git a/src/content/partials/rules/transform/header-modification-fields.mdx b/src/content/partials/rules/transform/header-modification-fields.mdx index 4c7fa27e7de264..a65f6dc490d559 100644 --- a/src/content/partials/rules/transform/header-modification-fields.mdx +++ b/src/content/partials/rules/transform/header-modification-fields.mdx @@ -31,8 +31,13 @@ - `ip.src` - `ip.src.lat` - `ip.src.lon` +- `ip.src.asnum` - `ip.src.city` -- `ip.geoip.*` +- `ip.src.country` +- `ip.src.continent` +- `ip.src.is_in_european_union` +- `ip.src.subdivision_1_iso_code` +- `ip.src.subdivision_2_iso_code` - `ssl` Refer to [Fields](/ruleset-engine/rules-language/fields/) for reference information on these fields. diff --git a/src/content/partials/rules/transform/transform-phase-fields.mdx b/src/content/partials/rules/transform/transform-phase-fields.mdx index 6311866de58573..146cbb3a5d1f0a 100644 --- a/src/content/partials/rules/transform/transform-phase-fields.mdx +++ b/src/content/partials/rules/transform/transform-phase-fields.mdx @@ -30,8 +30,13 @@ - `ip.src` - `ip.src.lat` - `ip.src.lon` +- `ip.src.asnum` - `ip.src.city` -- `ip.geoip.*` +- `ip.src.country` +- `ip.src.continent` +- `ip.src.is_in_european_union` +- `ip.src.subdivision_1_iso_code` +- `ip.src.subdivision_2_iso_code` - `ssl` Refer to [Fields](/ruleset-engine/rules-language/fields/) for reference information on these fields.