diff --git a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix-allowlist.mdx b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix-allowlist.mdx
index aa3bd694a38a52e..bed113d647d4721 100644
--- a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix-allowlist.mdx
+++ b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix-allowlist.mdx
@@ -9,15 +9,17 @@ head:
---
-import { Render } from "~/components"
+import { Render, Steps } from "~/components"
To add an IP address or prefix to the Advanced DDoS Protection [allowlist](/ddos-protection/advanced-ddos-systems/concepts/#allowlist):
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection**.
3. Under **General settings** > **Allowlist**, select **Edit**.
4. Enter a prefix and (optionally) a description in **Prefix** and **Description**, respectively.
5. To exclude the current prefix from the allowlist instead of including it, uncheck the **Enabled** checkbox.
6. Select **Add**.
+
\ No newline at end of file
diff --git a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix.mdx b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix.mdx
index 346a31e4ff7a681..8c7c7b59a2e1506 100644
--- a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix.mdx
+++ b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/add-prefix.mdx
@@ -8,14 +8,17 @@ head:
content: Add a prefix to Advanced DDoS Protection
---
+import { Steps } from "~/components"
To add a [prefix](/ddos-protection/advanced-ddos-systems/concepts/#prefixes) to Advanced DDoS Protection:
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection**.
3. Under **General settings** > **Prefixes**, select **Edit**.
4. Expand the **Add existing prefix** section and select **Add** next to the prefix you wish to add.
Alternatively, enter a prefix and (optionally) a description in **Prefix** and **Description**, respectively, and select **Add**.
+
:::note[Note]
diff --git a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-filter.mdx b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-filter.mdx
index 4ddb495acb35fd9..c60a4edd70ab5f6 100644
--- a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-filter.mdx
+++ b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-filter.mdx
@@ -9,7 +9,7 @@ head:
---
-import { GlossaryTooltip, Render } from "~/components"
+import { GlossaryTooltip, Render, Steps } from "~/components"
@@ -23,13 +23,15 @@ Filters only apply to Advanced TCP Protection.
To create a [filter](/ddos-protection/advanced-ddos-systems/concepts/#filter) for one of the system components:
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection** > **Advanced TCP Protection**.
3. Under the system component for which you are creating the filter (**SYN Flood Protection** or **Out-of-state TCP Protection**), select **Create** next to the type of filter you want to create:
- - **Mitigation Filter**: The protection system will drop packets matching the filter expression.
- - **Monitoring Filter**: The protection system will log packets matching the filter expression.
- - **Off Filter**: The protection system will ignore packets matching the filter expression.
+ - **Mitigation Filter**: The protection system will drop packets matching the filter expression.
+ - **Monitoring Filter**: The protection system will log packets matching the filter expression.
+ - **Off Filter**: The protection system will ignore packets matching the filter expression.
4. Under **When incoming packets match**, define a filter expression using the Expression Builder (specifying one or more values for **Field**, **Operator**, and **Value**), or manually enter an expression using the Expression Editor. For more information, refer to [Edit rule expressions](/ruleset-engine/rules-language/expressions/edit-expressions/).
5. Select **Save**.
+
\ No newline at end of file
diff --git a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-rule.mdx b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-rule.mdx
index b9ee4798b546030..ced110eb25b81e2 100644
--- a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-rule.mdx
+++ b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/create-rule.mdx
@@ -9,28 +9,29 @@ head:
---
-import { Render } from "~/components"
+import { Render, Steps } from "~/components"
## Create an Advanced TCP Protection rule
To create a [SYN flood rule](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/#syn-flood-protection) or an [out-of-state TCP](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/#out-of-state-tcp-protection) rule:
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection** > **Advanced TCP Protection**.
3. Depending on the rule you are creating, do one of the following:
-
- Under **SYN Flood Protection**, select **Create SYN flood rule**.
- Under **Out-of-state TCP Protection**, select **Create out-of-state TCP rule**.
-
4. In **Mode**, select a [mode](/ddos-protection/advanced-ddos-systems/concepts/#mode) for the rule.
5. Under **Set scope**, select a [scope](/ddos-protection/advanced-ddos-systems/concepts/#scope) for the rule. If you choose to apply the rule to a subset of incoming packets, select a region or a data center.
6. Under **Sensitivity**, define the [burst sensitivity](/ddos-protection/advanced-ddos-systems/concepts/#burst-sensitivity) and [rate sensitivity](/ddos-protection/advanced-ddos-systems/concepts/#rate-sensitivity) of the rule (by default, _Medium_). The sensitivity levels are based on the initially configured thresholds for your specific case.
7. Select **Deploy**.
+
## Create an Advanced DNS Protection rule
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection** > **General settings**.
3. Add the prefixes you wish to onboard. Advanced DNS Protection will only be applied to the prefixes you onboard. If you already onboarded the desired prefixes when you configured Advanced TCP Protection, you do not need to take any other action.
@@ -43,4 +44,5 @@ To create a [SYN flood rule](/ddos-protection/advanced-ddos-systems/overview/adv
6. In **Mode**, select a mode for the rule.
7. Under **Set scope**, select a [scope](/ddos-protection/advanced-ddos-systems/concepts/#scope) to determine the range of packets that will be affected by the rule.
8. Under **Sensitivity**, define the [burst sensitivity](/ddos-protection/advanced-ddos-systems/concepts/#burst-sensitivity), [rate sensitivity](/ddos-protection/advanced-ddos-systems/concepts/#rate-sensitivity), and [profile sensitivity](/ddos-protection/advanced-ddos-systems/concepts/#profile-sensitivity) to determine when to initiate mitigation.
-9. Select **Deploy**.
\ No newline at end of file
+9. Select **Deploy**.
+
\ No newline at end of file
diff --git a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/exclude-prefix.mdx b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/exclude-prefix.mdx
index 0800eea999fd942..1f7bfd3cba9a91a 100644
--- a/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/exclude-prefix.mdx
+++ b/src/content/docs/ddos-protection/advanced-ddos-systems/how-to/exclude-prefix.mdx
@@ -6,13 +6,17 @@ sidebar:
---
+import { Steps } from "~/components"
+
To exclude a prefix or a prefix subset from Advanced DDoS Protection:
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection**.
3. [Add the prefix](/ddos-protection/advanced-ddos-systems/how-to/add-prefix/) you previously onboarded to Magic Transit to Advanced TCP Protection.
4. [Add the prefix](/ddos-protection/advanced-ddos-systems/how-to/add-prefix/) (or subset) you wish to exclude as a new, separate prefix in Advanced TCP Protection.
5. For the prefix you added in the previous step, select **Exclude Subset** in the **Enrolled Prefixes** list.
+
:::note
diff --git a/src/content/docs/ddos-protection/advanced-ddos-systems/overview/index.mdx b/src/content/docs/ddos-protection/advanced-ddos-systems/overview/index.mdx
index e88392c22047dfa..e3f694987c0a8d8 100644
--- a/src/content/docs/ddos-protection/advanced-ddos-systems/overview/index.mdx
+++ b/src/content/docs/ddos-protection/advanced-ddos-systems/overview/index.mdx
@@ -10,7 +10,7 @@ head:
---
-import { GlossaryTooltip, Render } from "~/components"
+import { GlossaryTooltip, Render, Steps } from "~/components"
The Advanced DDoS Protection system includes [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) and [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/). Both systems are configured using the general settings, but also comprise of their own dedicated settings.
@@ -62,6 +62,8 @@ Refer to [Concepts](/ddos-protection/advanced-ddos-systems/concepts/) for more i
Enable the Advanced DDoS system and begin routing traffic through it.
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection** > **General settings**.
-3. Under **General settings**, toggle the feature status **On**.
\ No newline at end of file
+3. Under **General settings**, toggle the feature status **On**.
+
\ No newline at end of file
diff --git a/src/content/docs/ddos-protection/best-practices/respond-to-ddos-attacks.mdx b/src/content/docs/ddos-protection/best-practices/respond-to-ddos-attacks.mdx
index 90c78b831fa21ec..7d4dce3bef8d269 100644
--- a/src/content/docs/ddos-protection/best-practices/respond-to-ddos-attacks.mdx
+++ b/src/content/docs/ddos-protection/best-practices/respond-to-ddos-attacks.mdx
@@ -5,7 +5,7 @@ title: Respond to DDoS attacks
---
-import { GlossaryTooltip } from "~/components"
+import { GlossaryTooltip, Steps } from "~/components"
Cloudflare's network automatically mitigates large DDoS attacks, but these attacks can still affect your application.
@@ -13,6 +13,7 @@ Cloudflare's network automatically mitigates large
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
2. Go to **Manage Account** > **Configurations**.
3. Select **DDoS Threat Feed ASNs**.
4. On the list of ASNs configured for your threat feed, select **Add ASN**.
5. You will be redirected to the PeeringDB authentication page, where you can log in and consent to share the affiliation data with us. You will be redirected back to the configuration page once it is successful.
+
:::note
You can add multiple ASNs to your threat feed.
diff --git a/src/content/docs/ddos-protection/get-started.mdx b/src/content/docs/ddos-protection/get-started.mdx
index c2706ec1384c24e..6bc6038d771ded5 100644
--- a/src/content/docs/ddos-protection/get-started.mdx
+++ b/src/content/docs/ddos-protection/get-started.mdx
@@ -6,6 +6,8 @@ sidebar:
---
+import { Steps } from "~/components"
+
## Free, Pro, and Business plans
The DDoS Attack Protection managed rulesets provided by Cloudflare are enabled by default on zones onboarded to Cloudflare, IP applications onboarded to Spectrum, and IP Prefixes onboarded to Magic Transit.
@@ -26,10 +28,12 @@ Cloudflare's DDoS protection systems automatically detect and mitigate DDoS atta
To prevent this situation, Cloudflare recommends that you perform these steps to get started:
+
1. Set the ruleset actions for all the [DDoS Attack Protection managed rulesets](/ddos-protection/managed-rulesets/) to _Log_.
2. Analyze the flagged traffic.
3. Adjust the sensitivity or action of individual managed ruleset rules, if required.
4. Switch ruleset actions from _Log_ back to the default.
+
### Prerequisites
@@ -46,9 +50,11 @@ You must have one of the following:
The _Log_ action is only available to Enterprise customers.
:::
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account.
2. [Configure all the rules in the HTTP DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard/#create-a-ddos-override), setting their action to _Log_.
3. [Configure all the rules in the Network-layer DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard/#create-a-ddos-override), setting the action to _Log_.
+
Alternatively, if you are using the API, define an override at the ruleset level to set the action of all managed ruleset rules to `log` by following these instructions:
@@ -57,8 +63,10 @@ Alternatively, if you are using the API, define an override at the ruleset level
### 2. Review flagged traffic
+
1. Go to your [analytics dashboard](/ddos-protection/reference/analytics/) (the exact dashboard depends on your Cloudflare services).
2. Apply one or more filters, if required, and identify any rules that would have blocked legitimate traffic if _Log_ mode were disabled. Take note of the rule IDs.
+
### 3. Customize managed ruleset rules
diff --git a/src/content/docs/ddos-protection/managed-rulesets/adaptive-protection.mdx b/src/content/docs/ddos-protection/managed-rulesets/adaptive-protection.mdx
index 82353f29b6177c3..b70128e959e5d7a 100644
--- a/src/content/docs/ddos-protection/managed-rulesets/adaptive-protection.mdx
+++ b/src/content/docs/ddos-protection/managed-rulesets/adaptive-protection.mdx
@@ -7,6 +7,8 @@ sidebar:
---
+import { Tabs, TabItem, Steps } from "~/components"
+
Adaptive DDoS Protection learns your unique traffic patterns and adapts to them to provide better protection against sophisticated DDoS attacks on layer 7 and layers 3/4, depending on your subscribed Cloudflare services.
Adaptive DDoS Protection provides the following types of protection:
@@ -58,15 +60,41 @@ For more information on the types of DDoS attacks covered by Cloudflare's DDoS p
To view traffic flagged by HTTP Adaptive DDoS Protection rules:
-1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and website.
-2. Go to **Security** > **Events**.
-3. Filter by `Service equals HTTP DDoS` and by rule ID.
+
+
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
+ 2. Go to **Security** > **Events**.
+ 3. Filter by `Service equals HTTP DDoS` and by rule ID.
+
+
+
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
+ 2. Go to **Security** > **Analytics** > **Events**.
+ 3. Filter by `Service equals HTTP DDoS` and by rule ID.
+
+
+
To view traffic flagged by L3/4 Adaptive DDoS Protection rules:
-1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
-2. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
-3. Filter by rule ID.
+
+
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
+ 2. Go to Account Home > **Analytics & Logs** > **Network Analytics**.
+ 3. Filter by rule ID.
+
+
+
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
+ 2. Go to **Security** > **Analytics** > **Events**.
+ 3. Filter by rule ID.
+
+
+
You may also obtain information about flagged traffic through [Logpush](/logs/about/) or the [GraphQL API](/analytics/graphql-api/).
diff --git a/src/content/docs/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard.mdx b/src/content/docs/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard.mdx
index 24b9f9c306a98ad..9955f1eda1dadad 100644
--- a/src/content/docs/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard.mdx
+++ b/src/content/docs/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard.mdx
@@ -9,7 +9,7 @@ head:
---
-import { Details, Render } from "~/components"
+import { Details, Render, Tabs, TabItem, Steps } from "~/components";
Configure the HTTP DDoS Attack Protection managed ruleset by defining [overrides](/ruleset-engine/managed-rulesets/override-managed-ruleset/) in the Cloudflare dashboard. DDoS overrides allow you to customize the **action** and **sensitivity** of one or more rules in the managed ruleset.
@@ -24,35 +24,52 @@ If you cannot deploy any additional overrides, consider editing an existing over
-## Create a DDoS override
-
-1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and website.
-2. Go to **Security** > **DDoS**.
-3. Next to **HTTP DDoS attack protection**, select **Deploy a DDoS override**.
-4. Enter a descriptive name for the override in **Override name**.
-5. If you are an Enterprise customer with the Advanced DDoS Protection subscription:
- 1. Under **Override scope**, review the scope of the override — by default, all incoming requests for the current zone.
- 2. If necessary, select **Edit scope** and configure the [custom filter expression](/ddos-protection/managed-rulesets/http/http-overrides/override-expressions/) that will determine the override scope.
-6. Depending on what you wish to override, refer to the following sections (you can perform both configurations on the same override):
-
- 7. To always apply a given action for all the rules in the ruleset, select an action in **Ruleset action**.
- 8. To set the sensitivity level for all the rules in the ruleset, select a value in **Ruleset sensitivity**.
-
-
-
- 9. Under **Rule configuration**, select **Browse rules**.
- 10. Search for the rules you wish to configure using the available filters. You can search by [tag](/ddos-protection/managed-rulesets/http/rule-categories/) (also known as category).
- 11. To configure a single rule, select the desired value for a field in the displayed dropdowns next to the rule.
- To configure more than one rule, select the rules using the row checkboxes and update the fields for the selected rules using the dropdowns displayed before the table. You can also configure all the rules with a given tag. For more information, refer to [Configure rules in bulk in a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#configure-rules-in-bulk-in-a-managed-ruleset).
- 12. Select **Next**.
-
-
- :::note[Notes]
-
- - Tag and rule overrides have priority over ruleset overrides.
- -
- :::
-
-7. Select **Save**.
-
- DDoS" }} />
+## Access
+
+
+
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and website.
+ 2. Go to **Security** > **DDoS**.
+ 3. Next to **HTTP DDoS attack protection**, select **Deploy a DDoS override**.
+
+
+
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
+ 2. Go to **Security** > **Security rules**.
+ 3. On **HTTP DDoS Attack Protection**, select **Create override**.
+
+
+
+
+### Create a DDoS override
+
+
+1. Enter a descriptive name for the override in **Override name**.
+2. If you are an Enterprise customer with the Advanced DDoS Protection subscription:
+ 1. Under **Override scope**, review the scope of the override — by default, all incoming requests for the current zone.
+ 2. If necessary, select **Edit scope** and configure the [custom filter expression](/ddos-protection/managed-rulesets/http/http-overrides/override-expressions/) that will determine the override scope.
+3. Depending on what you wish to override, refer to the following sections (you can perform both configurations on the same override):
+
+ 4. To always apply a given action for all the rules in the ruleset, select an action in **Ruleset action**.
+ 5. To set the sensitivity level for all the rules in the ruleset, select a value in **Ruleset sensitivity**.
+
+
+
+ 4. Under **Rule configuration**, select **Browse rules**.
+ 5. Search for the rules you wish to configure using the available filters. You can search by [tag](/ddos-protection/managed-rulesets/http/rule-categories/) (also known as category).
+ 6. To configure a single rule, select the desired value for a field in the displayed dropdowns next to the rule.
+ To configure more than one rule, select the rules using the row checkboxes and update the fields for the selected rules using the dropdowns displayed before the table. You can also configure all the rules with a given tag. For more information, refer to [Configure rules in bulk in a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#configure-rules-in-bulk-in-a-managed-ruleset).
+ 7. Select **Next**.
+
+
+ :::note[Notes]
+
+ - Tag and rule overrides have priority over ruleset overrides.
+ -
+ :::
+
+4. Select **Save**.
+
+ DDoS" }} />
diff --git a/src/content/partials/ddos-protection/create-notification.mdx b/src/content/partials/ddos-protection/create-notification.mdx
index e4f0d100509fe1c..3121ff61081db58 100644
--- a/src/content/partials/ddos-protection/create-notification.mdx
+++ b/src/content/partials/ddos-protection/create-notification.mdx
@@ -3,25 +3,23 @@
---
+import { Steps } from "~/components";
+
To set up a notification:
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
-
2. Select **Notifications**.
-
3. Under **Notifications**, select **Add**.
-
4. Select one of the [available DDoS alerts](/ddos-protection/reference/alerts/#alert-types) (depending on your plan and services):
-
- * HTTP DDoS Attack Alert
- * Layer 3/4 DDoS Attack Alert
- * Advanced HTTP DDoS Attack Alert
- * Advanced Layer 3/4 DDoS Attack Alert
+
+ - HTTP DDoS Attack Alert
+ - Layer 3/4 DDoS Attack Alert
+ - Advanced HTTP DDoS Attack Alert
+ - Advanced Layer 3/4 DDoS Attack Alert
5. Enter a notification name and (optionally) a description.
-
6. Configure a delivery method for the notification. The available delivery methods depend on your Cloudflare plan. For more information, refer to [Cloudflare Notifications](/notifications/).
-
7. If you are creating a notification for one of the advanced DDoS attack alerts, select **Next** and define the parameters that will filter the notifications you will receive.
-
8. Select **Save**.
+
\ No newline at end of file
diff --git a/src/content/partials/ddos-protection/managed-rulesets/create-override.mdx b/src/content/partials/ddos-protection/managed-rulesets/create-override.mdx
index a1a54d21eb310e9..aa54cd4bbc5aaf6 100644
--- a/src/content/partials/ddos-protection/managed-rulesets/create-override.mdx
+++ b/src/content/partials/ddos-protection/managed-rulesets/create-override.mdx
@@ -2,35 +2,35 @@
{}
---
-import { Details, Render } from "~/components"
+import { Details, Render, Steps } from "~/components"
-1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
-2. Go to Account Home > **L3/4 DDoS** > **Network-layer DDoS Protection**.
-3. Select **Deploy a DDoS override**.
-4. In **Set scope**, specify if you wish to apply the override to all incoming packets or to a subset of the packets.
-5. If you are creating an override for a subset of the incoming packets, define the [custom expression](/ddos-protection/managed-rulesets/network/network-overrides/override-expressions/) that matches the incoming packets you wish to target in the override, using either the Rule Builder or the Expression Editor.
-6. Select **Next**.
-7. Depending on what you wish to override, refer to the following sections (you can perform both configurations on the same override):
-
- 8. Select **Next**.
- 9. Enter a name for your override in **Execution name**.
- 10. To always apply a given action for all the rules in the ruleset, select an action in **Ruleset action**.
- 11. To set the sensitivity level for all the rules in the ruleset, select a value in **Ruleset sensitivity**.
-
+
+ 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
+ 2. Go to Account Home > **L3/4 DDoS** > **Network-layer DDoS Protection**.
+ 3. Select **Deploy a DDoS override**.
+ 4. In **Set scope**, specify if you wish to apply the override to all incoming packets or to a subset of the packets.
+ 5. If you are creating an override for a subset of the incoming packets, define the [custom expression](/ddos-protection/managed-rulesets/network/network-overrides/override-expressions/) that matches the incoming packets you wish to target in the override, using either the Rule Builder or the Expression Editor.
+ 6. Select **Next**.
+ 7. Depending on what you wish to override, refer to the following sections (you can perform both configurations on the same override):
+
+ 8. Select **Next**.
+ 9. Enter a name for your override in **Execution name**.
+ 10. To always apply a given action for all the rules in the ruleset, select an action in **Ruleset action**.
+ 11. To set the sensitivity level for all the rules in the ruleset, select a value in **Ruleset sensitivity**.
+
+
+ 12. Search for the rules you wish to override using the available filters. You can search for tags.
+ 13. To override a single rule, select the desired value for a field in the displayed dropdowns next to the rule.
-
- 12. Search for the rules you wish to override using the available filters. You can search for tags.
- 13. To override a single rule, select the desired value for a field in the displayed dropdowns next to the rule.
+ To configure more than one rule, select the rules using the row checkboxes and update the fields for the selected rules using the dropdowns displayed before the table. You can also configure all the rules with a given tag. For more information, refer to [Configure rules in bulk in a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#configure-rules-in-bulk-in-a-managed-ruleset).
+ 14. Select **Next**.
+ 15. Enter a name for your override in **Execution name**.
+
- To configure more than one rule, select the rules using the row checkboxes and update the fields for the selected rules using the dropdowns displayed before the table. You can also configure all the rules with a given tag. For more information, refer to [Configure rules in bulk in a managed ruleset](/waf/managed-rules/deploy-zone-dashboard/#configure-rules-in-bulk-in-a-managed-ruleset).
- 14. Select **Next**.
- 15. Enter a name for your override in **Execution name**.
-
+ :::note[Notes]
- :::note[Notes]
-
- - Tag and rule overrides have priority over ruleset overrides.
- -
- :::
-
-8. To save and deploy the override, select **Deploy**. If you are not ready to deploy your override, select **Save as Draft**.
\ No newline at end of file
+ - Tag and rule overrides have priority over ruleset overrides.
+ -
+ :::
+ 8. To save and deploy the override, select **Deploy**. If you are not ready to deploy your override, select **Save as Draft**.
+
\ No newline at end of file
diff --git a/src/content/partials/ddos-protection/managed-rulesets/delete-override.mdx b/src/content/partials/ddos-protection/managed-rulesets/delete-override.mdx
index f4e487f886d643c..77555371f5d688e 100644
--- a/src/content/partials/ddos-protection/managed-rulesets/delete-override.mdx
+++ b/src/content/partials/ddos-protection/managed-rulesets/delete-override.mdx
@@ -3,11 +3,25 @@ inputParameters: selectAccountWebsite;;dashboardLocation
---
-import { Markdown } from "~/components"
+import { Markdown, Tabs, TabItem, Steps } from "~/components"
-## Delete a DDoS override
+### Delete a DDoS override
+
+
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and {props.one}.
-2. Go to **{props.two}**.
+2. Go to **Security** > **DDoS**.
3. Next to the DDoS override you wish to delete, select **Delete**.
4. Select **Delete** to confirm the operation.
+
+
+
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
+2. Go to **Security** > **Security rules**.
+3. Select the override.
+4. Select **Delete deployment**.
+
+
+
\ No newline at end of file
diff --git a/src/content/partials/ddos-protection/override-logic.mdx b/src/content/partials/ddos-protection/override-logic.mdx
index e19776806c753df..b9ff54257029827 100644
--- a/src/content/partials/ddos-protection/override-logic.mdx
+++ b/src/content/partials/ddos-protection/override-logic.mdx
@@ -7,6 +7,12 @@ When Cloudflare's DDoS Protection systems detect an attack, an ephemeral mitigat
All mitigations and its associated managed rules are evaluated in order by the DDoS systems one by one. Cloudflare will go through all of the rule overrides defined in the ruleset overrides until one matches the managed rule, and apply the action and stop at that point. Otherwise, the evaluation will continue in order until a rule matches.
-You can create only one ruleset override that can contain one or multiple rule overrides. A rule override instructs the DDoS system on the action it should take against the attack according to its matching managed rule.
+You can create only one ruleset override that can contain one or multiple rule overrides.
+
+:::note
+Enterprise customers with the [Advanced DDoS Protection](/ddos-protection/advanced-ddos-systems/overview/) add-on can create up to 10 ruleset overrides.
+:::
+
+A rule override instructs the DDoS system on the action it should take against the attack according to its matching managed rule.
However, within a rule override, specificity matters and the DDoS system will choose the more specific configuration. A rule override takes precedence over the ruleset override.
\ No newline at end of file
diff --git a/src/content/plans/index.json b/src/content/plans/index.json
index 3ec16b288e66784..88625b1526cc47d 100644
--- a/src/content/plans/index.json
+++ b/src/content/plans/index.json
@@ -1465,7 +1465,7 @@
"ddos": {
"title": "DDoS protection",
"link": "/ddos-protection/",
- "ent_plus": "Enterprise with add-on",
+ "ent_plus": "Enterprise with Advanced DDoS Protection add-on",
"properties": {
"availability": {
"title": "Availability",
@@ -1515,7 +1515,7 @@
"link": "/ddos-protection/managed-rulesets/#proactive-false-positive-detection-for-new-rules",
"free": "No",
"pro": "No",
- "biz": "Yes",
+ "biz": "No",
"ent": "Yes",
"ent_plus": "Yes"
},
@@ -1554,6 +1554,15 @@
"ent": "Available to [Magic Transit](/magic-transit/) customers",
"ent_plus": "Available to [Magic Transit](/magic-transit/) customers"
},
+ "ruleset_overrides": {
+ "title": "Number of ruleset overrides allowed",
+ "link": "/ddos-protection/reference/alerts/",
+ "free": "1",
+ "pro": "1",
+ "biz": "1",
+ "ent": "1",
+ "ent_plus": "10"
+ },
"v_alerts": {
"title": "Alerts",
"link": "/ddos-protection/reference/alerts/",