跳转到内容
搜索文档
↵选择
↑↓导航
ESC关闭

通过 API 配置

最后更新 查看 MarkdownAgent 设置

使用 API 配置 OWASP Core Ruleset。 要使用 API 为给定 zone 启用 Cloudflare OWASP Core Ruleset，请在 http_request_firewall_managed 阶段的入口点 ruleset 中创建一条 execute 操作的规则。有关部署 managed ruleset 的更多信息，请参阅 Deploy a managed ruleset。

要使用 API 配置 Cloudflare OWASP Core Ruleset，请使用 Rulesets API 创建 overrides。您可以执行以下配置：

您也可以使用 rule overrides 禁用 managed ruleset 中的特定规则。

设置 paranoia level

要启用直至特定 paranoia level 的所有规则，请创建禁用与更高 paranoia level 关联的所有规则的 tag overrides。

与不同 paranoia level 关联的标签如下：

  • paranoia-level-1
  • paranoia-level-2
  • paranoia-level-3
  • paranoia-level-4

例如，要启用与 Paranoia Level 2（PL2）关联的所有规则，请禁用与标签 paranoia-level-3 与 paranoia-level-4 关联的规则。与直至所需 paranoia level 的所有 paranoia level 关联的规则都将启用（在此示例中，为与 PL1 与 PL2 关联的所有规则）。

示例

此示例将某 zone 的 Cloudflare OWASP Core Ruleset 的 paranoia level 设为 PL2。要进行此配置，您必须使用 tag overrides 禁用与级别 PL3 与 PL4 关联的标签（paranoia-level-3 与 paranoia-level-4）。

  1. 使用 List account rulesets 方法获取 Cloudflare OWASP Core Ruleset 的 ID，因为 WAF 的 managed rulesets 存在于账户级别。或者，直接使用以下 ruleset ID： 。

    List account rulesetsbash
    curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
    {
	"result": [
		{
			"id": "4814384a9e5d4991b9815dcfc25d2f1f",
			"name": "Cloudflare OWASP Core Ruleset",
			"description": "Cloudflare's implementation of the Open Web Application Security Project (OWASP) ModSecurity Core  Rule Set. We routinely monitor for updates from OWASP based on the latest version available from the official  code repository",
			"source": "firewall_managed",
			"kind": "managed",
			"version": "35",
			"last_updated": "2022-01-24T21:08:20.293196Z",
			"phase": "http_request_firewall_managed"
		}
		// (...)
	],
	"success": true,
	"errors": [],
	"messages": []
}

  2. 使用 Get a zone entry point ruleset 获取将 OWASP ruleset 部署到您的 zone 的规则 ID。搜索 "action": "execute" 且在 action_parameters 对象中配置了 OWASP ruleset ID 的规则（ID ）。仅当您已部署 OWASP ruleset 时，此规则才会存在。

    Get a zone entry point rulesetbash
    curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
    {
	"result": {
		"id": "<ENTRY_POINT_RULESET_ID>",
		"name": "zone",
		"description": "",
		"source": "firewall_managed",
		"kind": "zone",
		"version": "3",
		"rules": [
			// (...)
			{
				"id": "<EXECUTE_RULE_ID>",
				"version": "1",
				"action": "execute",
				"action_parameters": {
					"id": "4814384a9e5d4991b9815dcfc25d2f1f",
					"version": "latest"
				},
				"expression": "true",
				"last_updated": "2022-02-04T16:27:58.930927Z",
				"ref": "<RULE_REF>",
				"enabled": true
			}
			// (...)
		],
		"last_updated": "2022-02-07T10:41:31.702744Z",
		"phase": "http_request_firewall_managed"
	},
	"success": true,
	"errors": [],
	"messages": []
}

  3. 使用 Update a zone ruleset rule 操作更新您识别的规则，添加禁用带有标签 paranoia-level-3 与 paranoia-level-4 的规则的 tag overrides。

    Update a zone ruleset rulebash
    curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$ENTRY_POINT_RULESET_ID/rules/$EXECUTE_RULE_ID" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"action": "execute",
		"action_parameters": {
				"id": "4814384a9e5d4991b9815dcfc25d2f1f",
				"overrides": {
						"categories": [
								{
										"category": "paranoia-level-3",
										"enabled": false
								},
								{
										"category": "paranoia-level-4",
										"enabled": false
								}
						]
				}
		},
		"expression": "true",
		"enabled": true
	}'

有关创建 overrides 的更多信息，请参阅 Override a managed ruleset。

配置分数阈值与操作

要定义 score threshold，或指定当威胁分数大于阈值时要执行的操作，请为 managed ruleset 中的最后一条规则创建 rule override，该 override：

  • 在 action 属性中指定要采取的操作。可用操作包括：js_challenge（Non-Interactive Challenge）、managed_challenge（Managed Challenge）、block（默认）、challenge（Interactive Challenge）与 log。
  • 在 score_threshold 属性中定义所需的异常分数阈值（整数值）。

示例

此示例通过为 managed ruleset 的最后一条规则创建 rule override 来配置 managed ruleset 的分数阈值与所执行的操作。

  1. 使用 List account rulesets 方法获取 Cloudflare OWASP Core Ruleset 的 ID，因为 WAF 的 managed rulesets 存在于账户级别。或者，直接使用以下 ruleset ID： 。

    List account rulesetsbash
    curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
    {
	"result": [
		{
			"id": "4814384a9e5d4991b9815dcfc25d2f1f",
			"name": "Cloudflare OWASP Core Ruleset",
			"description": "Cloudflare's implementation of the Open Web Application Security Project (OWASP) ModSecurity Core Rule Set. We routinely monitor for updates from OWASP based on the latest version available from the official code repository",
			"source": "firewall_managed",
			"kind": "managed",
			"version": "35",
			"last_updated": "2022-01-24T21:08:20.293196Z",
			"phase": "http_request_firewall_managed"
		}
		// (...)
	],
	"success": true,
	"errors": [],
	"messages": []
}

  2. 获取 Cloudflare OWASP Core Ruleset 中最后一条规则 的 ID。使用 Get an account ruleset 方法获取 ruleset 中的规则列表。或者，直接使用以下 rule ID： 。

    Get an account rulesetbash
    curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/$OWASP_RULESET_ID" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
    {
	"result": {
		"id": "4814384a9e5d4991b9815dcfc25d2f1f",
		"name": "Cloudflare OWASP Core Ruleset",
		"description": "Cloudflare's implementation of the Open Web Application Security Project (OWASP) ModSecurity Core Rule Set. We routinely monitor for updates from OWASP based on the latest version available from the official code repository",
		"source": "firewall_managed",
		"kind": "managed",
		"version": "36",
		"rules": [
			// (...)
			{
				"id": "6179ae15870a4bb7b2d480d4843b323c",
				"version": "35",
				"action": "block",
				"score_threshold": 40,
				"description": "949110: Inbound Anomaly Score Exceeded",
				"last_updated": "2022-02-08T16:11:18.236676Z",
				"ref": "ad0beb2fce9f149e565ee78d6e659d47",
				"enabled": true
			}
		],
		"last_updated": "2022-02-08T16:11:18.236676Z",
		"phase": "http_request_firewall_managed"
	},
	"success": true,
	"errors": [],
	"messages": []
}

  3. 使用 Get a zone entry point ruleset 获取将 OWASP ruleset 部署到您的 zone 的规则 ID（在此示例中为 <EXECUTE_RULE_ID>）。搜索 "action": "execute" 且在 action_parameters 对象中配置了 OWASP ruleset ID 的规则（ID ）。仅当您已部署 OWASP ruleset 时，此规则才会存在。

    Get a zone entry point rulesetbash
    curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
    {
	"result": {
		"id": "<ENTRY_POINT_RULESET_ID>",
		"name": "zone",
		"description": "",
		"source": "firewall_managed",
		"kind": "zone",
		"version": "3",
		"rules": [
			// (...)
			{
				"id": "<EXECUTE_RULE_ID>",
				"version": "1",
				"action": "execute",
				"action_parameters": {
					"id": "4814384a9e5d4991b9815dcfc25d2f1f",
					"version": "latest"
				},
				"expression": "true",
				"last_updated": "2022-02-04T16:27:58.930927Z",
				"ref": "<RULE_REF>",
				"enabled": true
			}
			// (...)
		],
		"last_updated": "2022-02-07T10:41:31.702744Z",
		"phase": "http_request_firewall_managed"
	},
	"success": true,
	"errors": [],
	"messages": []
}

  4. 使用 Update a zone ruleset rule 操作更新您在入口点 ruleset 中识别的规则，为 OWASP ruleset 中的最后一条规则（在步骤 2 中识别）添加具有以下属性与值的 rule override：

    • "score_threshold": 60
    • "action": "managed_challenge"
    Update a zone ruleset rulebash
    curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$ENTRY_POINT_RULESET_ID/rules/$EXECUTE_RULE_ID" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"action": "execute",
		"action_parameters": {
				"id": "4814384a9e5d4991b9815dcfc25d2f1f",
				"overrides": {
						"rules": [
								{
										"id": "6179ae15870a4bb7b2d480d4843b323c",
										"score_threshold": 60,
										"action": "managed_challenge"
								}
						]
				}
		},
		"expression": "true",
		"enabled": true
	}'

更多资源

有关更多 API 示例，请参阅 Ruleset Engine 文档中的 Override examples。

这篇文档对您有帮助吗？