CloudflareWAF

Cloudflare WAF integration allows customers to manage firewall rules, filters, and IP-lists. It also allows to retrieve zones list for each account.

Network Security · Cloudflare WAF

Details

IDCloudflareWAF
ProviderCloudflare
CategoryNetwork Security
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10404775
Supported ModulesAgentix XSIAM

README

Cloudflare WAF integration allows customers to manage firewall rules, filters, and IP-lists. It also allows to retrieve zones list for each account.
This integration was integrated and tested with version 4 of CloudflareWAF

Configure Cloudflare WAF in Cortex

Parameter Description Required
Server URL (e.g. https://api.cloudflare.com/client/v4/)   False
API Token   False
Global API Key   False
Email   False
Account ID Account identifier. True
Default Zone ID The domain identifier. Zone ID can be override when executing commands.The domain identifier. Zone ID can be override when executing commands. False
Use system proxy settings   False
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cloudflare-waf-firewall-rule-create

will be as deprecated, available until 2025-06-15
Create a new firewall rule that create new filter or use an exist filter.
Permissions required for the API token:
Account: Account Firewall Access Rules:Edit
Zone: Firewall Services:Edit
Include all zones and accounts needed.

Base Command

cloudflare-waf-firewall-rule-create

Input

Argument Name Description Required
action The rule action. Possible values are: block, challenge, js_challenge, managed_challenge, allow, log, bypass. Required
filter_id Identifier of an existing filter. Required if filter_expression is unspecified. Optional
filter_expression Filter expression when creating a filter for a new rule. Required if filter_id is unspecified. Expression example: “(ip.src eq 120.2.2.8) or (ip.src in $list_name)”. For syntax explanations and more examples: https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/. Optional
products Comma separated list of products to bypass for a request when the bypass action is used. Valid values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf. Possible values are: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf. Optional
priority The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
min value: 0.
max value: 2147483647.		 Optional
paused Whether this firewall rule is currently paused. Possible values are: True, False. Optional
description A description of the rule to help identify it. Optional
ref Short reference tag to quickly select related rules. Optional
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

Path Type Description
CloudflareWAF.FirewallRule.id String Firewall rule ID.
CloudflareWAF.FirewallRule.priority unknown The priority of the rule to allow control of processing order.
CloudflareWAF.FirewallRule.action unknown The action of the rule.
CloudflareWAF.FirewallRule.products unknown List of products to bypass for a request when the bypass action is used.
CloudflareWAF.FirewallRule.paused Boolean Whether this firewall rule is currently paused.
CloudflareWAF.FirewallRule.description String A description of the rule to help identify it.
CloudflareWAF.FirewallRule.ref String Short reference tag to quickly select related rules.

Command example

!cloudflare-waf-firewall-rule-create action=allow filter_expression="(ip.src eq 120.2.2.8)"

Context Example

{
    "CloudflareWAF": {
        "FirewallRule": {
            "action": "allow",
            "created_on": "2022-05-02T08:00:59Z",
            "filter": {
                "expression": "(ip.src eq 120.2.2.8)",
                "id": "2e740a75f2904b8e8df8e4fb36de1563",
                "paused": false
            },
            "id": "8da08f6f0c214e378e7847e420ec7965",
            "index": 4,
            "modified_on": "2022-05-02T08:00:59Z",
            "paused": false
        }
    }
}

Human Readable Output

Firewall rule was successfully created

Id Action Filter Id Filter Expression Products Priority Paused Description Ref
8da08f6f0c214e378e7847e420ec7965 allow 2e740a75f2904b8e8df8e4fb36de1563 (ip.src eq 120.2.2.8)     false    

cloudflare-waf-firewall-rule-update

will be as deprecated, available until 2025-06-15
Update firewall rule by the specified rule ID. Can update rule action, paused, description, priority, products and ref. Can not update or delete rule filter, ONLY add a new filter.
Permissions required for the API token:
Account: Account Firewall Access Rules:Edit
Zone: Firewall Services:Edit
Include all zones and accounts needed.

Base Command

cloudflare-waf-firewall-rule-update

Input

Argument Name Description Required
id Firewall Rule identifier. . Required
action The exist rule action or the new rule action to set. Possible values are: block, challenge, js_challenge, managed_challenge, allow, log, bypass. Required
filter_id The ID of the exist rule filter or the ID of the new filter to set. Required
products List of products to bypass for a request when the bypass action is used (comma separated list). Valid values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf. Possible values are: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf. Optional
priority The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
min value: 0.
max value: 2147483647.		 Optional
paused Whether this firewall rule is currently paused. Possible values are: true, false. Optional
description A description of the rule to help identify it. Optional
ref Short reference tag to quickly select related rules. Optional
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

There is no context output for this command.

cloudflare-waf-firewall-rule-delete

will be as deprecated, available until 2025-06-15
Delete firewall rule by the specified rule ID.
Permissions required for the API token:
Account: Account Firewall Access Rules:Edit
Zone: Firewall Services:Edit
Include all zones and accounts needed.

Base Command

cloudflare-waf-firewall-rule-delete

Input

Argument Name Description Required
id Firewall Rule identifier. . Required
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

There is no context output for this command.

Command example

!cloudflare-waf-firewall-rule-delete id="93657f595665493bbfcf3664edfca130"

Human Readable Output

Firewall rule 93657f595665493bbfcf3664edfca130 was successfully deleted.

cloudflare-waf-firewall-rule-list

will be as deprecated, available until 2025-06-15
List of firewall rules or details of individual rule by ID.
Permissions required for the API token:
Account: Account Firewall Access Rules:Read
Zone: Firewall Services:Read
Include all zones and accounts needed.

Base Command

cloudflare-waf-firewall-rule-list

Input

Argument Name Description Required
id Firewall Rule identifier. . Optional
action The rule action. Possible values are: block, challenge, js_challenge, managed_challenge, allow, log, bypass. Optional
paused Whether this firewall rule is currently paused. Possible values are: true, false. Optional
description A description of the rule to help identify it. Optional
page Page number of paginated results.
min value: 1.		 Optional
page_size Number of firewall rules per page. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Optional
limit The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Default is 50. Optional
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

Path Type Description
CloudflareWAF.FirewallRule.id String Firewall Rule identifier.
CloudflareWAF.FirewallRule.action String The rule action.
CloudflareWAF.FirewallRule.paused Boolean Whether this firewall rule is currently paused.
CloudflareWAF.FirewallRule.description String Rule description.
CloudflareWAF.FirewallRule.Filter.id String Rule filter id.
CloudflareWAF.FirewallRule.Filter.expression String Rule filter expression.
CloudflareWAF.FirewallRule.Filter.paused Boolean Whether this rule filter is currently paused.
CloudflareWAF.FirewallRule.Filter.description String Description of the rule filter.
CloudflareWAF.FirewallRule.Filter.ref String Short reference tag.

Command example


#### Context Example

```json
{
    "CloudflareWAF": {
        "FirewallRule": [
            {
                "action": "block",
                "description": null,
                "filter_expression": "(cf.client.bot)",
                "filter_id": "2aafaaea87da44ffa0929c115d2bebfc",
                "id": "47c7b26db654427d98235705abfcf32e",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            },
            {
                "action": "block",
                "description": null,
                "filter_expression": "(ip.src eq 120.2.2.8)",
                "filter_id": "a8e2887c7e484e0d84b0571e1e1ecc4a",
                "id": "de4fba698eb347f59e202306b46880a5",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            },
            {
                "action": "block",
                "description": null,
                "filter_expression": "(ip.src eq 120.2.2.8)",
                "filter_id": "c092787d60b54f06b270ab4cb22edd54",
                "id": "c643071e10694fecb194c95d80c64706",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            },
            {
                "action": "block",
                "description": null,
                "filter_expression": "(ip.src eq 120.2.2.8)",
                "filter_id": "3d6ea4fe88614d3c99d9f11da5b84b62",
                "id": "45a16a6ed90349db851eda214188f47a",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            }
        ]
    }
}

Human Readable Output

Firewall rule list

Showing 4 rows out of 4.

Id Action Paused Description Filter Id Filter Expression
47c7b26db654427d98235705abfcf32e block false   2aafaaea87da44ffa0929c115d2bebfc (cf.client.bot)
de4fba698eb347f59e202306b46880a5 block false   a8e2887c7e484e0d84b0571e1e1ecc4a (ip.src eq 120.2.2.8)
c643071e10694fecb194c95d80c64706 block false   c092787d60b54f06b270ab4cb22edd54 (ip.src eq 120.2.2.8)
45a16a6ed90349db851eda214188f47a block false   3d6ea4fe88614d3c99d9f11da5b84b62 (ip.src eq 120.2.2.8)

cloudflare-waf-filter-create

Create a new filter which can be added to a firewall rule.
Permissions required for the API token:
Account: Account Filter Lists:Edit
Zone: Firewall Services:Edit

Base Command

cloudflare-waf-filter-create

Input

Argument Name Description Required
expression The filter expression to be used. Expression example: “(ip.src eq 120.2.2.8) or (ip.src in $list_name)”. For syntax explanations and more examples: https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/. Required
ref Short reference tag to quickly select related rules. Optional
paused Whether this filter is currently paused. Possible values are: true, false. Optional
description A note that you can use to describe the purpose of the filter. Optional
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

Path Type Description
CloudflareWAF.Filter.id String Filter identifier.
CloudflareWAF.Filter.expression String The filter expression to be used.
CloudflareWAF.Filter.paused Boolean Whether this filter is currently paused.
CloudflareWAF.Filter.description String A note that describe the purpose of the filter.
CloudflareWAF.Filter.ref String Short reference tag to quickly select related rules.

Command example

!cloudflare-waf-filter-create expression="(ip.src eq 120.2.2.8)"

Context Example

{
    "CloudflareWAF": {
        "Filter": [
            {
                "expression": "(ip.src eq 120.2.2.8)",
                "id": "02f3f01de4644c31a048d4b837145162",
                "paused": false
            },
            {
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            }
        ]
    }
}

Human Readable Output

Filter was successfully created

Id Expression Paused Description Ref
02f3f01de4644c31a048d4b837145162 (ip.src eq 120.2.2.8) false    
         

cloudflare-waf-filter-update

Update filter by the specified filter ID.
Permissions required for the API token:
Account: Account Filter Lists:Edit
Zone: Firewall Services:Edit

Base Command

cloudflare-waf-filter-update

Input

Argument Name Description Required
id Filter identifier. . Possible values are: . Required
expression The filter expression to be used. Expression example: “(ip.src eq 120.2.2.8) or (ip.src in $list_name)”. Required
ref Short reference tag to quickly select related rules. Optional
paused Whether this filter is currently paused. Possible values are: true, false. Optional
description A note that you can use to describe the purpose of the filter. Optional
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

There is no context output for this command.

cloudflare-waf-filter-delete

Delete an exist filter (Note that a filter linked to firewall rule cannot be deleted).
Permissions required for the API token:
Account: Account Filter Lists:Edit
Zone: Firewall Services:Edit

Base Command

cloudflare-waf-filter-delete

Input

Argument Name Description Required
filter_id The filter ID. Required
zone_id Zone identifier. The initialization will override the value set in the instance. Optional

Context Output

There is no context output for this command.

Command example

!cloudflare-waf-filter-delete filter_id="c8bf98553afd4522bde108f600d8a794"

Human Readable Output

Filter c8bf98553afd4522bde108f600d8a794 was successfully deleted.

cloudflare-waf-filter-list

List filters.
Permissions required for the API token:
Account: Account Filter Lists:Read
Zone: Firewall Services:Read

Base Command

cloudflare-waf-filter-list

Input

Argument Name Description Required
id Filter identifier. . Optional
expression The filter expression to be used. Optional
ref Short reference tag to quickly select related rules. Optional
paused Whether this filter is currently paused. Possible values are: true, false. Optional
description A note that you can use to describe the purpose of the filter. Optional
page Page number of paginated results.
min value: 1.		 Optional
page_size Number of filter based firewall rules per page. The argument accepts values ​​divided by 5.
Minimum value 5.
Maximum value 100.
For example: 5,10,15.		 Optional
limit The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Default is 50. Optional
zone_id Zone identifier. If provided, it will override the value set in the instance. Optional

Context Output

Path Type Description
CloudflareWAF.Filter.id String Filter identifier.
CloudflareWAF.Filter.expression String The filter expression.
CloudflareWAF.Filter.description String Description of the filter purpose.
CloudflareWAF.Filter.paused Boolean Whether this filter is currently paused.
CloudflareWAF.Filter.ref String Short reference tag.

Command example


#### Context Example

```json
{
    "CloudflareWAF": {
        "Filter": [
            {
                "expression": "(ip.src eq 120.2.2.8)",
                "id": "c092787d60b54f06b270ab4cb22edd54",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            },
            {
                "expression": "(ip.src eq 120.2.2.8)",
                "id": "cdbbc2fc50d84e07bec72e213642d293",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            },
            {
                "expression": "(ip.src eq 120.2.2.8)",
                "id": "dc6eb4ff230648ecabf7c3f0c159d3b5",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            },
            {
                "expression": "(ip.src eq 120.2.2.8)",
                "id": "2c18e08324b345feade9003b68fc5762",
                "paused": false,
                "zone_id": "e18cd14b21c8282bec11cabec5c4dbf9"
            }
        ]
    }
}

Human Readable Output

Filter list

Showing 50 rows out of 93.

Id Expression Ref Description Paused
c092787d60b54f06b270ab4cb22edd54 (ip.src eq 120.2.2.8)     false
3b997e7e24bd48598870f02560e26044 (ip.src eq 120.2.2.8)     false
3d6ea4fe88614d3c99d9f11da5b84b62 (ip.src eq 120.2.2.8)     false
f368d129d8fa4c97ad62fd4024bf63f9 (ip.src eq 120.2.2.8)     false

cloudflare-waf-zone-list

List all account zones.
Permissions required for the API token:
Zone: Zone Settings:Read
Zone:Read

Base Command

cloudflare-waf-zone-list

Input

Argument Name Description Required
match Whether to match all search requirements or at least one (any). Possible values are: any, all. Default is all. Optional
name A domain name. Optional
account_name Account name. Optional
account_id Account identifier tag. Optional
status Status of the zone. Possible values are: active, pending, initializing, moved, deleted, deactivated, read only. Optional
order Field to order zones by. Possible values are: name, status, account.id, account.name. Optional
direction Direction to order zones. Possible values are: asc, desc. Optional
page Page number of paginated results. Default value: 1, min value: 1. Optional
page_size Number of zones per page. The argument accepts values ​​divided by 5.
Minimum value 5.
Maximum value 100.
For example: 5,10,15.		 Optional
limit The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Default is 50. Optional

Context Output

Path Type Description
CloudflareWAF.Zone.success Boolean The status of the request (true or false).
CloudflareWAF.Zone.id String The zone ID.
CloudflareWAF.Zone.name String A domain name.
CloudflareWAF.Zone.development_mode Integer Development mode.
CloudflareWAF.Zone.original_name_servers Data Original name servers.
CloudflareWAF.Zone.original_registrar String Original registrar.
CloudflareWAF.Zone.original_dnshost String Original DNS host.
CloudflareWAF.Zone.created_on Date Zone created date.
CloudflareWAF.Zone.modified_on Date Zone modified date.
CloudflareWAF.Zone.activated_on Date Zone activated date.
CloudflareWAF.Zone.status String Status of the zone.
CloudflareWAF.Zone.paused Boolean Whether this zone is currently paused.
CloudflareWAF.Zone.type String Short reference tag.
CloudflareWAF.Zone.permissions Data List of zone permissions.
CloudflareWAF.Zone.Account Data Account details.
CloudflareWAF.Zone.owner Data The zone owner details.
CloudflareWAF.Zone.name_servers Data Zone servers names.

Command example


#### Context Example

```json
{
    "CloudflareWAF": {
        "Zone": [
            {
                "account": {
                    "id": "67fb88dc5eb69bd55969cea954c75cea",
                    "name": "email@email.com"
                },
                "activated_on": "2021-12-08T07:54:43.676430Z",
                "created_on": "2021-12-01T12:50:43.250444Z",
                "development_mode": 0,
                "id": "d185f37563270905ae2e587e5bc6c9dd",
                "meta": {
                    "custom_certificate_quota": 0,
                    "multiple_railguns_allowed": false,
                    "page_rule_quota": 30,
                    "phishing_detected": false,
                    "step": 2
                },
                "modified_on": "2021-12-08T07:54:43.676430Z",
                "name": "fortresscyber.io",
                "name_servers": [
                    "earl.ns.cloudflare.com",
                    "monroe.ns.cloudflare.com"
                ],
                "original_dnshost": null,
                "original_name_servers": [
                    "ns-669.awsdns-19.net",
                    "ns-1219.awsdns-24.org",
                    "ns-64.awsdns-08.com",
                    "ns-1907.awsdns-46.co.uk"
                ],
                "original_registrar": "namecheap, inc. (id: 1068)",
                "owner": {
                    "email": "email@email.com",
                    "id": "b295c6a5f2897c4f1a1c42ebeeb079",
                    "type": "user"
                },
                "paused": false,
                "permissions": [
                    "#access:edit",
                    "#access:read",
                    "#analytics:read",
                    "#app:edit",
                    "#auditlogs:read",
                    "#billing:read",
                    "#cache_purge:edit",
                    "#dns_records:edit",
                    "#dns_records:read",
                    "#healthchecks:edit",
                    "#healthchecks:read",
                    "#lb:edit",
                    "#lb:read",
                    "#legal:read",
                    "#logs:edit",
                    "#logs:read",
                    "#member:read",
                    "#organization:edit",
                    "#organization:read",
                    "#ssl:edit",
                    "#ssl:read",
                    "#stream:edit",
                    "#stream:read",
                    "#subscription:edit",
                    "#subscription:read",
                    "#teams:edit",
                    "#teams:read",
                    "#teams:report",
                    "#waf:edit",
                    "#waf:read",
                    "#waitingroom:edit",
                    "#waitingroom:read",
                    "#webhooks:edit",
                    "#webhooks:read",
                    "#worker:edit",
                    "#worker:read",
                    "#zaraz:edit",
                    "#zaraz:read",
                    "#zone:edit",
                    "#zone:read",
                    "#zone_settings:edit",
                    "#zone_settings:read"
                ],
                "plan": {
                    "can_subscribe": false,
                    "currency": "USD",
                    "externally_managed": false,
                    "frequency": "",
                    "id": "a577b510288e82b26486fd1df47000ec",
                    "is_subscribed": true,
                    "legacy_discount": false,
                    "legacy_id": "pro",
                    "name": "Pro Website",
                    "price": 0
                },
                "status": "active",
                "type": "full"
            },
            {
                "account": {
                    "id": "67fb88dc5eb69bd55969cea954c75cea",
                    "name": "email@email.com"
                },
                "activated_on": "2022-01-30T11:04:53.255562Z",
                "created_on": "2022-01-30T10:47:46.393968Z",
                "development_mode": 0,
                "id": "e0fb31cf064ac5fc55377bf9e16d40ee",
                "meta": {
                    "custom_certificate_quota": 0,
                    "multiple_railguns_allowed": false,
                    "page_rule_quota": 3,
                    "phishing_detected": false,
                    "step": 2
                },
                "modified_on": "2022-01-30T11:04:53.255562Z",
                "name": "stronghold.services",
                "name_servers": [
                    "earl.ns.cloudflare.com",
                    "monroe.ns.cloudflare.com"
                ],
                "original_dnshost": null,
                "original_name_servers": [
                    "dns1.registrar-servers.com",
                    "dns2.registrar-servers.com"
                ],
                "original_registrar": "namecheap, inc. (id: 1068)",
                "owner": {
                    "email": "email@email.com",
                    "id": "b295c6a5f2897c4f1a1c42ebeeb079",
                    "type": "user"
                },
                "paused": false,
                "permissions": [
                    "#access:edit",
                    "#access:read",
                    "#analytics:read",
                    "#app:edit",
                    "#auditlogs:read",
                    "#billing:read",
                    "#cache_purge:edit",
                    "#dns_records:edit",
                    "#dns_records:read",
                    "#healthchecks:edit",
                    "#healthchecks:read",
                    "#lb:edit",
                    "#lb:read",
                    "#legal:read",
                    "#logs:edit",
                    "#logs:read",
                    "#member:read",
                    "#organization:edit",
                    "#organization:read",
                    "#ssl:edit",
                    "#ssl:read",
                    "#stream:edit",
                    "#stream:read",
                    "#subscription:edit",
                    "#subscription:read",
                    "#teams:edit",
                    "#teams:read",
                    "#teams:report",
                    "#waf:edit",
                    "#waf:read",
                    "#waitingroom:edit",
                    "#waitingroom:read",
                    "#webhooks:edit",
                    "#webhooks:read",
                    "#worker:edit",
                    "#worker:read",
                    "#zaraz:edit",
                    "#zaraz:read",
                    "#zone:edit",
                    "#zone:read",
                    "#zone_settings:edit",
                    "#zone_settings:read"
                ],
                "plan": {
                    "can_subscribe": false,
                    "currency": "USD",
                    "externally_managed": false,
                    "frequency": "",
                    "id": "0feeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
                    "is_subscribed": false,
                    "legacy_discount": false,
                    "legacy_id": "free",
                    "name": "Free Website",
                    "price": 0
                },
                "status": "active",
                "type": "full"
            }
        ]
    }
}

Human Readable Output

Zone list

Showing 2 rows out of 2

Name Account Name Status Account Id Direction
fortresscyber.io   active    
stronghold.services   active    

cloudflare-waf-ip-list-create

Create a new IP-list. An IP-list is a list that includes IP addresses and CIDR. IP-list is used in the filter expression.
Permissions required for the API token:
Account: All accounts - Account WAF:Edit

Base Command

cloudflare-waf-ip-list-create

Input

Argument Name Description Required
name The name of the list (used in filter expressions). Required
description A note that can be used to annotate the List. Optional

Context Output

Path Type Description
CloudflareWAF.IpList.id String The list ID.
CloudflareWAF.IpList.name String The name of the list.
CloudflareWAF.IpList.description String A note that annotate the List.
CloudflareWAF.IpList.kind String The kind of values in the List.
CloudflareWAF.IpList.num_items Integer Number of list items.
CloudflareWAF.IpList.num_referencing_filters Integer Number of referencing filters to the list.
CloudflareWAF.IpList.created_on Date List created date.
CloudflareWAF.IpList.modified_on Date List modified date.

cloudflare-waf-ip-list-delete

Delete IP-list by the specified list ID.
Permissions required for the API token:
Account: All accounts - Account WAF:Edit

Base Command

cloudflare-waf-ip-list-delete

Input

Argument Name Description Required
id The list ID. . Required

Context Output

There is no context output for this command.

Command example

!cloudflare-waf-ip-list-delete id="dd7e3f1f5edf4591acb22f20da320b8f"

Human Readable Output

IP list dd7e3f1f5edf4591acb22f20da320b8f was successfully deleted

cloudflare-waf-ip-lists-list

List IP-lists.
Permissions required for the API token:
Account: All accounts - Account WAF:Read

Base Command

cloudflare-waf-ip-lists-list

Input

Argument Name Description Required
id Retrieve details for an individual list Id. Optional
page Page number of paginated results.
Default value: 1, min value: 1.		 Optional
page_size Number of IP-list per page. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Optional
limit The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Default is 50. Optional

Context Output

Path Type Description
CloudflareWAF.IpList.id String The list ID.
CloudflareWAF.IpList.name String The list name.
CloudflareWAF.IpList.description String List description.
CloudflareWAF.IpList.kind String List kind (ip\redirect).
CloudflareWAF.IpList.num_items unknown Number of list items.
CloudflareWAF.IpList.num_referencing_filters unknown Number of referencing filters to the list.

Command example


#### Context Example

```json
{
    "CloudflareWAF": {
        "IpList": [
            {
                "created_on": "2022-04-10T09:42:13Z",
                "id": "e6efdc37cf7d41f2860a3fd448c68df8",
                "kind": "ip",
                "modified_on": "2022-04-27T13:39:44Z",
                "name": "my_first_list1",
                "num_items": 8,
                "num_referencing_filters": 1
            },
            {
                "created_on": "2022-03-29T14:53:15Z",
                "id": "82963f46e892446e99ae3ff9fe1b6524",
                "kind": "ip",
                "modified_on": "2022-04-27T13:39:32Z",
                "name": "my_first_list",
                "num_items": 1,
                "num_referencing_filters": 1
            },
            {
                "created_on": "2022-04-27T13:36:54Z",
                "id": "617290bdb0674696a20af4cdf4677f4e",
                "kind": "ip",
                "modified_on": "2022-04-27T13:36:54Z",
                "name": "new_new",
                "num_items": 0,
                "num_referencing_filters": 0
            },
            {
                "created_on": "2022-04-27T13:12:13Z",
                "id": "8af3465383434fc3ab6283d07406699f",
                "kind": "ip",
                "modified_on": "2022-04-27T13:12:13Z",
                "name": "my_new_and_last_list",
                "num_items": 0,
                "num_referencing_filters": 0
            },
            {
                "created_on": "2022-04-26T13:54:32Z",
                "id": "c0388c7c007d497ea37a21555aff49d2",
                "kind": "ip",
                "modified_on": "2022-04-27T12:35:09Z",
                "name": "list_name",
                "num_items": 1,
                "num_referencing_filters": 0
            },
            {
                "created_on": "2022-04-27T10:46:47Z",
                "id": "71934eec8ce34a85b57509a60f9ae57c",
                "kind": "ip",
                "modified_on": "2022-04-27T10:49:52Z",
                "name": "playbook_list",
                "num_items": 0,
                "num_referencing_filters": 0
            },
            {
                "created_on": "2022-04-27T10:08:53Z",
                "id": "8e9773d982fb4dbfb198f8078d22f4f6",
                "kind": "ip",
                "modified_on": "2022-04-27T10:08:53Z",
                "name": "list_name2",
                "num_items": 0,
                "num_referencing_filters": 0
            },
            {
                "created_on": "2022-04-26T08:25:48Z",
                "id": "8667dc96872c44ebabd7559594e92372",
                "kind": "ip",
                "modified_on": "2022-04-26T08:55:54Z",
                "name": "demo_list2",
                "num_items": 1,
                "num_referencing_filters": 1
            }
        ]
    }
}

Human Readable Output

IP lists list

Showing 8 rows out of 8.

Id Name Kind Num Items Num Referencing Filters Created On Modified On
e6efdc37cf7d41f2860a3fd448c68df8 my_first_list1 ip 8 1 2022-04-10T09:42:13Z 2022-04-27T13:39:44Z
82963f46e892446e99ae3ff9fe1b6524 my_first_list ip 1 1 2022-03-29T14:53:15Z 2022-04-27T13:39:32Z
617290bdb0674696a20af4cdf4677f4e new_new ip 0 0 2022-04-27T13:36:54Z 2022-04-27T13:36:54Z
8af3465383434fc3ab6283d07406699f my_new_and_last_list ip 0 0 2022-04-27T13:12:13Z 2022-04-27T13:12:13Z
c0388c7c007d497ea37a21555aff49d2 list_name ip 1 0 2022-04-26T13:54:32Z 2022-04-27T12:35:09Z
71934eec8ce34a85b57509a60f9ae57c playbook_list ip 0 0 2022-04-27T10:46:47Z 2022-04-27T10:49:52Z
8e9773d982fb4dbfb198f8078d22f4f6 list_name2 ip 0 0 2022-04-27T10:08:53Z 2022-04-27T10:08:53Z
8667dc96872c44ebabd7559594e92372 demo_list2 ip 1 1 2022-04-26T08:25:48Z 2022-04-26T08:55:54Z

cloudflare-waf-ip-list-item-create

Create new items for exist IP-list.
Permissions required for the API token:
Account: All accounts - Account WAF:Edit

Base Command

cloudflare-waf-ip-list-item-create

Input

Argument Name Description Required
list_id The ID of the list to insert the new items. Possible values are: . Required
items The new items to be added (comma separated IP addresses). Required
polling Use Cortex XSOAR built-in polling to retrieve the result when it’s ready. Default is False. Possible values are: true, false. Default is True. Optional
interval Indicates how long to wait between command execution (in seconds) when ‘polling’ argument is true. Minimum value is 10 seconds. Default is 30. Default is 10. Optional
timeout Indicates the time in seconds until the polling sequence timeouts. Default is 60. Default is 60. Optional
operation_id The ID of the pipeline run to retrieve when polling argument is true. Intended for use by the Polling process and does not need to be provided by the user. Optional

Context Output

There is no context output for this command.

cloudflare-waf-ip-list-item-update

Replace the IP-list items with a new items
Permissions required for the API token:
Account: All accounts - Account WAF:Edit

Base Command

cloudflare-waf-ip-list-item-update

Input

Argument Name Description Required
list_id The list ID. Required
items The new items. Required
polling Use Cortex XSOAR built-in polling to retrieve the result when it’s ready. Default is False. Possible values are: true, false. Default is True. Optional
interval Indicates how long to wait between command execution (in seconds) when ‘polling’ argument is true. Minimum value is 10 seconds. Default is 30. Default is 10. Optional
timeout Indicates the time in seconds until the polling sequence timeouts. Default is 60. Default is 60. Optional
operation_id The ID of the pipeline run to retrieve when polling argument is true. Intended for use by the Polling process and does not need to be provided by the user. Optional

Context Output

There is no context output for this command.

cloudflare-waf-ip-list-item-delete

Delete item of a IP-list by the specified list ID and list item.
Permissions required for the API token:
Account: All accounts - Account WAF:Edit

Base Command

cloudflare-waf-ip-list-item-delete

Input

Argument Name Description Required
list_id The list ID. Required
items_id The items ID to be delete. Required
polling Use Cortex XSOAR built-in polling to retrieve the result when it’s ready. Default is False. Possible values are: true, false. Default is True. Optional
interval Indicates how long to wait between command execution (in seconds) when ‘polling’ argument is true. Minimum value is 10 seconds. Default is 30. Default is 10. Optional
timeout Indicates the time in seconds until the polling sequence timeouts. Default is 60. Default is 60. Optional
operation_id The ID of the pipeline run to retrieve when polling argument is true. Intended for use by the Polling process and does not need to be provided by the user. Optional

Context Output

There is no context output for this command.

cloudflare-waf-ip-list-item-list

List all items in the List or details of individual item by ID.
Permissions required for the API token:
Account: All accounts - Account WAF:Read

Base Command

cloudflare-waf-ip-list-item-list

Input

Argument Name Description Required
list_id The list ID. Required
item_id Retrieve details for an individual item Id. Optional
page Page number of paginated results.
Default value: 1, min value: 1.		 Optional
page_size Number of zones per page. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Optional
limit The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15. Default is 50. Optional

Context Output

Path Type Description
CloudflareWAF.IpListItem.items Unknown The list items.
CloudflareWAF.IpListItem.list_id String The list ID.

Command example

!cloudflare-waf-ip-list-item-list list_id="e6efdc37cf7d41f2860a3fd448c68df8"

Context Example

{
    "CloudflareWAF": {
        "IpListItem": {
            "items": [
                {
                    "created_on": "2022-04-26T10:58:55Z",
                    "id": "b3016f6529274bbd8086a4ac0be07822",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-26T10:59:24Z"
                },
                {
                    "created_on": "2022-04-25T13:01:32Z",
                    "id": "e5a81036d2c549dba90460c6b5745495",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T13:01:32Z"
                },
                {
                    "created_on": "2022-04-25T13:12:09Z",
                    "id": "93d34d1f299a46659fe61fa2165d38a3",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T13:12:09Z"
                },
                {
                    "created_on": "2022-04-25T12:45:50Z",
                    "id": "748c3ae947ca49d3aada448d233838e0",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T12:46:05Z"
                },
                {
                    "created_on": "2022-04-25T12:45:50Z",
                    "id": "ceea4f5b3e124a72a9aed4a779ce8dcb",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T12:46:05Z"
                },
                {
                    "created_on": "2022-04-25T12:45:50Z",
                    "id": "eab6abfa0d754c629a9bce69ab3cc5fb",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T12:46:05Z"
                },
                {
                    "created_on": "2022-04-25T12:45:50Z",
                    "id": "eccdf2f286804a988850accbaaeaa462",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T12:46:05Z"
                },
                {
                    "created_on": "2022-04-25T12:45:50Z",
                    "id": "d3b69c4d7bc34384a7448498dd8d9b45",
                    "ip": "120.2.2.8",
                    "modified_on": "2022-04-25T12:46:05Z"
                }
            ],
            "list_id": "e6efdc37cf7d41f2860a3fd448c68df8"
        }
    }
}

Human Readable Output

ip-list e6efdc37cf7d41f2860a3fd448c68df8

Showing 8 rows out of 8.

Id Ip Created On Modified On
b3016f6529274bbd8086a4ac0be07822 120.2.2.8 2022-04-26T10:58:55Z 2022-04-26T10:59:24Z
e5a81036d2c549dba90460c6b5745495 120.2.2.8 2022-04-25T13:01:32Z 2022-04-25T13:01:32Z
93d34d1f299a46659fe61fa2165d38a3 120.2.2.8 2022-04-25T13:12:09Z 2022-04-25T13:12:09Z
748c3ae947ca49d3aada448d233838e0 120.2.2.8 2022-04-25T12:45:50Z 2022-04-25T12:46:05Z
ceea4f5b3e124a72a9aed4a779ce8dcb 120.2.2.8 2022-04-25T12:45:50Z 2022-04-25T12:46:05Z
eab6abfa0d754c629a9bce69ab3cc5fb 120.2.2.8 2022-04-25T12:45:50Z 2022-04-25T12:46:05Z
eccdf2f286804a988850accbaaeaa462 120.2.2.8 2022-04-25T12:45:50Z 2022-04-25T12:46:05Z
d3b69c4d7bc34384a7448498dd8d9b45 120.2.2.8 2022-04-25T12:45:50Z 2022-04-25T12:46:05Z

cloudflare-waf-ruleset-list

The command lists all rulesets at the account or zone level.

Base Command

cloudflare-waf-ruleset-list

Input

Argument Name Description Required
zone_id Zone identifier. If provided, lists zone-level rulesets. If not provided, lists account-level rulesets. The value set in the instance configuration is used by default. Optional

Context Output

Path Type Description
CloudflareWAF.Ruleset.id String The ruleset identifier.
CloudflareWAF.Ruleset.name String The name of the ruleset.
CloudflareWAF.Ruleset.kind String The kind of the ruleset.
CloudflareWAF.Ruleset.phase String The phase of the ruleset.
CloudflareWAF.Ruleset.description String A description of the ruleset.
CloudflareWAF.Ruleset.version String The version of the ruleset.
CloudflareWAF.Ruleset.last_updated Date The timestamp of when the ruleset was last updated.

Command example

!cloudflare-waf-ruleset-list

Human Readable Output

Ruleset list

Id Name Kind Phase Description Version Last Updated
abc123 Cloudflare Managed Ruleset managed http_request_firewall_managed Managed ruleset 1 2023-01-15T10:00:00Z

cloudflare-waf-ruleset-get

The command retrieves a specific ruleset by ID, including its list of rules.

Base Command

cloudflare-waf-ruleset-get

Input

Argument Name Description Required
ruleset_id The ruleset identifier. Required
zone_id Zone identifier. If provided, gets a zone-level ruleset. If not provided, gets an account-level ruleset. The value set in the instance configuration is used by default. Optional

Context Output

Path Type Description
CloudflareWAF.Ruleset.id String The ruleset identifier.
CloudflareWAF.Ruleset.name String The name of the ruleset.
CloudflareWAF.Ruleset.kind String The kind of the ruleset.
CloudflareWAF.Ruleset.phase String The phase of the ruleset.
CloudflareWAF.Ruleset.description String A description of the ruleset.
CloudflareWAF.Ruleset.version String The version of the ruleset.
CloudflareWAF.Ruleset.last_updated Date The timestamp of when the ruleset was last updated.
CloudflareWAF.Ruleset.rules.id String The rule identifier.
CloudflareWAF.Ruleset.rules.action String The action to perform when the rule matches.
CloudflareWAF.Ruleset.rules.expression String The filter expression for the rule.
CloudflareWAF.Ruleset.rules.description String A description of the rule.
CloudflareWAF.Ruleset.rules.enabled Boolean Whether the rule is enabled.
CloudflareWAF.Ruleset.rules.version String The version of the rule.
CloudflareWAF.Ruleset.rules.ref String The reference of the rule.

Command example

!cloudflare-waf-ruleset-get ruleset_id="abc123"

Human Readable Output

Ruleset details

Id Name Kind Phase Description Version Last Updated
abc123 Cloudflare Managed Ruleset managed http_request_firewall_managed Managed ruleset 1 2023-01-15T10:00:00Z

Ruleset rules

Id Action Expression Description Enabled Version Ref
rule_1 block (ip.src eq 192.0.2.1) Block bad IP true 1 ref_1

cloudflare-waf-ruleset-create

The command creates a new ruleset at the account or zone level.

Base Command

cloudflare-waf-ruleset-create

Input

Argument Name Description Required
name The name of the ruleset. Required
kind The kind of the ruleset. Possible values are: managed, custom, root, zone. Required
phase The phase of the ruleset. Possible values are: ddos_l4, ddos_l7, http_config_settings, http_custom_errors, http_log_custom_fields, http_ratelimit, http_request_cache_settings, http_request_dynamic_redirect, http_request_firewall_custom, http_request_firewall_managed, http_request_late_transform, http_request_origin, http_request_redirect, http_request_sanitize, http_request_sbfm, http_request_transform, http_response_compression, http_response_firewall_managed, http_response_headers_transform, magic_transit. Required
description A description of the ruleset. Optional
rules A JSON array of rule objects to include in the ruleset. For example: [{“action”: “block”, “expression”: “(ip.src eq 192.0.2.1)”, “description”: “Block bad IP”}]. Optional
zone_id Zone identifier. If provided, creates a zone-level ruleset. If not provided, creates an account-level ruleset. The value set in the instance configuration is used by default. Optional

Context Output

Path Type Description
CloudflareWAF.Ruleset.id String The ruleset identifier.
CloudflareWAF.Ruleset.name String The name of the ruleset.
CloudflareWAF.Ruleset.kind String The kind of the ruleset.
CloudflareWAF.Ruleset.phase String The phase of the ruleset.
CloudflareWAF.Ruleset.description String A description of the ruleset.
CloudflareWAF.Ruleset.version String The version of the ruleset.
CloudflareWAF.Ruleset.last_updated Date The timestamp of when the ruleset was last updated.

Command example

!cloudflare-waf-ruleset-create name="My Custom Ruleset" kind="custom" phase="http_request_firewall_custom" description="A custom ruleset"

Human Readable Output

Ruleset was successfully created

Id Name Kind Phase Description Version Last Updated
new_id My Custom Ruleset custom http_request_firewall_custom A custom ruleset 1 2023-03-10T08:00:00Z

cloudflare-waf-ruleset-update

The command updates an existing ruleset by ID. Note that this replaces the entire ruleset configuration.

Base Command

cloudflare-waf-ruleset-update

Input

Argument Name Description Required
ruleset_id The ruleset identifier. Required
name The name of the ruleset. Optional
description A description of the ruleset. Optional
rules A JSON array of rule objects to set in the ruleset. This replaces all existing rules. For example: [{“action”: “block”, “expression”: “(ip.src eq 192.0.2.1)”, “description”: “Block bad IP”}]. Optional
zone_id Zone identifier. If provided, updates a zone-level ruleset. If not provided, updates an account-level ruleset. The value set in the instance configuration is used by default. Optional

Context Output

Path Type Description
CloudflareWAF.Ruleset.id String The ruleset identifier.
CloudflareWAF.Ruleset.name String The name of the ruleset.
CloudflareWAF.Ruleset.kind String The kind of the ruleset.
CloudflareWAF.Ruleset.phase String The phase of the ruleset.
CloudflareWAF.Ruleset.description String A description of the ruleset.
CloudflareWAF.Ruleset.version String The version of the ruleset.
CloudflareWAF.Ruleset.last_updated Date The timestamp of when the ruleset was last updated.

Command example

!cloudflare-waf-ruleset-update ruleset_id="abc123" name="Updated Ruleset" description="Updated description"

Human Readable Output

Ruleset abc123 was successfully updated.

cloudflare-waf-ruleset-delete

The command deletes a ruleset by ID.

Base Command

cloudflare-waf-ruleset-delete

Input

Argument Name Description Required
ruleset_id The ruleset identifier. Required
zone_id Zone identifier. If provided, deletes a zone-level ruleset. If not provided, deletes an account-level ruleset. The value set in the instance configuration is used by default. Optional

Context Output

There is no context output for this command.

Command example

!cloudflare-waf-ruleset-delete ruleset_id="abc123"

Human Readable Output

Ruleset abc123 was successfully deleted.

Configuration parameters

  • server — Server URL (e.g. https://api.cloudflare.com/client/v4/)
  • credentials — API Token
  • global_api_key — Global API Key
  • email — Email
  • account_id — Account ID (required)
  • zone_id — Default Zone ID
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (21)

  • cloudflare-waf-filter-create

    Create a new filter which can be added to a firewall rule.

  • cloudflare-waf-filter-delete

    Delete an exist filter (Note that a filter linked to firewall rule cannot be deleted).

  • cloudflare-waf-filter-list

    List filters.

  • cloudflare-waf-filter-update

    Update filter by the specified filter ID.

  • cloudflare-waf-firewall-rule-create

    Create a new firewall rule that create new filter or use an exist filter.

  • cloudflare-waf-firewall-rule-delete

    Delete firewall rule by the specified rule ID.

  • cloudflare-waf-firewall-rule-list

    List of firewall rules or details of individual rule by ID.

  • cloudflare-waf-firewall-rule-update

    Update firewall rule by the specified rule ID. Can update rule action, paused, description, priority, products and ref. Can not update or delete rule filter, ONLY add a new filter.

  • cloudflare-waf-ip-list-create

    Create a new IP-list. An IP-list is a list that includes IP addresses and CIDR. IP-list is used in the filter expression.

  • cloudflare-waf-ip-list-delete

    Delete IP-list by the specified list ID. Note that IP-list that assigned to a firewall rule can not be delete, only after unassign the list.

  • cloudflare-waf-ip-list-item-create

    Create new items for exist IP-list.

  • cloudflare-waf-ip-list-item-delete

    Delete item of a IP-list by the specified list ID and list item.

  • cloudflare-waf-ip-list-item-list

    List all items in the List or details of individual item by ID or IP. This command may take a long time, you can set the 'execution-timeout' field if necessary.

  • cloudflare-waf-ip-list-item-update

    Replace the IP-list items with a new items.

  • cloudflare-waf-ip-lists-list

    List IP-lists.

  • cloudflare-waf-ruleset-create

    The command creates a new ruleset at the account or zone level.

  • cloudflare-waf-ruleset-delete

    The command deletes a ruleset by ID.

  • cloudflare-waf-ruleset-get

    The command retrieves a specific ruleset by ID, including its list of rules.

  • cloudflare-waf-ruleset-list

    The command lists all rulesets at the account or zone level.

  • cloudflare-waf-ruleset-update

    The command updates an existing ruleset by ID. Note that this replaces the entire ruleset configuration.

  • cloudflare-waf-zone-list

    List all account zones.

Source

CloudflareWAF.py CloudflareWAF_test.py CloudflareWAF.yml CloudflareWAF_description.md
Download History Raw 
display: Cloudflare WAF
name: CloudflareWAF
sectionorder:
- Connect
- Collect
category: Network Security
provider: Cloudflare
commonfields:
  id: CloudflareWAF
  version: -1
configuration:
- display: Server URL (e.g. https://api.cloudflare.com/client/v4/)
  name: server
  defaultvalue: https://api.cloudflare.com/client/v4/
  type: 0
  required: false
  section: Connect
- name: credentials
  display: API Token
  type: 9
  required: false
  displaypassword: API Token
  hiddenusername: true
  section: Connect
- name: global_api_key
  display: Global API Key
  type: 9
  required: false
  hiddenusername: true
  displaypassword: Global API Key
  section: Connect
- name: email
  display: Email
  type: 0
  required: false
  section: Connect
- name: account_id
  display: Account ID
  required: true
  type: 0
  additionalinfo: Account identifier.
  section: Connect
- name: zone_id
  display: Default Zone ID
  type: 0
  additionalinfo: The domain identifier. Zone ID can be override when executing commands.The domain identifier. Zone ID can be override when executing commands.
  required: false
  section: Connect
- name: proxy
  display: Use system proxy settings
  defaultvalue: 'false'
  type: 8
  additionalinfo:
  required: false
  section: Connect
- name: insecure
  display: Trust any certificate (not secure)
  defaultvalue: 'false'
  type: 8
  additionalinfo: ''
  required: false
  section: Connect
description: Cloudflare WAF integration allows customers to manage firewall rules, filters, and IP-lists. It also allows to retrieve zones list for each account.
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: The rule action.
      name: action
      predefined:
      - block
      - challenge
      - js_challenge
      - managed_challenge
      - allow
      - log
      - bypass
      required: true
    - description: Identifier of an existing filter. Required if filter_expression is unspecified.
      name: filter_id
    - description: 'Filter expression when creating a filter for a new rule. Required if filter_id is unspecified. Expression example: "(ip.src eq 192.0.0.4) or (ip.src in $list_name)". For syntax explanations and more examples: https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/'
      name: filter_expression
    - auto: PREDEFINED
      description: 'Comma separated list of products to bypass for a request when the bypass action is used. Valid values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.'
      isArray: true
      name: products
      predefined:
      - zoneLockdown
      - uaBlock
      - bic
      - hot
      - securityLevel
      - rateLimit
      - waf
    - description: >-
        The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

        min value: 0.

        max value: 2147483647.
      name: priority
    - auto: PREDEFINED
      description: Whether this firewall rule is currently paused.
      name: paused
      predefined:
      - 'True'
      - 'False'
    - description: A description of the rule to help identify it.
      name: description
    - description: Short reference tag to quickly select related rules.
      name: ref
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: Create a new firewall rule that create new filter or use an exist filter.
    name: cloudflare-waf-firewall-rule-create
    outputs:
    - contextPath: CloudflareWAF.FirewallRule.id
      description: Firewall rule ID.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.priority
      description: The priority of the rule to allow control of processing order.
    - contextPath: CloudflareWAF.FirewallRule.action
      description: The action of the rule.
    - contextPath: CloudflareWAF.FirewallRule.products
      description: List of products to bypass for a request when the bypass action is used.
    - contextPath: CloudflareWAF.FirewallRule.paused
      description: Whether this firewall rule is currently paused.
      type: Boolean
    - contextPath: CloudflareWAF.FirewallRule.description
      description: A description of the rule to help identify it.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.ref
      description: Short reference tag to quickly select related rules.
      type: String
  - arguments:
    - description: 'Firewall Rule identifier. '
      name: id
      required: true
    - auto: PREDEFINED
      description: The exist rule action or the new rule action to set.
      name: action
      predefined:
      - block
      - challenge
      - js_challenge
      - managed_challenge
      - allow
      - log
      - bypass
      required: true
    - description: The ID of the exist rule filter or the ID of the new filter to set.
      name: filter_id
      required: true
    - auto: PREDEFINED
      description: 'List of products to bypass for a request when the bypass action is used (comma separated list). Valid values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.'
      isArray: true
      name: products
      predefined:
      - zoneLockdown
      - uaBlock
      - bic
      - hot
      - securityLevel
      - rateLimit
      - waf
    - description: >-
        The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

        min value: 0.

        max value: 2147483647.
      name: priority
    - auto: PREDEFINED
      description: Whether this firewall rule is currently paused.
      name: paused
      predefined:
      - 'true'
      - 'false'
    - description: A description of the rule to help identify it.
      name: description
    - description: Short reference tag to quickly select related rules.
      name: ref
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: Update firewall rule by the specified rule ID. Can update rule action, paused, description, priority, products and ref. Can not update or delete rule filter, ONLY add a new filter.
    name: cloudflare-waf-firewall-rule-update
    outputs: []
  - arguments:
    - description: 'Firewall Rule identifier. '
      name: id
      required: true
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: Delete firewall rule by the specified rule ID.
    name: cloudflare-waf-firewall-rule-delete
    outputs: []
  - arguments:
    - description: 'Firewall Rule identifier. '
      name: id
    - auto: PREDEFINED
      description: The rule action.
      name: action
      predefined:
      - block
      - challenge
      - js_challenge
      - managed_challenge
      - allow
      - log
      - bypass
    - auto: PREDEFINED
      description: Whether this firewall rule is currently paused.
      name: paused
      predefined:
      - 'true'
      - 'false'
    - description: A description of the rule to help identify it.
      name: description
    - description: |-
        Page number of paginated results.
        min value: 1.
      name: page
    - description: 'Number of firewall rules per page. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: page_size
    - defaultValue: 50
      description: 'The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: limit
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: List of firewall rules or details of individual rule by ID.
    name: cloudflare-waf-firewall-rule-list
    outputs:
    - contextPath: CloudflareWAF.FirewallRule.id
      description: 'Firewall Rule identifier. '
      type: String
    - contextPath: CloudflareWAF.FirewallRule.action
      description: The rule action.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.paused
      description: Whether this firewall rule is currently paused.
      type: Boolean
    - contextPath: CloudflareWAF.FirewallRule.description
      description: Rule description.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.Filter.id
      description: Rule filter id.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.Filter.expression
      description: Rule filter expression.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.Filter.paused
      description: Whether this rule filter is currently paused.
      type: Boolean
    - contextPath: CloudflareWAF.FirewallRule.Filter.description
      description: Description of the rule filter.
      type: String
    - contextPath: CloudflareWAF.FirewallRule.Filter.ref
      description: Short reference tag.
      type: String
  - arguments:
    - description: 'The filter expression to be used. Expression example: "(ip.src eq 192.0.0.4) or (ip.src in $list_name)". For syntax explanations and more examples: https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/'
      name: expression
      required: true
    - description: Short reference tag to quickly select related rules.
      name: ref
    - auto: PREDEFINED
      description: Whether this filter is currently paused.
      name: paused
      predefined:
      - 'true'
      - 'false'
    - description: A note that you can use to describe the purpose of the filter.
      name: description
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: Create a new filter which can be added to a firewall rule.
    name: cloudflare-waf-filter-create
    outputs:
    - contextPath: CloudflareWAF.Filter.id
      description: Filter identifier.
      type: String
    - contextPath: CloudflareWAF.Filter.expression
      description: The filter expression to be used.
      type: String
    - contextPath: CloudflareWAF.Filter.paused
      description: Whether this filter is currently paused.
      type: Boolean
    - contextPath: CloudflareWAF.Filter.description
      description: A note that describe the purpose of the filter.
      type: String
    - contextPath: CloudflareWAF.Filter.ref
      description: Short reference tag to quickly select related rules.
      type: String
  - arguments:
    - name: id
      description: 'Filter identifier.  '
      required: true
      defaultValue: ''
      predefined:
      - ''
    - description: 'The filter expression to be used. Expression example: "(ip.src eq 192.0.0.4) or (ip.src in $list_name)". For syntax explanations and more examples: https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/'
      name: expression
      required: true
    - description: Short reference tag to quickly select related rules.
      name: ref
    - auto: PREDEFINED
      description: Whether this filter is currently paused.
      name: paused
      predefined:
      - 'true'
      - 'false'
    - description: A note that you can use to describe the purpose of the filter.
      name: description
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: Update filter by the specified filter ID.
    name: cloudflare-waf-filter-update
    outputs: []
  - arguments:
    - description: The filter ID.
      name: filter_id
      required: true
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: Delete an exist filter (Note that a filter linked to firewall rule cannot be deleted).
    name: cloudflare-waf-filter-delete
    outputs: []
  - arguments:
    - description: 'Filter identifier. '
      name: id
    - description: The filter expression to be used.
      name: expression
    - description: Short reference tag to quickly select related rules.
      name: ref
    - auto: PREDEFINED
      description: Whether this filter is currently paused.
      name: paused
      predefined:
      - 'true'
      - 'false'
    - description: A note that you can use to describe the purpose of the filter.
      name: description
    - description: |-
        Page number of paginated results.
        min value: 1.
      name: page
    - description: >-
        Number of filter based firewall rules per page. The argument accepts
        values ​​divided by 5.

        Minimum value 5.

        Maximum value 100.

        For example: 5,10,15.
      name: page_size
    - defaultValue: 50
      description: 'The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: limit
    - description: Zone identifier. The initialization will override the value set in the instance. Zone ID field is required for this command.
      name: zone_id
    description: List filters.
    name: cloudflare-waf-filter-list
    outputs:
    - contextPath: CloudflareWAF.Filter.id
      description: 'Filter identifier. '
      type: String
    - contextPath: CloudflareWAF.Filter.expression
      description: The filter expression.
      type: String
    - contextPath: CloudflareWAF.Filter.description
      description: Description of the filter purpose.
      type: String
    - contextPath: CloudflareWAF.Filter.paused
      description: Whether this filter is currently paused.
      type: Boolean
    - contextPath: CloudflareWAF.Filter.ref
      description: Short reference tag.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: all
      description: Whether to match all search requirements or at least one (any).
      name: match
      predefined:
      - any
      - all
    - description: A domain name.
      name: name
    - description: Account name.
      name: account_name
    - description: Account identifier tag.
      name: account_id
    - auto: PREDEFINED
      description: Status of the zone.
      name: status
      predefined:
      - active
      - pending
      - initializing
      - moved
      - deleted
      - deactivated
      - read only
    - auto: PREDEFINED
      description: Field to order zones by.
      name: order
      predefined:
      - name
      - status
      - account.id
      - account.name
    - auto: PREDEFINED
      description: Direction to order zones.
      name: direction
      predefined:
      - asc
      - desc
    - description: 'Page number of paginated results. Default value: 1, min value: 1.'
      name: page
    - description: >-
        Number of zones per page. The argument accepts values ​​divided by
        5.

        Minimum value 5.

        Maximum value 100.

        For example: 5,10,15.
      name: page_size
    - defaultValue: 50
      description: 'The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: limit
    description: List all account zones.
    name: cloudflare-waf-zone-list
    outputs:
    - contextPath: CloudflareWAF.Zone.success
      description: The status of the request (true or false).
      type: Boolean
    - contextPath: CloudflareWAF.Zone.id
      description: 'The zone ID. '
      type: String
    - contextPath: CloudflareWAF.Zone.name
      description: A domain name.
      type: String
    - contextPath: CloudflareWAF.Zone.development_mode
      description: Development mode.
      type: Integer
    - contextPath: CloudflareWAF.Zone.original_name_servers
      description: Original name servers.
      type: Data
    - contextPath: CloudflareWAF.Zone.original_registrar
      description: Original registrar.
      type: String
    - contextPath: CloudflareWAF.Zone.original_dnshost
      description: Original DNS host.
      type: String
    - contextPath: CloudflareWAF.Zone.created_on
      description: Zone created date.
      type: Date
    - contextPath: CloudflareWAF.Zone.modified_on
      description: Zone modified date.
      type: Date
    - contextPath: CloudflareWAF.Zone.activated_on
      description: Zone activated date.
      type: Date
    - contextPath: CloudflareWAF.Zone.status
      description: Status of the zone.
      type: String
    - contextPath: CloudflareWAF.Zone.paused
      description: Whether this zone is currently paused.
      type: Boolean
    - contextPath: CloudflareWAF.Zone.type
      description: Short reference tag.
      type: String
    - contextPath: CloudflareWAF.Zone.permissions
      description: List of zone permissions.
      type: Data
    - contextPath: CloudflareWAF.Zone.Account
      description: Account details.
      type: Data
    - contextPath: CloudflareWAF.Zone.owner
      description: The zone owner details.
      type: Data
    - contextPath: CloudflareWAF.Zone.name_servers
      description: Zone servers names.
      type: Data
  - arguments:
    - description: The name of the list (used in filter expressions).
      name: name
      required: true
    - description: A note that can be used to annotate the List.
      name: description
    description: Create a new IP-list. An IP-list is a list that includes IP addresses and CIDR. IP-list is used in the filter expression.
    name: cloudflare-waf-ip-list-create
    outputs:
    - contextPath: CloudflareWAF.IpList.id
      description: 'The list ID. '
      type: String
    - contextPath: CloudflareWAF.IpList.name
      description: The name of the list.
      type: String
    - contextPath: CloudflareWAF.IpList.description
      description: A note that annotate the List.
      type: String
    - contextPath: CloudflareWAF.IpList.kind
      description: The kind of values in the List.
      type: String
    - contextPath: CloudflareWAF.IpList.num_items
      description: Number of list items.
      type: Integer
    - contextPath: CloudflareWAF.IpList.num_referencing_filters
      description: Number of referencing filters to the list.
      type: Integer
    - contextPath: CloudflareWAF.IpList.created_on
      description: List created date.
      type: Date
    - contextPath: CloudflareWAF.IpList.modified_on
      description: List modified date.
      type: Date
  - arguments:
    - description: 'The list ID. '
      name: id
      required: true
    description: Delete IP-list by the specified list ID. Note that IP-list that assigned to a firewall rule can not be delete, only after unassign the list.
    name: cloudflare-waf-ip-list-delete
    outputs: []
  - arguments:
    - description: Retrieve details for an individual list Id.
      name: id
    - description: |-
        Page number of paginated results.
        Default value: 1, min value: 1.
      name: page
    - description: 'Number of IP-list per page. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: page_size
    - defaultValue: 50
      description: 'The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: limit
    description: List IP-lists.
    name: cloudflare-waf-ip-lists-list
    outputs:
    - contextPath: CloudflareWAF.IpList.id
      description: 'The list ID. '
      type: String
    - contextPath: CloudflareWAF.IpList.name
      description: The list name.
      type: String
    - contextPath: CloudflareWAF.IpList.description
      description: List description.
      type: String
    - contextPath: CloudflareWAF.IpList.kind
      description: List kind (ip\redirect).
      type: String
    - contextPath: CloudflareWAF.IpList.num_items
      description: Number of list items.
    - contextPath: CloudflareWAF.IpList.num_referencing_filters
      description: Number of referencing filters to the list.
  - arguments:
    - name: list_id
      description: The ID of the list to insert the new items.
      required: true
      defaultValue: ''
      predefined:
      - ''
    - description: The new items to be added (comma separated IP addresses).
      isArray: true
      name: items
      required: true
    - auto: PREDEFINED
      defaultValue: true
      description: Use Cortex XSOAR built-in polling to retrieve the result when it's ready. Default is False.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.
      name: interval
    - defaultValue: '60'
      description: Indicates the time in seconds until the polling sequence timeouts. Default is 60.
      name: timeout
    - description: The ID of the pipeline run to retrieve when polling argument is true. Intended for use by the Polling process and does not need to be provided by the user.
      name: operation_id
      deprecated: true
    description: 'Create new items for exist IP-list. '
    name: cloudflare-waf-ip-list-item-create
    outputs: []
    polling: true
    compliantpolicies:
    - IP Blockage
  - arguments:
    - description: The list ID.
      name: list_id
      required: true
    - description: The new items.
      name: items
      required: true
    - auto: PREDEFINED
      defaultValue: true
      description: Use Cortex XSOAR built-in polling to retrieve the result when it's ready. Default is False.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.
      name: interval
    - defaultValue: '60'
      description: Indicates the time in seconds until the polling sequence timeouts. Default is 60.
      name: timeout
    - description: The ID of the pipeline run to retrieve when polling argument is true. Intended for use by the Polling process and does not need to be provided by the user.
      name: operation_id
      deprecated: true
    description: Replace the IP-list items with a new items.
    name: cloudflare-waf-ip-list-item-update
    outputs: []
    polling: true
  - arguments:
    - description: The list ID.
      name: list_id
      required: true
    - description: The items ID to be delete.
      name: items_id
      required: true
    - auto: PREDEFINED
      defaultValue: true
      description: Use Cortex XSOAR built-in polling to retrieve the result when it's ready. Default is False.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.
      name: interval
    - defaultValue: '60'
      description: Indicates the time in seconds until the polling sequence timeouts. Default is 60.
      name: timeout
    - description: The ID of the pipeline run to retrieve when polling argument is true. Intended for use by the Polling process and does not need to be provided by the user.
      name: operation_id
      deprecated: true
    description: Delete item of a IP-list by the specified list ID and list item.
    name: cloudflare-waf-ip-list-item-delete
    outputs: []
    polling: true
  - arguments:
    - description: The list ID.
      name: list_id
      required: true
    - description: Retrieve details for an individual item ID. Note that the item_id field can only be provided if item_ip is not provided and vice versa.
      name: item_id
    - description: Retrieve details for an individual item IP. Note that the item_ip field can only be provided if item_id is not provided and vice versa.
      name: item_ip
    - description: |-
        Page number of paginated results.
        Default value: 1, min value: 1.
      name: page
    - description: 'Number of zones per page. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: page_size
    - defaultValue: 50
      description: 'The maximum number of records to retrieve. The argument accepts values ​​divided by 5. Minimum value 5. Maximum value 100. For example: 5,10,15.'
      name: limit
    description: List all items in the List or details of individual item by ID or IP. This command may take a long time, you can set the 'execution-timeout' field if necessary.
    name: cloudflare-waf-ip-list-item-list
    outputs:
    - contextPath: CloudflareWAF.IpListItem.items
      description: The list items.
      type: Unknown
    - contextPath: CloudflareWAF.IpListItem.list_id
      description: The list ID.
      type: String
  - arguments:
    - description: The Zone identifier. If provided, lists zone-level rulesets. If not provided, lists account-level rulesets. The value set in the instance configuration is used by default.
      name: zone_id
    description: The command lists all rulesets at the account or zone level.
    name: cloudflare-waf-ruleset-list
    outputs:
    - contextPath: CloudflareWAF.Ruleset.id
      description: The ruleset identifier.
      type: String
    - contextPath: CloudflareWAF.Ruleset.name
      description: The name of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.kind
      description: The kind of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.phase
      description: The phase of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.description
      description: The description of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.version
      description: The version of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.last_updated
      description: 'The timestamp of when the ruleset was last updated. For example, 2024-08-01T17:37:12.291474Z.'
      type: Date
  - arguments:
    - description: The ruleset identifier.
      name: ruleset_id
      required: true
    - description: The zone identifier. If provided, gets a zone-level ruleset. If not provided, gets an account-level ruleset. The value set in the instance configuration is used by default.
      name: zone_id
    description: The command retrieves a specific ruleset by ID, including its list of rules.
    name: cloudflare-waf-ruleset-get
    outputs:
    - contextPath: CloudflareWAF.Ruleset.id
      description: The ruleset identifier.
      type: String
    - contextPath: CloudflareWAF.Ruleset.name
      description: The name of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.kind
      description: The kind of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.phase
      description: The phase of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.description
      description: The description of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.version
      description: The version of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.last_updated
      description: 'The timestamp of when the ruleset was last updated. For example, 2024-08-01T17:37:12.291474Z.'
      type: Date
    - contextPath: CloudflareWAF.Ruleset.rules.id
      description: The rule identifier.
      type: String
    - contextPath: CloudflareWAF.Ruleset.rules.action
      description: The action to perform when the rule matches.
      type: String
    - contextPath: CloudflareWAF.Ruleset.rules.expression
      description: The filter expression for the rule.
      type: String
    - contextPath: CloudflareWAF.Ruleset.rules.description
      description: The description of the rule.
      type: String
    - contextPath: CloudflareWAF.Ruleset.rules.enabled
      description: Whether the rule is enabled.
      type: Boolean
    - contextPath: CloudflareWAF.Ruleset.rules.version
      description: The version of the rule.
      type: String
    - contextPath: CloudflareWAF.Ruleset.rules.ref
      description: The reference of the rule.
      type: String
  - arguments:
    - description: The name of the ruleset.
      name: name
      required: true
    - auto: PREDEFINED
      description: The kind of the ruleset.
      name: kind
      predefined:
      - managed
      - custom
      - root
      - zone
      required: true
    - auto: PREDEFINED
      description: The phase of the ruleset.
      name: phase
      predefined:
      - ddos_l4
      - ddos_l7
      - http_config_settings
      - http_custom_errors
      - http_log_custom_fields
      - http_ratelimit
      - http_request_cache_settings
      - http_request_dynamic_redirect
      - http_request_firewall_custom
      - http_request_firewall_managed
      - http_request_late_transform
      - http_request_origin
      - http_request_redirect
      - http_request_sanitize
      - http_request_sbfm
      - http_request_transform
      - http_response_compression
      - http_response_firewall_managed
      - http_response_headers_transform
      - magic_transit
      required: true
    - description: The description of the ruleset.
      name: description
    - description: 'The JSON array of rule objects to include in the ruleset. For example: [{"action": "block", "expression": "(ip.src eq 192.0.2.1)", "description": "Block bad IP"}].'
      name: rules
    - description: The Zone identifier. If provided, creates a zone-level ruleset. If not provided, creates an account-level ruleset. The value set in the instance configuration is used by default.
      name: zone_id
    description: The command creates a new ruleset at the account or zone level.
    name: cloudflare-waf-ruleset-create
    outputs:
    - contextPath: CloudflareWAF.Ruleset.id
      description: The ruleset identifier.
      type: String
    - contextPath: CloudflareWAF.Ruleset.name
      description: The name of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.kind
      description: The kind of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.phase
      description: The phase of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.description
      description: The description of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.version
      description: The version of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.last_updated
      description: 'The timestamp of when the ruleset was last updated. For example, 2024-08-01T17:37:12.291474Z.'
      type: Date
  - arguments:
    - description: The ruleset identifier.
      name: ruleset_id
      required: true
    - description: The name of the ruleset.
      name: name
    - description: The description of the ruleset.
      name: description
    - description: 'The JSON array of rule objects to set in the ruleset. This replaces all existing rules. For example: [{"action": "block", "expression": "(ip.src eq 192.0.2.1)", "description": "Block bad IP"}].'
      name: rules
    - description: The Zone identifier. If provided, updates a zone-level ruleset. If not provided, updates an account-level ruleset. The value set in the instance configuration is used by default.
      name: zone_id
    description: The command updates an existing ruleset by ID. Note that this replaces the entire ruleset configuration.
    name: cloudflare-waf-ruleset-update
    outputs:
    - contextPath: CloudflareWAF.Ruleset.id
      description: The ruleset identifier.
      type: String
    - contextPath: CloudflareWAF.Ruleset.name
      description: The name of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.kind
      description: The kind of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.phase
      description: The phase of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.description
      description: The description of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.version
      description: The version of the ruleset.
      type: String
    - contextPath: CloudflareWAF.Ruleset.last_updated
      description: 'The timestamp of when the ruleset was last updated. For example, 2024-08-01T17:37:12.291474Z.'
      type: Date
  - arguments:
    - description: The ruleset identifier.
      name: ruleset_id
      required: true
    - description: The Zone identifier. If provided, deletes a zone-level ruleset. If not provided, deletes an account-level ruleset. The value set in the instance configuration is used by default.
      name: zone_id
    description: The command deletes a ruleset by ID.
    name: cloudflare-waf-ruleset-delete
    outputs: []
  dockerimage: demisto/python3:3.12.13.10404775
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.2.0
tests:
- No tests (auto formatted)