Cloudflare Trace で Proxy リクエストの一生を可視化

<img width="500" alt="Screenshot 2023-10-01 at 17.41.45.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/f686df1c-01e2-9a54-0005-dea5d3664bad.png">

ダッシュボードに [Cloudflare Trace（Beta）](https://developers.cloudflare.com/fundamentals/basic-tasks/trace-request/)とあったので、試してみます。

[Blog 記事](https://blog.cloudflare.com/traffic-transparency-unleashing-cloudflare-trace/)がありました。
記事にあるように、13年にわたりこれまで何人ものお客様や Cloudflare 従業員がチャレンジしてきた `The life of a Cloudflare request`の可視化 … いくら素晴らしい絵を書いても、Cloudflare のプロダクトが早い進化ですぐ陳腐化してしまうのが課題でした。
Cloudflare サポートチームの意見を取り入れたこのプロダクトは、ダッシュボードでそれを実現する第一歩となる気がします。

具体的には、あるリクエストに対して、Cloudflare Proxy の [Ruleset](https://developers.cloudflare.com/ruleset-engine/) でどんな処理が行われるのかトレースできます。設定が期待通りに動いているか自分で確認できます（サポートやコミュニティに問い合わせる前に）。

なお、[API](https://developers.cloudflare.com/api/operations/account-request-tracer-request-trace) では以前から使えてました。利用例は[こちら](https://qiita.com/khayama/items/b7bba2c5bba006643479#request-trace-api-%E3%81%AB%E3%82%88%E3%82%8B%E6%A4%9C%E8%A8%BC)が参考になります。

## 実行
Trace したい宛先と付与したい情報をいれてリクエストを発行します。
- 今回はお試しのため、一個のリクエストが全部のルールにマッチするようにしました（ので、無理やり感ありますが、ご容赦ください）。
- Security の Rule で Block にマッチすると Trace が止まりましたが、Challenge の場合は Skip Challenge を On にすることで、次に進むことができました。
- 付与する情報の例として、Rule にマッチ・アンマッチするような任意のヘッダーを追加する、 Geo を指定する、などがあります。

<img width="500" alt="Screenshot 2023-10-01 at 17.45.21.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/669bc7c6-2989-204a-a288-942904efc166.png">

<img width="500" alt="Screenshot 2023-10-01 at 17.45.35.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/5f997f29-738e-0846-83d7-2cc382155a7c.png">

## 結果
リクエストがそのフェーズの条件にマッチすれば、左端が緑の Matchded となりました。
右端の ▼ をクリックすると、どの ruleset（と、そのなかの rule ）にリクエストがマッチしたのかがドリルダウンできました。
<img width="500" alt="Screenshot 2023-10-01 at 17.46.42.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/873de9ac-c3c3-1dae-3c01-1e790a82239b.png">

では、TRACE START から END まで順にたどっていきます。

## [URL normalization](https://developers.cloudflare.com/rules/normalization/)
<img width="500" alt="Screenshot 2023-10-01 at 17.24.40.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/4914caf1-348c-51d0-7cd8-b60db82b10d2.png">

有効化すると、入力リクエストの URL を正規化するオプションです。
今回のリクエストは URL path に `%68` を入れたので `h` に書き換えられました。
これにより、後続フェーズの Ruleset はこの URL を h 文字列でマッチできるようになります。

### View rule detail 
View rule detail（青字）をクリックします。
詳細（ API での応答内容）が表示されます。
<img width="500" alt="Screenshot 2023-10-01 at 17.24.58.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/48bd6ebd-31d2-004b-6f45-de0379048d0c.png">

### 設定画面
Matched Rule の Name が外部リンク（青字）になっているので、クリックします。
当該 Rule の設定画面に飛び、実際の設定を確認することができます。
<img width="500" alt="Screenshot 2023-10-01 at 17.25.30.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/ee0a0248-8073-b9b6-0d03-7cbc2ec78e7a.png">

## [Transform Rules - URL Rewrites](https://developers.cloudflare.com/rules/transform/url-rewrite/)
<img width="500" alt="Screenshot 2023-10-01 at 17.54.41.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/5e7f7f68-cebf-4824-d91f-80de81554abb.png">

URL リライトということで、その名の通り URL を書き換えています。

### View rule detail
今回のリクエストに対して Path の `/tr/` が `/` に置換されるルールとなっています。
<img width="500" alt="Screenshot 2023-10-01 at 17.25.49.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/f135f2ee-edb9-fabf-f000-8051ffd95dbc.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 17.26.32.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/580f7475-0450-d861-c642-8b3176653c64.png">

## [Waiting Room](https://developers.cloudflare.com/waiting-room/)
<img width="500" alt="Screenshot 2023-10-01 at 17.26.44.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/e4d4aeeb-c772-6099-fd43-bbd18526bf43.png">

デジタル待合室で、リクエストをキューします。

### 設定画面
Hostname and Path でリクエスト URL とマッチさせています。
<img width="500" alt="Screenshot 2023-10-01 at 17.58.06.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/2513f439-00ac-1e9d-9718-97420c86a4a7.png">

## [Configuration Rules](https://developers.cloudflare.com/rules/configuration-rules/)
<img width="500" alt="Screenshot 2023-10-01 at 17.27.01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/db203598-3d84-002d-402d-6480d0ba1a46.png">

リクエスト・レスポンスに対する Proxy での動作オプションを変えれます。

### View rule detail
当該ホストに対して minify を On にしてみます。
<img width="500" alt="Screenshot 2023-10-01 at 17.27.10.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/9ba7d805-5d06-7db8-d92b-0ee353d04691.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 17.27.42.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/97074b86-6c2e-a317-80b7-cf75ba7077bf.png">

## [Origin Rules](https://developers.cloudflare.com/rules/origin-rules/)
<img width="500" alt="Screenshot 2023-10-01 at 17.27.57.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/6cde141f-ccdc-b087-8242-a2dc23de5dc2.png">

オリジンサーバーに接続すときのルールを定義できます。

### View rule detail
オリジンサーバーに接続する Host ヘッダーを入力リクエストから別の名前に置換しています。

<img width="500" alt="Screenshot 2023-10-01 at 17.28.05.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/2c990043-2932-368a-9326-d8fb59d0d410.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 20.23.57.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/487182fd-ca25-8d4b-d973-7b89a0073972.png">

## [File Upload Scan](https://developers.cloudflare.com/waf/about/content-scanning/)
<img width="500" alt="Screenshot 2023-10-01 at 17.28.38.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/2e8445a5-3622-80c1-91ef-d49bf23850f6.png">

アップロードしたファイルに対するスキャンです。
現時点では Enterprise plan の特定のお客様に提供される機能です。

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 18.08.17.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/2421a292-da97-198e-d82c-6f7ea30529ea.png">

## [WAF Custom Rules](https://developers.cloudflare.com/waf/custom-rules/)
<img width="500" alt="Screenshot 2023-10-01 at 17.28.51.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/2fb8b52b-7ee4-69e5-8a7d-8d18b82e998d.png">

[Rules Language](https://developers.cloudflare.com/ruleset-engine/rules-language/) で expression とそれに対する action を定義し、自分自身の WAF ルールを作ることができます。

### View rule detail
WAF の [Machine Learning Score](https://blog.cloudflare.com/waf-ml/) 40 以下にマッチさせいます。 
<img width="500" alt="Screenshot 2023-10-01 at 17.29.02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/35994d37-9439-4384-9d7e-8dfaa8b763be.png">

### 設定画面

<img width="500" alt="Screenshot 2023-10-01 at 18.11.11.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/028d06a5-6338-1ca4-9890-e2cb91ee3a6f.png">

## [Rate Limiting Rules](https://developers.cloudflare.com/waf/rate-limiting-rules/)
<img width="500" alt="Screenshot 2023-10-01 at 17.29.48.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/0bcb1be7-8a71-82ec-1d16-2d1e360824de.png">

オリジンサーバーに対するリクエストレート制限を行います。
リクエストレートのカウントや制限を送信元 IP に頼らないなど、柔軟な設定ができます。

### View rule detail
<img width="500" alt="Screenshot 2023-10-01 at 17.29.56.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/d5bc6f96-d886-06eb-5605-1aea34cc80ae.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 20.36.11.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/ea0a3821-41fb-61e0-6cc9-862fe0dbb6a4.png">


## [API Shield](https://developers.cloudflare.com/api-shield/)
<img width="500" alt="Screenshot 2023-10-01 at 17.32.05.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/9f9be6b5-82f7-988b-d8c4-8c80f5e4885e.png">

API エンドポイントに対する保護を提供します。
下の例では API からのレスポンスにクレジットカード情報がレスポンスに含まれているのを検知し、警告しています（Sensitive Data Detection ）。
<img width="500" alt="Screenshot 2023-10-02 at 12.27.28.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/c84a9451-8816-dd71-6e95-a71befcf489b.png">

### 設定画面
当該 Path に [Schema Validation](https://developers.cloudflare.com/api-shield/security/schema-validation/) を定義しています。
<img width="500" alt="Screenshot 2023-10-02 at 12.23.53.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/cf864d1e-42d9-5776-5fa8-48b1eea63ba0.png">

## [WAF Managed Rules](https://developers.cloudflare.com/waf/managed-rules/)
<img width="500" alt="Screenshot 2023-10-02 at 10.46.39.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/b1d9f818-c3e0-4313-993e-7eb46b778be3.png">

Cloudflare が管理する WAF のルールです。

### View rule detail
複数の Rule にマッチしていますが、たとえばこの様な内容です。
<img width="500" alt="Screenshot 2023-10-02 at 17.08.36.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/8eca2604-67df-d6bd-6a90-df8939eaf6ce.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-02 at 17.11.24.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/ba381d10-1404-14b5-97ea-77ea08716f68.png">


## [Super Bot Fight Mode](https://blog.cloudflare.com/super-bot-fight-mode/)
今回は [Bot Management](https://developers.cloudflare.com/bots/) を有効にしている Zone なので、 Super Bot Fight Mode は無効になっています。

## [Request Managed Headers](https://developers.cloudflare.com/rules/transform/managed-transforms/reference/#http-request-headers)
<img width="500" alt="Screenshot 2023-10-01 at 17.32.41.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/0d542117-5659-d76d-65b8-0e01d7e03ee8.png">

予め定義された Cloudflare マネージドの Request Header 変更をリクエストに適用します。

### 設定画面
リクエストに関する bot 関連の情報をヘッダーでオリジンに提供しています。
<img width="500" alt="Screenshot 2023-10-01 at 20.42.18.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/145fea15-5d3d-6472-c75c-b0ffd60efb24.png">


## [Transform Rules - HTTP Request Headers](https://developers.cloudflare.com/rules/transform/request-header-modification/)
リクエストヘッダーの書き換えを実施します。

### View rule detail
user-agent を置換しています。
<img width="500" alt="Screenshot 2023-10-01 at 17.32.49.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/428b81e7-2c60-75df-16d4-eac1f6013823.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 20.47.27.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/05b1330a-3bfa-822b-511f-862050bfd204.png">

## [Cache Rules](https://developers.cloudflare.com/cache/how-to/cache-rules/)
<img width="500" alt="Screenshot 2023-10-01 at 17.33.02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/bda8d7a6-44cb-95f1-9401-f43fce3ec873.png">

Cache に関する設定を行います。

### View rule detail
Edge Cache TTL を上書きするよう指示しています。
<img width="500" alt="Screenshot 2023-10-01 at 17.33.08.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/687899a1-6f73-1322-6eb8-dfe8ffbcead0.png">

### 設定画面
<img width="500" alt="Screenshot 2023-10-01 at 17.33.27.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/7f9b98f9-c4f3-5544-dddd-52bfaa815c48.png">

## [Response Managed Headers](https://developers.cloudflare.com/rules/transform/managed-transforms/reference/#http-response-headers)
<img width="500" alt="Screenshot 2023-10-01 at 17.33.43.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/90103a1d-6b1d-48b1-6df2-e6bdb5f1249a.png">

予め定義された Cloudflare マネージドの Response Header 変更をレスポンスに適用します。

### 設定画面
レスポンスにセキュリティ関連のヘッダーを追加しています。
<img width="500" alt="Screenshot 2023-10-01 at 20.46.39.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/2cdfd2ed-58e9-10a1-2051-e910094c9967.png">

## 補足
curl で API を叩くサンプルも表示されています。

<details><summary>出力</summary>

```json
{
  "success": true,
  "result": {
    "trace": [
      {
        "step_name": "http_request_sanitize",
        "type": "phase",
        "matched": true,
        "public_name": "URL Normalization",
        "trace": [
          {
            "step_name": "921aaf52eb104dfcb18db1149dbbcab7",
            "type": "ruleset",
            "matched": true,
            "description": "ruleset for controlling url normalization",
            "name": "Entrypoint for url normalization ruleset",
            "kind": "zone",
            "trace": [
              {
                "step_name": "989066487cd545629681f5efa152ff9e",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "id": "70339d97bdb34195bbf054b1ebe81f76",
                  "version": "latest",
                  "overrides": {
                    "rules": [
                      {
                        "id": "78723a9e0c7c4c6dbec5684cb766231d",
                        "enabled": true
                      },
                      {
                        "id": "b232b534beea4e00a21dcbb7a8a545e9",
                        "enabled": false
                      },
                      {
                        "id": "20e18610e4a048d6b87430b3cb2d89a3",
                        "enabled": false
                      },
                      {
                        "id": "60444c0705d4438799584a15cca2cb7d",
                        "enabled": false
                      }
                    ]
                  }
                },
                "expression": "true",
                "trace": [
                  {
                    "step_name": "70339d97bdb34195bbf054b1ebe81f76",
                    "type": "ruleset",
                    "matched": true,
                    "description": "Created by the Cloudflare security team, this ruleset provides normalization on the URL path",
                    "name": "Cloudflare Normalization Ruleset",
                    "kind": "managed",
                    "trace": [
                      {
                        "step_name": "78723a9e0c7c4c6dbec5684cb766231d",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "uri": {
                            "path": {
                              "expression": "normalize_url_path(raw.http.request.uri.path)"
                            },
                            "origin": false
                          }
                        },
                        "description": "Normalization on the URL path, without propagating it to the origin"
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      {
        "step_name": "http_request_transform",
        "type": "phase",
        "matched": true,
        "public_name": "Transform Rules - URL Rewrites",
        "trace": [
          {
            "step_name": "d6a7f5de8dc34ba5a562f2c1dcb82b24",
            "type": "ruleset",
            "matched": true,
            "name": "transfer ruleset",
            "kind": "zone",
            "trace": [
              {
                "step_name": "5e9987321e62450c92c8a0259cb656b4",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "uri": {
                    "path": {
                      "expression": "regex_replace(http.request.uri.path, \"^/tr/\", \"/\")"
                    }
                  }
                },
                "expression": "(starts_with(http.host, \"s3-o\"))",
                "description": "trace test"
              }
            ]
          }
        ]
      },
      {
        "step_name": "waiting_room",
        "type": "product",
        "matched": true
      },
      {
        "step_name": "http_config_settings",
        "type": "phase",
        "matched": true,
        "public_name": "Configuration Rules",
        "trace": [
          {
            "step_name": "e3112c9c198a44888ebb693e78218636",
            "type": "ruleset",
            "matched": true,
            "name": "default",
            "kind": "zone",
            "trace": [
              {
                "step_name": "76493dc8e75f478c9adeff4aca1697eb",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "automatic_https_rewrites": false,
                  "autominify": {
                    "html": false,
                    "css": false,
                    "js": true
                  }
                },
                "expression": "(starts_with(http.host, \"s3-o\"))",
                "description": "trace test"
              }
            ]
          }
        ]
      },
      {
        "step_name": "http_request_origin",
        "type": "phase",
        "matched": true,
        "public_name": "Origin Rules",
        "trace": [
          {
            "step_name": "07c0e14bc5a54188a2684bac8e0eadb2",
            "type": "ruleset",
            "matched": true,
            "name": "default",
            "kind": "zone",
            "trace": [
              {
                "step_name": "1c214943e4ce46979cb1a6408ea3fe5d",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "host_header": "s3-o.s3.ap-northeast-1.amazonaws.com"
                },
                "expression": "(starts_with(http.host, \"s3-o\"))",
                "description": "s3-o Host override"
              }
            ]
          }
        ]
      },
      {
        "step_name": "file_upload_scan",
        "type": "product",
        "matched": true
      },
      {
        "step_name": "http_request_firewall_custom",
        "type": "phase",
        "matched": true,
        "public_name": "WAF Custom Rules",
        "trace": [
          {
            "step_name": "7d0b838c24a24a7b8d3e7b046db9e7bd",
            "type": "ruleset",
            "matched": true,
            "name": "default",
            "kind": "zone",
            "trace": [
              {
                "step_name": "40ee6e0959ca4ca6bb5ee3716414886c",
                "type": "rule",
                "matched": true,
                "expression": "cf.waf.ml.score le 40\n",
                "description": "WAFML Test"
              },
              {
                "step_name": "f988f2a562744036ba284374256b9507",
                "type": "rule",
                "matched": true,
                "expression": "(http.host eq \"s3-o.oyama.cf\")",
                "description": "trace test"
              }
            ]
          }
        ]
      },
      {
        "step_name": "http_ratelimit",
        "type": "phase",
        "matched": true,
        "public_name": "Rate Limiting Rules",
        "trace": [
          {
            "step_name": "6ab99a1a40c543598a9606cbac5c5a73",
            "type": "ruleset",
            "matched": true,
            "name": "default",
            "kind": "zone",
            "trace": [
              {
                "step_name": "698bde60fa6e4447b15750cfd4b2bc48",
                "type": "rule",
                "matched": true,
                "expression": "(http.host eq \"s3-o.oyama.cf\")",
                "description": "trace test"
              }
            ]
          }
        ]
      },
      {
        "step_name": "api_shield",
        "type": "product",
        "matched": true
      },
      {
        "step_name": "http_request_firewall_managed",
        "type": "phase",
        "matched": true,
        "public_name": "WAF Managed Rules",
        "trace": [
          {
            "step_name": "0fea3f5a773d4202baeb89c705a2e74a",
            "type": "ruleset",
            "matched": false,
            "name": "root",
            "kind": "root"
          },
          {
            "step_name": "3c28d3a62c9d4016b29d6d059dad9afc",
            "type": "ruleset",
            "matched": true,
            "name": "default",
            "kind": "zone",
            "trace": [
              {
                "step_name": "641f6b64ee1a4003b1bcdee81a9e823f",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "id": "c2e184081120413c86c3ab7e14069605",
                  "version": "latest",
                  "overrides": {
                    "action": "block"
                  },
                  "matched_data": {
                    "public_key": "pgjfQqjuZenvYduM9/olKGjAIlZPH187Ddnw3RZ28xw="
                  }
                },
                "expression": "true",
                "description": "zone",
                "trace": [
                  {
                    "step_name": "c2e184081120413c86c3ab7e14069605",
                    "type": "ruleset",
                    "matched": false,
                    "description": "Exposed credentials check rules",
                    "name": "Cloudflare Exposed Credentials Check Ruleset",
                    "kind": "managed"
                  }
                ]
              },
              {
                "step_name": "de2be07400384f58841dee5400adc4bd",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "id": "efb7b8c949ac4650a09736fc376e9aee",
                  "version": "latest",
                  "overrides": {
                    "action": "managed_challenge",
                    "enabled": true
                  },
                  "matched_data": {
                    "public_key": "pgjfQqjuZenvYduM9/olKGjAIlZPH187Ddnw3RZ28xw="
                  }
                },
                "expression": "true",
                "description": "zone",
                "trace": [
                  {
                    "step_name": "efb7b8c949ac4650a09736fc376e9aee",
                    "type": "ruleset",
                    "matched": true,
                    "description": "Created by the Cloudflare security team, this ruleset is designed to provide fast and effective protection for all your applications. It is frequently updated to cover new vulnerabilities and reduce false positives.",
                    "name": "Cloudflare Managed Ruleset",
                    "kind": "managed",
                    "trace": [
                      {
                        "step_name": "1c3d3022129c48e9bb52e953fe8ceb2f",
                        "type": "rule",
                        "matched": true,
                        "description": "Anomaly:URL:Query String - Multiple Slashes, Relative Paths, CR, LF or NULL"
                      }
                    ]
                  }
                ]
              },
              {
                "step_name": "9ec7b4004fd3467c8837ec858abca029",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "id": "4814384a9e5d4991b9815dcfc25d2f1f",
                  "version": "latest",
                  "overrides": {
                    "categories": [
                      {
                        "category": "paranoia-level-4",
                        "enabled": false
                      }
                    ],
                    "rules": [
                      {
                        "id": "6179ae15870a4bb7b2d480d4843b323c",
                        "action": "managed_challenge",
                        "score_threshold": 25
                      }
                    ]
                  },
                  "matched_data": {
                    "public_key": "pgjfQqjuZenvYduM9/olKGjAIlZPH187Ddnw3RZ28xw="
                  }
                },
                "expression": "true",
                "description": "zone",
                "trace": [
                  {
                    "step_name": "4814384a9e5d4991b9815dcfc25d2f1f",
                    "type": "ruleset",
                    "matched": true,
                    "description": "Cloudflare's implementation of the Open Web Application Security Project (OWASP) ModSecurity Core Rule Set. We routinely monitor for updates from OWASP based on the latest version available from the official code repository",
                    "name": "Cloudflare OWASP Core Ruleset",
                    "kind": "managed",
                    "trace": [
                      {
                        "step_name": "3500d96add324dcbbc0a93b2bd22c723",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "920270: Invalid character in request (null character)"
                      },
                      {
                        "step_name": "a882bfdf91b3440b83020de61d8cf992",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "920271: Invalid character in request (non printable characters)"
                      },
                      {
                        "step_name": "6fac9ca10e764e06a0e242791813a269",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "920272: Invalid character in request (outside of printable chars below ascii 127)"
                      },
                      {
                        "step_name": "e358b09dbfa34f3194ee6e48fc1987a9",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "941110: XSS Filter - Category 1: Script Tag Vector"
                      },
                      {
                        "step_name": "1c2c87f990e34262a0fd890fa2bdaa68",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "941160: NoScript XSS InjectionChecker: HTML Injection"
                      },
                      {
                        "step_name": "1fd9e041e6944a5c9c080d19346650ed",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "941320: Possible XSS Attack Detected - HTML Tag Handler"
                      },
                      {
                        "step_name": "5a6f5a57cde8428ab0668ce17cdec0c8",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "942370: Detects classic SQL injection probings 2/3"
                      },
                      {
                        "step_name": "f5aebedc99a14c8d9e8cfa2ce5f94216",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 3
                        },
                        "description": "942431: Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)"
                      },
                      {
                        "step_name": "edf8c37cc81747d382690b3c77e82ce4",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 3
                        },
                        "description": "942460: Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters"
                      },
                      {
                        "step_name": "3e032e0fd1d34bbeb63eb77050e2c244",
                        "type": "rule",
                        "matched": true,
                        "action_parameter": {
                          "increment": 5
                        },
                        "description": "942511: SQLi bypass attempt by ticks detected"
                      },
                      {
                        "step_name": "6179ae15870a4bb7b2d480d4843b323c",
                        "type": "rule",
                        "matched": true,
                        "description": "949110: Inbound Anomaly Score Exceeded"
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      {
        "step_name": "http_request_sbfm",
        "type": "phase",
        "matched": false,
        "public_name": "Super Bot Fight Mode",
        "trace": [
          {
            "step_name": "208412990ef24af5ae810b06cac52535",
            "type": "ruleset",
            "matched": false,
            "name": "default",
            "kind": "zone"
          }
        ]
      },
      {
        "step_name": "request_managed_headers",
        "type": "product",
        "matched": true,
        "managed_headers": [
          {
            "id": "add_bot_protection_headers",
            "enabled": true
          },
          {
            "id": "add_client_certificate_headers",
            "enabled": false
          },
          {
            "id": "add_visitor_location_headers",
            "enabled": false
          },
          {
            "id": "add_true_client_ip_headers",
            "enabled": false
          },
          {
            "id": "remove_visitor_ip_headers",
            "enabled": false
          }
        ]
      },
      {
        "step_name": "http_request_late_transform",
        "type": "phase",
        "matched": true,
        "public_name": "Transform Rules - HTTP Request Headers",
        "trace": [
          {
            "step_name": "397707921f77417082a4fbf3ca9d6c82",
            "type": "ruleset",
            "matched": true,
            "name": "header modification",
            "kind": "zone",
            "trace": [
              {
                "step_name": "7f902770c157435096e8135d2bb34548",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "headers": {
                    "user-agent": {
                      "operation": "set",
                      "value": "02F2F1C1-5C6F-410D-A08F-BD2D014FD3F4"
                    }
                  }
                },
                "expression": "(starts_with(http.host, \"s3-v\")) or (starts_with(http.host, \"s3-o\"))",
                "description": "s3-v UA override"
              }
            ]
          }
        ]
      },
      {
        "step_name": "http_request_cache_settings",
        "type": "phase",
        "matched": true,
        "public_name": "Cache Rules",
        "trace": [
          {
            "step_name": "79d47699204049d188a99c28b7f17029",
            "type": "ruleset",
            "matched": true,
            "name": "default",
            "kind": "zone",
            "trace": [
              {
                "step_name": "e37d98f1880d47e9be63150cf94bcfa1",
                "type": "rule",
                "matched": true,
                "action_parameter": {
                  "cache": true,
                  "edge_ttl": {
                    "mode": "override_origin",
                    "default": 5
                  }
                },
                "expression": "(http.host eq \"s3-o.oyama.cf\")",
                "description": "trace test"
              }
            ]
          }
        ]
      },
      {
        "step_name": "response_managed_headers",
        "type": "product",
        "matched": true,
        "managed_headers": [
          {
            "id": "remove_x-powered-by_header",
            "enabled": false
          },
          {
            "id": "add_security_headers",
            "enabled": true
          }
        ]
      }
    ],
    "status_code": 200
  }
}
```
</details>

## まとめ

<img width="500" alt="Screenshot 2023-10-01 at 17.46.59.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2218045/c25fe904-db79-eaa7-ac1e-ba894a73bb2d.png">

Beta なので、試したらフィードバックを行い、改善を期待します。
青で強調されてる feedback をクリックしましょう。
Google Form でフィードバックできるようになってました。

私も早速入れておきました。