{"resources":{"cloudflare":{"id":"cloudflare","name":"cloudflare","fields":{"account":{"name":"account","type":"\u001bcloudflare.account","title":"Cloudflare Account","desc":"Cloudflare account and its account-scoped services. Query `settings` for account-level preferences such as two-factor enforcement, `roles` and `members` for the account's access model, `one` for Zero Trust, `r2` for object storage, `workers` for deployed scripts, `tunnels` for Cloudflare Tunnel connectivity, and `liveInputs` and `videos` for Stream assets.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bcloudflare.account","title":"List available accounts","provider":"go.mondoo.com/mql/providers/cloudflare"},"apiToken":{"name":"apiToken","type":"\u001bcloudflare.apiToken","title":"Cloudflare API Token","desc":"User-scoped Cloudflare API token, used to audit programmatic access to the account. The `status` field reports whether the token is active, disabled, or expired, while `expiresOn` and `notBefore` bound its validity window. `ipIn` and `ipNotIn` capture the IP allowlist and blocklist that restrict where the token may be used, and `policies` records the grants that define what the token can do.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"apiTokens":{"name":"apiTokens","type":"\u0019\u001bcloudflare.apiToken","title":"API tokens visible to the calling user","desc":"Cloudflare API tokens are user-scoped, so this reads the tokens of the user the connecting token authenticates as. It requires a token with user-level access (the User API Tokens Read permission); an account-scoped token cannot list them and this returns empty. Account-owned tokens are listed separately, through `cloudflare.account.apiTokens`.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"corsHeaders":{"name":"corsHeaders","type":"\u001bcloudflare.corsHeaders","title":"CORS headers","desc":"Cross-Origin Resource Sharing settings applied by a Cloudflare Access application. Reports which origins, HTTP methods, and request headers are permitted on cross-origin requests, whether the browser may send credentials, and how long a browser may cache a preflight response. Auditing these settings surfaces permissive combinations (for example allowAllOrigins together with allowCredentials) that weaken the cross-origin protections around a protected application.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"dns":{"name":"dns","type":"\u001bcloudflare.dns","title":"Cloudflare DNS namespace","desc":"DNS records configured for a zone. The `records` field enumerates every record type (A, AAAA, CNAME, MX, TXT, and others) with its content, TTL, and proxy status, which is the starting point for auditing exposed hostnames, mail routing (MX and TXT-carried SPF/DMARC records), and whether traffic is proxied through Cloudflare or served DNS-only.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"ipAccessRule":{"name":"ipAccessRule","type":"\u001bcloudflare.ipAccessRule","title":"IP Access rule","desc":"Rule evaluated ahead of the WAF that matches a request by its source: a single IP, an IP range, an autonomous system number, or a country. The `mode` field carries the verdict. The dangerous value is `whitelist`: a source allowed there bypasses the WAF, rate limiting, and the zone's security level entirely, so a stale allowlist entry for an office range or a cloud provider's ASN is an unfiltered path to the origin. Rules exist at both zone and account scope, and `scopeType` reports which one a rule came from.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"loadBalancerPool":{"name":"loadBalancerPool","type":"\u001bcloudflare.loadBalancerPool","title":"Cloudflare load balancer pool","desc":"Named group of origin servers that a load balancer steers traffic to. The `origins` list gives each backend `address`, weight, and enabled state; `monitorId` and `checkRegions` describe the health checks; `minimumOrigins` is the healthy-origin floor below which the pool is considered down; `notificationEmail` receives health alerts; and `latitude`/`longitude` position the pool for proximity steering. Pools are account-scoped and may be shared by several load balancers.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"logExplorerDataset":{"name":"logExplorerDataset","type":"\u001bcloudflare.logExplorerDataset","title":"Cloudflare Log Explorer dataset","desc":"A log stream Log Explorer retains so it can be queried after the fact. `dataset` names the stream, such as `http_requests`, and `objectType` reports whether the dataset is scoped to the whole account or to a single zone, with `objectId` naming that account or zone. `enabled` reports whether the dataset is still ingesting, and `deletionProtection` whether it is guarded against removal, which is what keeps retained logs available while an investigation is open. `filter` carries the expression limiting which entries are kept.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"mtlsCertificate":{"name":"mtlsCertificate","type":"\u001bcloudflare.mtlsCertificate","title":"Cloudflare mTLS certificate","desc":"CA certificate uploaded to a Cloudflare account for mutual TLS authentication, where Cloudflare validates the client certificate a connecting device presents against the CA on file. Reviewing these certificates surfaces which certificate authorities are trusted for client authentication, whether any are self-signed (the ca flag), and when each expires so an mTLS enforcement gap can be caught before the certificate lapses.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"notificationPolicy":{"name":"notificationPolicy","type":"\u001bcloudflare.notificationPolicy","title":"Cloudflare notification policy","desc":"Single notification (alert) policy configured on a Cloudflare account: which `alertType` it subscribes to (for example `dedicated_ssl_certificate_expiration_type`, `universal_ssl_event_type`, `web_analytics_metrics_update`, `dos_attack_l7`), whether it is `enabled`, how alerts are delivered via `mechanisms` (email, PagerDuty, webhook integrations), and any `conditions` or `filters` that narrow the firing criteria. Query it to assert that critical alerts (TLS expiry, DDoS, mTLS revocation, configuration changes) are wired up to an active destination.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"one":{"name":"one","type":"\u001bcloudflare.one","title":"Cloudflare One (Zero Trust) namespace","desc":"Zero Trust configuration for a Cloudflare account, spanning Access, Gateway, and device enrollment. `apps` covers Access application settings (allowed IdPs, session duration, cookie security); `identityProviders` the configured IdPs and their SAML/SCIM settings; `accessPolicies` and `accessGroups` the reusable policy components; `serviceTokens` the machine-to-machine token inventory; `organization` org-wide settings such as auth domain and WARP session duration; `gatewayRules` the DNS/HTTP/L4 traffic policies; `lists`, `locations`, and `dlpProfiles` the Gateway data sources; `devices` the enrolled device inventory; and `devicePostureRules` and `devicePostureIntegrations` the posture-check configuration.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"pages":{"name":"pages","type":"\u001bcloudflare.pages","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"r2":{"name":"r2","type":"\u001bcloudflare.r2","title":"Cloudflare R2 namespace","desc":"Object-storage resources for a Cloudflare account. The buckets field enumerates every R2 bucket, which is the starting point for auditing where account data is stored and which buckets serve objects publicly, whether over the managed r2.dev subdomain or a custom domain.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"streams":{"name":"streams","type":"\u001bcloudflare.streams","title":"Cloudflare Stream namespace","desc":"Grouping for Cloudflare Stream assets, the managed video platform that serves live-streaming inputs alongside uploaded or recorded video-on-demand files. Live inputs are modeled as cloudflare.streams.liveInput and video assets as cloudflare.streams.video, both enumerated from the account.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"tunnel":{"name":"tunnel","type":"\u001bcloudflare.tunnel","title":"Cloudflare tunnel","desc":"Cloudflare Tunnel connecting origin services to Cloudflare's edge over an outbound-only connector, so private applications can be reached without opening inbound firewall ports. Auditing tunnels surfaces their operational health, whether their configuration is managed remotely from the Zero Trust dashboard, and the active connector connections carrying traffic. The `tunnelType` field distinguishes a cloudflared tunnel (cfd_tunnel) from a WARP connector (warp_connector).","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"turnstile":{"name":"turnstile","type":"\u001bcloudflare.turnstile","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"workers":{"name":"workers","type":"\u001bcloudflare.workers","title":"Cloudflare Workers namespace","desc":"Serverless Workers scripts and Pages projects for an account. Query `workers` for script metadata (size, placement mode, LogPush status), `pages` for Pages deployment details (environment, URL, aliases), `secrets` for the inventory of secrets bound to worker scripts (metadata only, values are never exposed), and `pageEnvVars` for the inventory of environment variables across Pages project environments.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"zone":{"name":"zone","type":"\u001bcloudflare.zone","title":"Cloudflare DNS Zone","desc":"Configuration and security posture of a single Cloudflare DNS zone. A zone corresponds to a registered domain managed through Cloudflare. Query `settings` for TLS, WAF, and HSTS enforcement; `dns` for DNS records; `rulesets` and `wafRules` for firewall policy; `certificatePacks` and `customCertificates` for TLS certificates; `dnssec` for DNSSEC configuration; `botManagement` for bot-mitigation settings; `emailRouting` for SPF/DKIM/DMARC status; and `logpushJobs` for data-export configuration.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"zones":{"name":"zones","type":"\u0019\u001bcloudflare.zone","title":"List all zones","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare","desc":"Cloudflare zones, accounts, API tokens, and account-level services. The `zones` field enumerates DNS zones, `accounts` exposes account-level configuration, and `apiTokens` lists the tokens visible to the calling user for token inventory and policy audits.","min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare","root":true},"cloudflare.account":{"id":"cloudflare.account","name":"cloudflare.account","fields":{"apiTokens":{"name":"apiTokens","type":"\u0019\u001bcloudflare.apiToken","title":"Account-owned API tokens","desc":"Tokens owned by the account rather than by a user, which is where long-lived automation credentials live. Each reports its validity window (`notBefore`, `expiresOn`), the IP allowlist and blocklist restricting where it may be used (`ipIn`, `ipNotIn`), when it was last used (`lastUsedOn`), and the grants that define its reach (`policies`). Token secrets are never returned by the API and are not exposed.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"auditLog":{"name":"auditLog","type":"\u001bcloudflare.account.auditLog","title":"Cloudflare audit log entry","desc":"Single change recorded in the Cloudflare account audit log: when it happened, who performed it (`actorEmail`, `actorId`, `actorIp`, and `actorType`, one of `user`, `cloudflare_admin`, `account`, and others), what resource it affected (`resourceType`, `resourceId`), and the action's outcome (`actionType`, `actionResult`). `oldValue` and `newValue` hold structured before/after data when the API returns it. Use for change-detection assertions and to confirm sensitive actions are performed by expected actors.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"auditLogs":{"name":"auditLogs","type":"\u0019\u001bcloudflare.account.auditLog","title":"Recent audit log entries for the account (most recent first; first page only)","desc":"Returns the first page of account audit log entries. The Cloudflare API caps a page at 100 entries; for older history, narrow with a `.where(when \u003e ...)` filter or paginate at the API level outside MQL. Use this to verify a change actor, spot unauthorized configuration changes, or feed an access review.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the account was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Account identifier","desc":"The 32-character account ID (the account \"tag\") that scopes every account-level API call. It selects an account from the `accounts` list and correlates a discovered asset with its owning account.","provider":"go.mondoo.com/mql/providers/cloudflare"},"ipAccessRules":{"name":"ipAccessRules","type":"\u0019\u001bcloudflare.ipAccessRule","title":"Account-wide IP Access rules","desc":"The IP, IP range, ASN, and country rules the account applies across all of its zones. A rule in `whitelist` mode exempts its source from the WAF, rate limiting, and the security level of every zone the account owns, so one entry can undo the firewall posture of the whole estate.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"liveInputs":{"name":"liveInputs","type":"\u0019\u001bcloudflare.streams.liveInput","title":"Stream live inputs","desc":"Live streaming ingest endpoints defined for the account. Each entry carries its `uid`, recording retention (`deleteRecordingAfterDays`), and name, covering the account's live-video ingestion surface.","provider":"go.mondoo.com/mql/providers/cloudflare"},"logExplorerDatasets":{"name":"logExplorerDatasets","type":"\u0019\u001bcloudflare.logExplorerDataset","title":"Log Explorer datasets","desc":"Datasets Log Explorer retains for the account and, where the account owns them, for its zones. Each reports whether it is still ingesting and whether deletion protection is on, which is what stops retained logs from being removed while an investigation is open.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"member":{"name":"member","type":"\u001bcloudflare.account.member","title":"Cloudflare account member","desc":"User (member) of a Cloudflare account, exposing their identity (`email`, `firstName`, `lastName`), enrollment `status` (`accepted`, `pending`, `rejected`), whether `twoFactorAuthenticationEnabled` is on, and the `roles` they hold. Use for access reviews (\"who can administer this account?\"), 2FA enforcement audits, and stale-invite cleanup.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bcloudflare.account.member","title":"Account members","desc":"Users belonging to the account, with their invitation `status`, assigned `roles`, and whether each has two-factor authentication enabled (`twoFactorAuthenticationEnabled`), for access and MFA reviews.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Account name","provider":"go.mondoo.com/mql/providers/cloudflare"},"notificationPolicies":{"name":"notificationPolicies","type":"\u0019\u001bcloudflare.notificationPolicy","title":"Notification policies configured for the account","desc":"Alert subscriptions that route Cloudflare notifications to email, PagerDuty, or webhooks. Each policy exposes its `alertType`, whether it is `enabled`, and its delivery `mechanisms`.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"one":{"name":"one","type":"\u001bcloudflare.one","title":"Cloudflare Zero Trust (Cloudflare One)","desc":"Account-wide Zero Trust configuration: Access applications and their policies, Access groups, service tokens, identity providers, the Access organization, Gateway rules, enrolled devices, device-posture rules and integrations, DLP profiles, and network lists and locations.","min_provider_version":"13.6.5","provider":"go.mondoo.com/mql/providers/cloudflare"},"r2":{"name":"r2","type":"\u001bcloudflare.r2","title":"Cloudflare R2 object storage","desc":"The account's R2 storage, whose `buckets` list each bucket with its name, location, creation time, and public-access exposure. Requires R2 to be enabled on the account.","min_provider_version":"13.6.5","provider":"go.mondoo.com/mql/providers/cloudflare"},"role":{"name":"role","type":"\u001bcloudflare.account.role","title":"Cloudflare account role","desc":"Named permission role defined in a Cloudflare account. Roles group the privileges that can be granted to account members. Query `name` and `description` to review what each role confers during an access review.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"roles":{"name":"roles","type":"\u0019\u001bcloudflare.account.role","title":"Account roles","desc":"The catalog of named roles the account can assign to members, each with an `id`, `name`, and `description`. Cross-reference with `members` to review which privileges a user holds.","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"settings":{"name":"settings","type":"\u001bcloudflare.account.settings","is_mandatory":true,"title":"Account-level configuration and preferences","desc":"Account-wide settings, including whether membership requires two-factor authentication (`enforceTwoFactor`).","provider":"go.mondoo.com/mql/providers/cloudflare"},"tunnelRoutes":{"name":"tunnelRoutes","type":"\u0019\u001bcloudflare.tunnel.route","title":"Tunnel routes","desc":"Private-network routes (CIDRs) advertised through the account's tunnels, each naming its target `tunnelId` and optional virtual network.","min_provider_version":"13.6.5","provider":"go.mondoo.com/mql/providers/cloudflare"},"tunnelVirtualNetworks":{"name":"tunnelVirtualNetworks","type":"\u0019\u001bcloudflare.tunnel.virtualNetwork","title":"Tunnel virtual networks","desc":"Virtual networks that segment overlapping private IP ranges across the account's tunnel routes, each with its name and whether it is the default network.","min_provider_version":"13.6.5","provider":"go.mondoo.com/mql/providers/cloudflare"},"tunnels":{"name":"tunnels","type":"\u0019\u001bcloudflare.tunnel","title":"Cloudflare Tunnels","desc":"Cloudflared tunnels defined for the account, each with its status, tunnel type, and active `connections`, for auditing outbound connectivity into private networks.","min_provider_version":"13.6.5","provider":"go.mondoo.com/mql/providers/cloudflare"},"turnstileWidgets":{"name":"turnstileWidgets","type":"\u0019\u001bcloudflare.turnstile.widget","title":"Turnstile widgets","desc":"Challenge widgets defined for the account, each with the `mode` that decides how much friction a visitor sees, the `domains` it may be embedded on, and the `clearanceLevel` it grants. Use it to find widgets left in a permissive mode or scoped to domains the account no longer owns.","min_provider_version":"13.6.8","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Account type","desc":"The account's plan class, for example `standard` or `enterprise`.","provider":"go.mondoo.com/mql/providers/cloudflare"},"videos":{"name":"videos","type":"\u0019\u001bcloudflare.streams.video","title":"Stream video assets","desc":"On-demand videos uploaded to or recorded through Cloudflare Stream. Query `requireSignedUrls` to audit token-gated playback, alongside duration, size, playback URLs, and readiness for each asset.","provider":"go.mondoo.com/mql/providers/cloudflare"},"workers":{"name":"workers","type":"\u001bcloudflare.workers","title":"Cloudflare Workers","desc":"The account's Workers platform: deployed `workers` (scripts) with their size, deployment metadata, and logpush setting, plus Pages projects. Covers the serverless code running on the account.","min_provider_version":"13.6.5","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Account","desc":"Cloudflare account and its account-scoped services. Query `settings` for account-level preferences such as two-factor enforcement, `roles` and `members` for the account's access model, `one` for Zero Trust, `r2` for object storage, `workers` for deployed scripts, `tunnels` for Cloudflare Tunnel connectivity, and `liveInputs` and `videos` for Stream assets.","private":true,"min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare","root":true},"cloudflare.account.auditLog":{"id":"cloudflare.account.auditLog","name":"cloudflare.account.auditLog","fields":{"actionResult":{"name":"actionResult","type":"\u0004","is_mandatory":true,"title":"Whether the action succeeded","provider":"go.mondoo.com/mql/providers/cloudflare"},"actionType":{"name":"actionType","type":"\u0007","is_mandatory":true,"title":"Action name (for example `tls.certificate.add`)","provider":"go.mondoo.com/mql/providers/cloudflare"},"actorEmail":{"name":"actorEmail","type":"\u0007","is_mandatory":true,"title":"Email of the actor that performed the action","provider":"go.mondoo.com/mql/providers/cloudflare"},"actorId":{"name":"actorId","type":"\u0007","is_mandatory":true,"title":"Identifier of the actor that performed the action","provider":"go.mondoo.com/mql/providers/cloudflare"},"actorIp":{"name":"actorIp","type":"\u0007","is_mandatory":true,"title":"IP address the action was performed from","provider":"go.mondoo.com/mql/providers/cloudflare"},"actorType":{"name":"actorType","type":"\u0007","is_mandatory":true,"title":"Actor classification (`user`, `cloudflare_admin`, `account`, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Audit log entry identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"newValue":{"name":"newValue","type":"\n","is_mandatory":true,"title":"Structured after-state of the affected resource (empty when the API does not return it)","provider":"go.mondoo.com/mql/providers/cloudflare"},"oldValue":{"name":"oldValue","type":"\n","is_mandatory":true,"title":"Structured before-state of the affected resource (empty when the API does not return it)","provider":"go.mondoo.com/mql/providers/cloudflare"},"ownerId":{"name":"ownerId","type":"\u0007","is_mandatory":true,"title":"Identifier of the account that owns the audit log entry","provider":"go.mondoo.com/mql/providers/cloudflare"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"Identifier of the resource the action was performed on","provider":"go.mondoo.com/mql/providers/cloudflare"},"resourceType":{"name":"resourceType","type":"\u0007","is_mandatory":true,"title":"Type of the resource the action was performed on (for example `zone`, `account_member`, `dns_record`)","provider":"go.mondoo.com/mql/providers/cloudflare"},"when":{"name":"when","type":"\t","is_mandatory":true,"title":"Time the action was performed","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare audit log entry","desc":"Single change recorded in the Cloudflare account audit log: when it happened, who performed it (`actorEmail`, `actorId`, `actorIp`, and `actorType`, one of `user`, `cloudflare_admin`, `account`, and others), what resource it affected (`resourceType`, `resourceId`), and the action's outcome (`actionType`, `actionResult`). `oldValue` and `newValue` hold structured before/after data when the API returns it. Use for change-detection assertions and to confirm sensitive actions are performed by expected actors.","private":true,"min_provider_version":"13.4.1","defaults":"when actorEmail actionType resourceType","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.account.member":{"id":"cloudflare.account.member","name":"cloudflare.account.member","fields":{"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Member's email address","provider":"go.mondoo.com/mql/providers/cloudflare"},"firstName":{"name":"firstName","type":"\u0007","is_mandatory":true,"title":"Member's first name","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Membership identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastName":{"name":"lastName","type":"\u0007","is_mandatory":true,"title":"Member's last name","provider":"go.mondoo.com/mql/providers/cloudflare"},"roles":{"name":"roles","type":"\u0019\u001bcloudflare.account.role","is_mandatory":true,"title":"Roles assigned to this member","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Member status (`accepted`, `pending`, `rejected`)","provider":"go.mondoo.com/mql/providers/cloudflare"},"twoFactorAuthenticationEnabled":{"name":"twoFactorAuthenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the member has two-factor authentication enabled on their Cloudflare account","provider":"go.mondoo.com/mql/providers/cloudflare"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"Member's Cloudflare user identifier","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare account member","desc":"User (member) of a Cloudflare account, exposing their identity (`email`, `firstName`, `lastName`), enrollment `status` (`accepted`, `pending`, `rejected`), whether `twoFactorAuthenticationEnabled` is on, and the `roles` they hold. Use for access reviews (\"who can administer this account?\"), 2FA enforcement audits, and stale-invite cleanup.","private":true,"min_provider_version":"13.4.1","defaults":"email status twoFactorAuthenticationEnabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.account.role":{"id":"cloudflare.account.role","name":"cloudflare.account.role","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Role description","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare account role","desc":"Named permission role defined in a Cloudflare account. Roles group the privileges that can be granted to account members. Query `name` and `description` to review what each role confers during an access review.","private":true,"min_provider_version":"13.1.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.account.settings":{"id":"cloudflare.account.settings","name":"cloudflare.account.settings","fields":{"enforceTwoFactor":{"name":"enforceTwoFactor","type":"\u0004","is_mandatory":true,"title":"Whether membership in this account requires that two-factor authentication is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Account settings","desc":"Account-level security preferences. The `enforceTwoFactor` field reports whether every member of the account is required to have two-factor authentication enabled, a common baseline in access-hardening audits.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.apiToken":{"id":"cloudflare.apiToken","name":"cloudflare.apiToken","fields":{"accountId":{"name":"accountId","type":"\u0007","is_mandatory":true,"title":"Account that owns the token","desc":"Null for a user-owned token, which belongs to the authenticating user rather than to any one account.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresOn":{"name":"expiresOn","type":"\t","is_mandatory":true,"title":"Time the token expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Token identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"ipIn":{"name":"ipIn","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses allowed to use the token (CIDR list)","provider":"go.mondoo.com/mql/providers/cloudflare"},"ipNotIn":{"name":"ipNotIn","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses blocked from using the token (CIDR list)","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuedOn":{"name":"issuedOn","type":"\t","is_mandatory":true,"title":"Time the token was issued","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastUsedOn":{"name":"lastUsedOn","type":"\t","is_mandatory":true,"title":"Time the token was last used","desc":"Null when the token has never been used, which on a long-lived automation credential means it can be revoked without effect.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the token was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/cloudflare"},"notBefore":{"name":"notBefore","type":"\t","is_mandatory":true,"title":"Earliest time the token is valid","provider":"go.mondoo.com/mql/providers/cloudflare"},"policies":{"name":"policies","type":"\u0019\n","is_mandatory":true,"title":"Token policies","desc":"Grant rules that define what the token can do. Each entry has `id` (policy identifier), `effect` (either allow or deny), `resources` (the scopes the policy applies to, decoded from the raw API shape), and `permissionGroups` (a list of objects with `id` and `name` naming the permission groups granted).","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Token status (active, disabled, expired)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare API Token","desc":"User-scoped Cloudflare API token, used to audit programmatic access to the account. The `status` field reports whether the token is active, disabled, or expired, while `expiresOn` and `notBefore` bound its validity window. `ipIn` and `ipNotIn` capture the IP allowlist and blocklist that restrict where the token may be used, and `policies` records the grants that define what the token can do.","private":true,"min_provider_version":"13.1.1","defaults":"name status expiresOn","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.corsHeaders":{"id":"cloudflare.corsHeaders","name":"cloudflare.corsHeaders","fields":{"allowAllHeaders":{"name":"allowAllHeaders","type":"\u0004","is_mandatory":true,"title":"Whether any request header is permitted, ignoring allowedHeaders","provider":"go.mondoo.com/mql/providers/cloudflare"},"allowAllMethods":{"name":"allowAllMethods","type":"\u0004","is_mandatory":true,"title":"Whether any HTTP method is permitted, ignoring allowedMethods","provider":"go.mondoo.com/mql/providers/cloudflare"},"allowAllOrigins":{"name":"allowAllOrigins","type":"\u0004","is_mandatory":true,"title":"Whether any origin is permitted (the request Origin is reflected), ignoring allowedOrigins","provider":"go.mondoo.com/mql/providers/cloudflare"},"allowCredentials":{"name":"allowCredentials","type":"\u0004","is_mandatory":true,"title":"Whether the browser may send credentials (cookies, TLS client certificates, HTTP auth) with cross-origin requests","provider":"go.mondoo.com/mql/providers/cloudflare"},"allowedHeaders":{"name":"allowedHeaders","type":"\u0019\u0007","is_mandatory":true,"title":"Request headers permitted on cross-origin requests when allowAllHeaders is false","provider":"go.mondoo.com/mql/providers/cloudflare"},"allowedMethods":{"name":"allowedMethods","type":"\u0019\u0007","is_mandatory":true,"title":"HTTP methods permitted on cross-origin requests when allowAllMethods is false","provider":"go.mondoo.com/mql/providers/cloudflare"},"allowedOrigins":{"name":"allowedOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"Origins permitted to make cross-origin requests when allowAllOrigins is false","provider":"go.mondoo.com/mql/providers/cloudflare"},"maxAge":{"name":"maxAge","type":"\u0005","is_mandatory":true,"provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"CORS headers","desc":"Cross-Origin Resource Sharing settings applied by a Cloudflare Access application. Reports which origins, HTTP methods, and request headers are permitted on cross-origin requests, whether the browser may send credentials, and how long a browser may cache a preflight response. Auditing these settings surfaces permissive combinations (for example allowAllOrigins together with allowCredentials) that weaken the cross-origin protections around a protected application.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.dns":{"id":"cloudflare.dns","name":"cloudflare.dns","fields":{"record":{"name":"record","type":"\u001bcloudflare.dns.record","title":"DNS record","desc":"Single DNS record in a Cloudflare zone, covering its type, content, TTL, and whether it is proxied through Cloudflare or served DNS-only. Auditing these records surfaces exposed hostnames, mail-authentication records (SPF, DKIM, and DMARC carried as TXT), and records that point directly at origin IP addresses and so bypass Cloudflare's proxy.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"records":{"name":"records","type":"\u0019\u001bcloudflare.dns.record","title":"List all DNS records","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare DNS namespace","desc":"DNS records configured for a zone. The `records` field enumerates every record type (A, AAAA, CNAME, MX, TXT, and others) with its content, TTL, and proxy status, which is the starting point for auditing exposed hostnames, mail routing (MX and TXT-carried SPF/DMARC records), and whether traffic is proxied through Cloudflare or served DNS-only.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.dns.record":{"id":"cloudflare.dns.record","name":"cloudflare.dns.record","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-form comment or description for the DNS record","provider":"go.mondoo.com/mql/providers/cloudflare"},"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Content of the record (e.g., hostname or IP Address)","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the record was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cloudflare internal ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the record was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Record name","provider":"go.mondoo.com/mql/providers/cloudflare"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Record priority (used by MX, SRV, and URI records)","provider":"go.mondoo.com/mql/providers/cloudflare"},"proxiable":{"name":"proxiable","type":"\u0004","is_mandatory":true,"title":"Whether the record can be proxied","provider":"go.mondoo.com/mql/providers/cloudflare"},"proxied":{"name":"proxied","type":"\u0004","is_mandatory":true,"title":"Whether the record is proxied (false indicates DNS only)","provider":"go.mondoo.com/mql/providers/cloudflare"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags for organizing and filtering DNS records","provider":"go.mondoo.com/mql/providers/cloudflare"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"Time to live (in seconds)","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of record (e.g., A, AAAA, or CNAME)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"DNS record","desc":"Single DNS record in a Cloudflare zone, covering its type, content, TTL, and whether it is proxied through Cloudflare or served DNS-only. Auditing these records surfaces exposed hostnames, mail-authentication records (SPF, DKIM, and DMARC carried as TXT), and records that point directly at origin IP addresses and so bypass Cloudflare's proxy.","private":true,"min_provider_version":"11.0.0","defaults":"type content name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.ipAccessRule":{"id":"cloudflare.ipAccessRule","name":"cloudflare.ipAccessRule","fields":{"allowedModes":{"name":"allowedModes","type":"\u0019\u0007","is_mandatory":true,"title":"Actions the rule is allowed to take","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the rule was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Action applied to a matching request","desc":"One of block, challenge, whitelist, js_challenge, or managed_challenge. The value whitelist exempts the source from the WAF, rate limiting, and the security level rather than allowing it through a single check.","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the rule was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Summary recorded with the rule","provider":"go.mondoo.com/mql/providers/cloudflare"},"scopeType":{"name":"scopeType","type":"\u0007","is_mandatory":true,"title":"Scope the rule was defined at","desc":"Either user or organization. An organization rule is defined on the account and applies to every zone it owns.","provider":"go.mondoo.com/mql/providers/cloudflare"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"What the rule matches on","desc":"One of ip, ip6, ip_range, asn, or country.","provider":"go.mondoo.com/mql/providers/cloudflare"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value matched against the request source","desc":"An IP address, a CIDR range, an AS number, or a two-letter ISO-3166-1 alpha-2 country code, according to `target`.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"IP Access rule","desc":"Rule evaluated ahead of the WAF that matches a request by its source: a single IP, an IP range, an autonomous system number, or a country. The `mode` field carries the verdict. The dangerous value is `whitelist`: a source allowed there bypasses the WAF, rate limiting, and the zone's security level entirely, so a stale allowlist entry for an office range or a cloud provider's ASN is an unfiltered path to the origin. Rules exist at both zone and account scope, and `scopeType` reports which one a rule came from.","private":true,"min_provider_version":"13.8.1","defaults":"mode target value notes","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.loadBalancerPool":{"id":"cloudflare.loadBalancerPool","name":"cloudflare.loadBalancerPool","fields":{"checkRegions":{"name":"checkRegions","type":"\u0019\u0007","is_mandatory":true,"title":"Regions health checks are run from; empty means all regions","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the pool was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the pool is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Pool identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"latitude":{"name":"latitude","type":"\u0006","is_mandatory":true,"title":"Latitude used for proximity steering","provider":"go.mondoo.com/mql/providers/cloudflare"},"longitude":{"name":"longitude","type":"\u0006","is_mandatory":true,"title":"Longitude used for proximity steering","provider":"go.mondoo.com/mql/providers/cloudflare"},"minimumOrigins":{"name":"minimumOrigins","type":"\u0005","is_mandatory":true,"title":"Minimum number of healthy origins before the pool is considered healthy","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the pool was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"monitorId":{"name":"monitorId","type":"\u0007","is_mandatory":true,"title":"ID of the monitor that health-checks the pool's origins","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pool name","provider":"go.mondoo.com/mql/providers/cloudflare"},"notificationEmail":{"name":"notificationEmail","type":"\u0007","is_mandatory":true,"title":"Email address notified when the pool's health changes","provider":"go.mondoo.com/mql/providers/cloudflare"},"origins":{"name":"origins","type":"\u0019\n","is_mandatory":true,"title":"Origin servers in the pool (each dict: name, address, enabled, weight, virtualNetworkId)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare load balancer pool","desc":"Named group of origin servers that a load balancer steers traffic to. The `origins` list gives each backend `address`, weight, and enabled state; `monitorId` and `checkRegions` describe the health checks; `minimumOrigins` is the healthy-origin floor below which the pool is considered down; `notificationEmail` receives health alerts; and `latitude`/`longitude` position the pool for proximity steering. Pools are account-scoped and may be shared by several load balancers.","private":true,"min_provider_version":"13.3.6","defaults":"name enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.logExplorerDataset":{"id":"cloudflare.logExplorerDataset","name":"cloudflare.logExplorerDataset","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the dataset was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"dataset":{"name":"dataset","type":"\u0007","is_mandatory":true,"title":"Name of the log stream this dataset retains, such as `http_requests`","provider":"go.mondoo.com/mql/providers/cloudflare"},"datasetId":{"name":"datasetId","type":"\u0007","is_mandatory":true,"title":"Dataset identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"deletionProtection":{"name":"deletionProtection","type":"\u0004","is_mandatory":true,"title":"Whether the dataset is protected against deletion","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the dataset is currently ingesting logs","provider":"go.mondoo.com/mql/providers/cloudflare"},"filter":{"name":"filter","type":"\u0007","title":"Expression limiting which log entries the dataset retains","desc":"Empty when the dataset retains every entry for its stream.","provider":"go.mondoo.com/mql/providers/cloudflare"},"objectId":{"name":"objectId","type":"\u0007","is_mandatory":true,"title":"Identifier of the account or zone the dataset belongs to","provider":"go.mondoo.com/mql/providers/cloudflare"},"objectType":{"name":"objectType","type":"\u0007","is_mandatory":true,"title":"Scope the dataset belongs to","desc":"One of `account` or `zone`.","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the dataset was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"zone":{"name":"zone","type":"\u001bcloudflare.zone","title":"Zone the dataset is scoped to","desc":"Null for an account-scoped dataset, and for a zone the calling token cannot list.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Log Explorer dataset","desc":"A log stream Log Explorer retains so it can be queried after the fact. `dataset` names the stream, such as `http_requests`, and `objectType` reports whether the dataset is scoped to the whole account or to a single zone, with `objectId` naming that account or zone. `enabled` reports whether the dataset is still ingesting, and `deletionProtection` whether it is guarded against removal, which is what keeps retained logs available while an investigation is open. `filter` carries the expression limiting which entries are kept.","private":true,"min_provider_version":"13.8.1","defaults":"dataset objectType enabled deletionProtection","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.mtlsCertificate":{"id":"cloudflare.mtlsCertificate","name":"cloudflare.mtlsCertificate","fields":{"ca":{"name":"ca","type":"\u0004","is_mandatory":true,"title":"Whether this is a CA certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate issuer","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Certificate name","provider":"go.mondoo.com/mql/providers/cloudflare"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number","provider":"go.mondoo.com/mql/providers/cloudflare"},"signature":{"name":"signature","type":"\u0007","is_mandatory":true,"title":"Signature type","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the certificate was last updated","desc":"Always null. The Cloudflare API response for an mTLS certificate no longer carries a separate last-updated timestamp.","provider":"go.mondoo.com/mql/providers/cloudflare"},"uploadedOn":{"name":"uploadedOn","type":"\t","is_mandatory":true,"title":"Time the certificate was uploaded","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare mTLS certificate","desc":"CA certificate uploaded to a Cloudflare account for mutual TLS authentication, where Cloudflare validates the client certificate a connecting device presents against the CA on file. Reviewing these certificates surfaces which certificate authorities are trusted for client authentication, whether any are self-signed (the ca flag), and when each expires so an mTLS enforcement gap can be caught before the certificate lapses.","private":true,"min_provider_version":"13.1.0","defaults":"name id","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.notificationPolicy":{"id":"cloudflare.notificationPolicy","name":"cloudflare.notificationPolicy","fields":{"alertType":{"name":"alertType","type":"\u0007","is_mandatory":true,"title":"Alert type the policy subscribes to (see the Cloudflare Notifications API for the full enum)","provider":"go.mondoo.com/mql/providers/cloudflare"},"conditions":{"name":"conditions","type":"\n","is_mandatory":true,"title":"Conditions further narrowing when the alert fires (shape depends on `alertType`)","provider":"go.mondoo.com/mql/providers/cloudflare"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the policy was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is currently active","provider":"go.mondoo.com/mql/providers/cloudflare"},"filters":{"name":"filters","type":"\n","is_mandatory":true,"title":"Filters further scoping which entities the alert applies to (shape depends on `alertType`)","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"mechanisms":{"name":"mechanisms","type":"\n","is_mandatory":true,"title":"Delivery destinations grouped by mechanism","desc":"Keyed by mechanism name (`email`, `pagerduty`, `webhooks`); each value is the list of configured integrations for that mechanism, where each integration is an object with `id` and `name`.","provider":"go.mondoo.com/mql/providers/cloudflare"},"modified":{"name":"modified","type":"\t","is_mandatory":true,"title":"Time the policy was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare notification policy","desc":"Single notification (alert) policy configured on a Cloudflare account: which `alertType` it subscribes to (for example `dedicated_ssl_certificate_expiration_type`, `universal_ssl_event_type`, `web_analytics_metrics_update`, `dos_attack_l7`), whether it is `enabled`, how alerts are delivered via `mechanisms` (email, PagerDuty, webhook integrations), and any `conditions` or `filters` that narrow the firing criteria. Query it to assert that critical alerts (TLS expiry, DDoS, mTLS revocation, configuration changes) are wired up to an active destination.","private":true,"min_provider_version":"13.4.1","defaults":"name alertType enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one":{"id":"cloudflare.one","name":"cloudflare.one","fields":{"accessGroup":{"name":"accessGroup","type":"\u001bcloudflare.one.accessGroup","title":"Cloudflare One access group","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"accessGroups":{"name":"accessGroups","type":"\u0019\u001bcloudflare.one.accessGroup","title":"Access groups","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"accessPolicies":{"name":"accessPolicies","type":"\u0019\u001bcloudflare.one.accessPolicy","title":"Access policies (reusable)","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"accessPolicy":{"name":"accessPolicy","type":"\u001bcloudflare.one.accessPolicy","title":"Cloudflare One access policy","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"app":{"name":"app","type":"\u001bcloudflare.one.app","title":"Cloudflare One application","desc":"Single Cloudflare One (Access) application: the identity providers it accepts, its CORS and cookie hardening, its session and authentication policies, and the deny and launcher experience it presents to users. The Access policies governing the application are available through `policies`.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"apps":{"name":"apps","type":"\u0019\u001bcloudflare.one.app","title":"Cloudflare Zero Trust applications","provider":"go.mondoo.com/mql/providers/cloudflare"},"device":{"name":"device","type":"\u001bcloudflare.one.device","title":"Cloudflare One device","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"devicePostureIntegration":{"name":"devicePostureIntegration","type":"\u001bcloudflare.one.devicePostureIntegration","title":"Cloudflare One device posture integration","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"devicePostureIntegrations":{"name":"devicePostureIntegrations","type":"\u0019\u001bcloudflare.one.devicePostureIntegration","title":"Device posture integrations","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"devicePostureRule":{"name":"devicePostureRule","type":"\u001bcloudflare.one.devicePostureRule","title":"Cloudflare One device posture rule","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"devicePostureRules":{"name":"devicePostureRules","type":"\u0019\u001bcloudflare.one.devicePostureRule","title":"Device posture rules","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"devices":{"name":"devices","type":"\u0019\u001bcloudflare.one.device","title":"Registered devices","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"dlpProfile":{"name":"dlpProfile","type":"\u001bcloudflare.one.dlpProfile","title":"Cloudflare One DLP profile","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"dlpProfiles":{"name":"dlpProfiles","type":"\u0019\u001bcloudflare.one.dlpProfile","title":"DLP profiles","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"gatewayConfiguration":{"name":"gatewayConfiguration","type":"\u001bcloudflare.one.gatewayConfiguration","title":"Account-wide Gateway enforcement settings","desc":"The settings every Gateway rule runs on top of, including whether TLS is decrypted, whether activity is logged, and whether antivirus, body scanning, protocol detection, browser isolation and the sandbox are on.","provider":"go.mondoo.com/mql/providers/cloudflare"},"gatewayRule":{"name":"gatewayRule","type":"\u001bcloudflare.one.gatewayRule","title":"Cloudflare One Gateway rule","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"gatewayRules":{"name":"gatewayRules","type":"\u0019\u001bcloudflare.one.gatewayRule","title":"Gateway rules","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"identityProviders":{"name":"identityProviders","type":"\u0019\u001bcloudflare.one.idp","title":"Identity providers","provider":"go.mondoo.com/mql/providers/cloudflare"},"idp":{"name":"idp","type":"\u001bcloudflare.one.idp","title":"Cloudflare One identity provider","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"list":{"name":"list","type":"\u001bcloudflare.one.list","title":"Cloudflare One Gateway list","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"lists":{"name":"lists","type":"\u0019\u001bcloudflare.one.list","title":"Gateway lists","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"location":{"name":"location","type":"\u001bcloudflare.one.location","title":"Cloudflare One Gateway location","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"locations":{"name":"locations","type":"\u0019\u001bcloudflare.one.location","title":"Gateway locations","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"organization":{"name":"organization","type":"\u001bcloudflare.one.organization","title":"Access organization configuration","provider":"go.mondoo.com/mql/providers/cloudflare"},"serviceToken":{"name":"serviceToken","type":"\u001bcloudflare.one.serviceToken","title":"Cloudflare One access service token","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"serviceTokens":{"name":"serviceTokens","type":"\u0019\u001bcloudflare.one.serviceToken","title":"Access service tokens","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One (Zero Trust) namespace","desc":"Zero Trust configuration for a Cloudflare account, spanning Access, Gateway, and device enrollment. `apps` covers Access application settings (allowed IdPs, session duration, cookie security); `identityProviders` the configured IdPs and their SAML/SCIM settings; `accessPolicies` and `accessGroups` the reusable policy components; `serviceTokens` the machine-to-machine token inventory; `organization` org-wide settings such as auth domain and WARP session duration; `gatewayRules` the DNS/HTTP/L4 traffic policies; `lists`, `locations`, and `dlpProfiles` the Gateway data sources; `devices` the enrolled device inventory; and `devicePostureRules` and `devicePostureIntegrations` the posture-check configuration.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.accessGroup":{"id":"cloudflare.one.accessGroup","name":"cloudflare.one.accessGroup","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the group was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Group identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the group was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One access group","private":true,"min_provider_version":"13.1.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.accessPolicy":{"id":"cloudflare.one.accessPolicy","name":"cloudflare.one.accessPolicy","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the policy was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"decision":{"name":"decision","type":"\u0007","is_mandatory":true,"title":"The action Access will take if the policy matches (allow, deny, non_identity, bypass)","provider":"go.mondoo.com/mql/providers/cloudflare"},"exclude":{"name":"exclude","type":"\u0019\n","is_mandatory":true,"title":"Rules that deny access when satisfied (NOT); same dict shape as include","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"include":{"name":"include","type":"\u0019\n","is_mandatory":true,"title":"Rules that grant access — the user must satisfy at least one (OR)","desc":"Each dict is one condition keyed by its rule type (e.g. email, email_domain, ip, ip_list, group, everyone, certificate, gsuite, okta, saml, azureAD, github-organization, service_token, device_posture).","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/mql/providers/cloudflare"},"precedence":{"name":"precedence","type":"\u0005","is_mandatory":true,"title":"The order in which the policy is executed","provider":"go.mondoo.com/mql/providers/cloudflare"},"require":{"name":"require","type":"\u0019\n","is_mandatory":true,"title":"Rules that must all be satisfied (AND); same dict shape as include","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the policy was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One access policy","private":true,"min_provider_version":"13.1.0","defaults":"name decision","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.app":{"id":"cloudflare.one.app","name":"cloudflare.one.app","fields":{"allowedIdentityProviders":{"name":"allowedIdentityProviders","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed identity providers","provider":"go.mondoo.com/mql/providers/cloudflare"},"appLauncherVisible":{"name":"appLauncherVisible","type":"\u0004","is_mandatory":true,"title":"Whether the application displays in the App Launcher","provider":"go.mondoo.com/mql/providers/cloudflare"},"aud":{"name":"aud","type":"\u0007","is_mandatory":true,"title":"Audience tag","provider":"go.mondoo.com/mql/providers/cloudflare"},"autoRedirectToIdentity":{"name":"autoRedirectToIdentity","type":"\u0004","is_mandatory":true,"title":"Whether users skip the identity provider selection step during login","provider":"go.mondoo.com/mql/providers/cloudflare"},"corsHeaders":{"name":"corsHeaders","type":"\u001bcloudflare.corsHeaders","is_mandatory":true,"title":"CORS headers","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the application was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"customDenyMessage":{"name":"customDenyMessage","type":"\u0007","is_mandatory":true,"title":"Custom error message shown to a user when they are denied access to the application","provider":"go.mondoo.com/mql/providers/cloudflare"},"customDenyUrl":{"name":"customDenyUrl","type":"\u0007","is_mandatory":true,"title":"Custom URL to redirect a user to when they are denied access to the application","provider":"go.mondoo.com/mql/providers/cloudflare"},"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Domain of the application","provider":"go.mondoo.com/mql/providers/cloudflare"},"enableBindingCookie":{"name":"enableBindingCookie","type":"\u0004","is_mandatory":true,"title":"Whether to allow the binding cookie","desc":"Increases security against compromised authorization tokens and CSRF attacks.","provider":"go.mondoo.com/mql/providers/cloudflare"},"httpOnlyCookieAttribute":{"name":"httpOnlyCookieAttribute","type":"\u0004","is_mandatory":true,"title":"Whether the HttpOnly cookie attribute is enabled","desc":"Increases security against XSS attacks.","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"UUID","provider":"go.mondoo.com/mql/providers/cloudflare"},"logoUrl":{"name":"logoUrl","type":"\u0007","is_mandatory":true,"title":"URL of the application's logo","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the application","provider":"go.mondoo.com/mql/providers/cloudflare"},"optionsPreflightBypass":{"name":"optionsPreflightBypass","type":"\u0004","is_mandatory":true,"title":"Whether preflight requests bypass Access authentication","desc":"When true, preflight requests are allowed to go directly to the origin. Can't be true if corsHeaders is set.","provider":"go.mondoo.com/mql/providers/cloudflare"},"policies":{"name":"policies","type":"\u0019\u001bcloudflare.one.accessPolicy","title":"Access policies governing the application","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"sameSiteCookieAttribute":{"name":"sameSiteCookieAttribute","type":"\u0007","is_mandatory":true,"title":"SameSite cookie setting","desc":"Provides increased security against CSRF attacks.","provider":"go.mondoo.com/mql/providers/cloudflare"},"serviceAuth401Redirect":{"name":"serviceAuth401Redirect","type":"\u0004","is_mandatory":true,"title":"Whether to return a 401 status code when the request is blocked by a Service Auth policy","provider":"go.mondoo.com/mql/providers/cloudflare"},"sessionDuration":{"name":"sessionDuration","type":"\u0007","is_mandatory":true,"title":"Amount of time that tokens issued for this application will be valid","desc":"Format is 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, and h.","provider":"go.mondoo.com/mql/providers/cloudflare"},"skipInterstitial":{"name":"skipInterstitial","type":"\u0004","is_mandatory":true,"title":"Whether automatic authentication through cloudflared is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Application type","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the application was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One application","desc":"Single Cloudflare One (Access) application: the identity providers it accepts, its CORS and cookie hardening, its session and authentication policies, and the deny and launcher experience it presents to users. The Access policies governing the application are available through `policies`.","private":true,"min_provider_version":"11.0.0","defaults":"name id","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.device":{"id":"cloudflare.one.device","name":"cloudflare.one.device","fields":{"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the device was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"deleted":{"name":"deleted","type":"\u0004","is_mandatory":true,"title":"Whether the device has been deleted","provider":"go.mondoo.com/mql/providers/cloudflare"},"deviceType":{"name":"deviceType","type":"\u0007","is_mandatory":true,"title":"Device type (desktop, mobile, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Device identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"ip":{"name":"ip","type":"\u0007","is_mandatory":true,"title":"Device IP address","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastSeen":{"name":"lastSeen","type":"\t","is_mandatory":true,"title":"Time the device was last seen","provider":"go.mondoo.com/mql/providers/cloudflare"},"macAddress":{"name":"macAddress","type":"\u0007","is_mandatory":true,"title":"Device MAC address","provider":"go.mondoo.com/mql/providers/cloudflare"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"Device manufacturer","provider":"go.mondoo.com/mql/providers/cloudflare"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Device model","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Device name","provider":"go.mondoo.com/mql/providers/cloudflare"},"osDistroName":{"name":"osDistroName","type":"\u0007","is_mandatory":true,"title":"OS distribution name","provider":"go.mondoo.com/mql/providers/cloudflare"},"osDistroRevision":{"name":"osDistroRevision","type":"\u0007","is_mandatory":true,"title":"OS distribution revision","provider":"go.mondoo.com/mql/providers/cloudflare"},"osVersion":{"name":"osVersion","type":"\u0007","is_mandatory":true,"title":"OS version","provider":"go.mondoo.com/mql/providers/cloudflare"},"revokedAt":{"name":"revokedAt","type":"\t","is_mandatory":true,"title":"Time the device was revoked","provider":"go.mondoo.com/mql/providers/cloudflare"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Device serial number","provider":"go.mondoo.com/mql/providers/cloudflare"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Time the device was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"WARP client version","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One device","private":true,"min_provider_version":"13.1.0","defaults":"name id","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.devicePostureIntegration":{"id":"cloudflare.one.devicePostureIntegration","name":"cloudflare.one.devicePostureIntegration","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Integration identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"interval":{"name":"interval","type":"\u0007","is_mandatory":true,"title":"Check interval","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Integration name","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Integration type (workspace_one, crowdstrike_s2s, uptycs, intune, kolide, tanium, sentinelone_s2s)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One device posture integration","private":true,"min_provider_version":"13.1.0","defaults":"name type","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.devicePostureRule":{"id":"cloudflare.one.devicePostureRule","name":"cloudflare.one.devicePostureRule","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Rule description","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiration":{"name":"expiration","type":"\u0007","is_mandatory":true,"title":"Rule expiration","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/mql/providers/cloudflare"},"schedule":{"name":"schedule","type":"\u0007","is_mandatory":true,"title":"Check schedule (cron expression)","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Rule type (file, application, serial_number, os_version, domain_joined, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One device posture rule","private":true,"min_provider_version":"13.1.0","defaults":"name type","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.dlpProfile":{"id":"cloudflare.one.dlpProfile","name":"cloudflare.one.dlpProfile","fields":{"allowedMatchCount":{"name":"allowedMatchCount","type":"\u0005","is_mandatory":true,"title":"Number of matches allowed before triggering","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the profile was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Profile description","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Profile identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name","provider":"go.mondoo.com/mql/providers/cloudflare"},"ocrEnabled":{"name":"ocrEnabled","type":"\u0004","is_mandatory":true,"title":"Whether OCR is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Profile type (predefined, custom, integration)","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the profile was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One DLP profile","private":true,"min_provider_version":"13.1.0","defaults":"name type","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.gatewayConfiguration":{"id":"cloudflare.one.gatewayConfiguration","name":"cloudflare.one.gatewayConfiguration","fields":{"activityLogEnabled":{"name":"activityLogEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Gateway records the decisions it makes","desc":"False means allowed and blocked requests leave no entry in the Gateway activity log, so there is no record of what a rule matched.","provider":"go.mondoo.com/mql/providers/cloudflare"},"antivirusDownloadEnabled":{"name":"antivirusDownloadEnabled","type":"\u0004","is_mandatory":true,"title":"Whether antivirus scanning runs on downloads","provider":"go.mondoo.com/mql/providers/cloudflare"},"antivirusFailClosed":{"name":"antivirusFailClosed","type":"\u0004","is_mandatory":true,"title":"Whether requests for files antivirus cannot scan are blocked","desc":"False lets an unscannable file through unscanned, which is the failure mode an attacker aims for with an archive antivirus cannot open.","provider":"go.mondoo.com/mql/providers/cloudflare"},"antivirusUploadEnabled":{"name":"antivirusUploadEnabled","type":"\u0004","is_mandatory":true,"title":"Whether antivirus scanning runs on uploads","provider":"go.mondoo.com/mql/providers/cloudflare"},"bodyScanningInspectionMode":{"name":"bodyScanningInspectionMode","type":"\u0007","is_mandatory":true,"title":"Depth of body inspection used for DLP","desc":"Either deep or shallow. Shallow inspection only reads the beginning of a request body, so a match placed later in the body is not found. Empty when body scanning is not configured.","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the Gateway configuration was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"extendedEmailMatchingEnabled":{"name":"extendedEmailMatchingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether email addresses in firewall policies match their plus and dot variants","provider":"go.mondoo.com/mql/providers/cloudflare"},"fipsTls":{"name":"fipsTls","type":"\u0004","is_mandatory":true,"title":"Whether Gateway enforces FIPS 140-2 compliant cipher suites and TLS versions","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostSelectorEnabled":{"name":"hostSelectorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether host filtering is available to egress policies","provider":"go.mondoo.com/mql/providers/cloudflare"},"inspectionMode":{"name":"inspectionMode","type":"\u0007","is_mandatory":true,"title":"Proxy inspection mode","desc":"Either static, where Gateway inspects HTTP on TCP 80 and, with TLS decryption on, HTTPS on 443, or dynamic, where protocol detection finds HTTP and HTTPS on any port. Empty when inspection is not configured.","provider":"go.mondoo.com/mql/providers/cloudflare"},"interceptionCertificateId":{"name":"interceptionCertificateId","type":"\u0007","is_mandatory":true,"title":"Identifier of the certificate Gateway presents when intercepting TLS","desc":"Empty or an all-zero UUID when the Cloudflare Root CA handles interception rather than a customer certificate.","provider":"go.mondoo.com/mql/providers/cloudflare"},"maxTtlSeconds":{"name":"maxTtlSeconds","type":"\u0005","is_mandatory":true,"title":"Account-wide cap on DNS response TTLs, in seconds","desc":"Null when no cap is set. Gateway rewrites DNS responses so returned record TTLs do not exceed this value.","provider":"go.mondoo.com/mql/providers/cloudflare"},"nonIdentityBrowserIsolationEnabled":{"name":"nonIdentityBrowserIsolationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether browser isolation accepts non-identity onramps","provider":"go.mondoo.com/mql/providers/cloudflare"},"protocolDetectionEnabled":{"name":"protocolDetectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Gateway identifies protocols from the first bytes of a connection","desc":"Required for dynamic inspection to find HTTP and HTTPS traffic on non-standard ports. False confines inspection to the standard ports.","provider":"go.mondoo.com/mql/providers/cloudflare"},"sandboxEnabled":{"name":"sandboxEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the file sandbox is on","provider":"go.mondoo.com/mql/providers/cloudflare"},"sandboxFallbackAction":{"name":"sandboxFallbackAction","type":"\u0007","is_mandatory":true,"title":"Action taken when the sandbox cannot scan a file","desc":"Either allow or block. Empty when the sandbox is not configured.","provider":"go.mondoo.com/mql/providers/cloudflare"},"tlsDecryptEnabled":{"name":"tlsDecryptEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Gateway decrypts and inspects encrypted HTTP traffic","desc":"False leaves Gateway with only the SNI of a TLS connection, so HTTP rules, DLP inspection and antivirus scanning no longer see request or response bodies and silently degrade to hostname matching.","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the Gateway configuration was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"urlBrowserIsolationEnabled":{"name":"urlBrowserIsolationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether clientless browser isolation is on","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Account-wide Cloudflare Gateway enforcement settings","desc":"Settings that apply to every Gateway rule in the account and decide how much of a rule can actually be enforced. With `tlsDecryptEnabled` off, Gateway sees only the SNI of an HTTPS connection, so every HTTP rule, DLP profile and antivirus scan degrades to hostname matching. With `activityLogEnabled` off, no Gateway decision is recorded, leaving no forensic trail for an investigation. The antivirus, body-scanning, protocol-detection, browser isolation and sandbox fields report which inspection engines are turned on.  Reported as null when the settings cannot be read, so an unreadable account is never reported as one with every control switched off.","private":true,"min_provider_version":"13.8.1","defaults":"tlsDecryptEnabled activityLogEnabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.gatewayRule":{"id":"cloudflare.one.gatewayRule","name":"cloudflare.one.gatewayRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Rule action (allow, block, isolate, log, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the rule was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Rule description","provider":"go.mondoo.com/mql/providers/cloudflare"},"devicePosture":{"name":"devicePosture","type":"\u0007","is_mandatory":true,"title":"Filter expression for device posture","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"filters":{"name":"filters","type":"\u0019\u0007","is_mandatory":true,"title":"Which filter types apply (dns, http, l4, egress, resolve)","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"Filter expression for user identity","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/mql/providers/cloudflare"},"precedence":{"name":"precedence","type":"\u0005","is_mandatory":true,"title":"Rule precedence (lower numbers execute first)","provider":"go.mondoo.com/mql/providers/cloudflare"},"traffic":{"name":"traffic","type":"\u0007","is_mandatory":true,"title":"Filter expression for network traffic","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the rule was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Rule version","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One Gateway rule","private":true,"min_provider_version":"13.1.0","defaults":"name action","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.idp":{"id":"cloudflare.one.idp","name":"cloudflare.one.idp","fields":{"attributes":{"name":"attributes","type":"\u0019\u0007","is_mandatory":true,"title":"Additional SAML attributes mapped from the IdP","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"emailAttributeName":{"name":"emailAttributeName","type":"\u0007","is_mandatory":true,"title":"SAML attribute used as the user's email","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/mql/providers/cloudflare"},"idpPublicCert":{"name":"idpPublicCert","type":"\u0007","is_mandatory":true,"title":"PEM-encoded IdP signing certificate (SAML)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuerUrl":{"name":"issuerUrl","type":"\u0007","is_mandatory":true,"title":"SAML/OIDC issuer URL","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"UUID","provider":"go.mondoo.com/mql/providers/cloudflare"},"saml":{"name":"saml","type":"\u0004","is_mandatory":true,"title":"Whether this IdP is SAML-based (SAML, Centrify, OneLogin, Ping, or Okta-via-the-generic-saml-type; OIDC and social IdPs are excluded)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"scimEnabled":{"name":"scimEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SCIM provisioning is enabled for this IdP","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"signRequest":{"name":"signRequest","type":"\u0004","is_mandatory":true,"title":"Whether SAML AuthnRequests are signed","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"ssoTargetUrl":{"name":"ssoTargetUrl","type":"\u0007","is_mandatory":true,"title":"SAML SSO target URL (only set for SAML IdPs)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"The name of the identity provider, shown to users on the login page.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One identity provider","private":true,"min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.list":{"id":"cloudflare.one.list","name":"cloudflare.one.list","fields":{"count":{"name":"count","type":"\u0005","is_mandatory":true,"title":"Number of items in the list","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the list was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"List description","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"List identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"List name","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"List type (SERIAL, URL, DOMAIN, EMAIL, IP)","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the list was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One Gateway list","private":true,"min_provider_version":"13.1.0","defaults":"name type","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.location":{"id":"cloudflare.one.location","name":"cloudflare.one.location","fields":{"anonymizedLogsEnabled":{"name":"anonymizedLogsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether anonymized logs are enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"clientDefault":{"name":"clientDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the default client location","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the location was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"dohSubdomain":{"name":"dohSubdomain","type":"\u0007","is_mandatory":true,"title":"DoH subdomain for this location","provider":"go.mondoo.com/mql/providers/cloudflare"},"ecsSupport":{"name":"ecsSupport","type":"\u0004","is_mandatory":true,"title":"Whether ECS (EDNS Client Subnet) is supported","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Location identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"ip":{"name":"ip","type":"\u0007","is_mandatory":true,"title":"Assigned IPv4 address","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Location name","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the location was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One Gateway location","private":true,"min_provider_version":"13.1.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.organization":{"id":"cloudflare.one.organization","name":"cloudflare.one.organization","fields":{"allowAuthenticateViaWarp":{"name":"allowAuthenticateViaWarp","type":"\u0004","is_mandatory":true,"title":"Whether authentication via WARP is allowed","provider":"go.mondoo.com/mql/providers/cloudflare"},"authDomain":{"name":"authDomain","type":"\u0007","is_mandatory":true,"title":"Auth domain for the organization (e.g., example.cloudflareaccess.com)","provider":"go.mondoo.com/mql/providers/cloudflare"},"autoRedirectToIdentity":{"name":"autoRedirectToIdentity","type":"\u0004","is_mandatory":true,"title":"Whether users auto-redirect to identity provider","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the organization was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"isUiReadOnly":{"name":"isUiReadOnly","type":"\u0004","is_mandatory":true,"title":"Whether the UI is read-only","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Organization name","provider":"go.mondoo.com/mql/providers/cloudflare"},"sessionDuration":{"name":"sessionDuration","type":"\u0007","is_mandatory":true,"title":"Default session duration","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the organization was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"userSeatExpirationInactiveTime":{"name":"userSeatExpirationInactiveTime","type":"\u0007","is_mandatory":true,"title":"Inactivity time before user seat expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"warpAuthNonBrowser401":{"name":"warpAuthNonBrowser401","type":"\u0004","is_mandatory":true,"title":"Whether failed WARP authentication returns 401 instead of a login redirect","desc":"When enabled, an unsuccessful WARP authentication request carrying a non-HTML Accept header receives a 401 response rather than being redirected to the login page. Null when the organization does not report the setting.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"warpAuthSessionDuration":{"name":"warpAuthSessionDuration","type":"\u0007","is_mandatory":true,"title":"WARP auth session duration","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One organization configuration","desc":"Account-wide Zero Trust settings that apply before any individual Access application policy is evaluated. `authDomain` is the team domain users authenticate against, `sessionDuration` and `warpAuthSessionDuration` bound how long issued tokens stay valid, and `userSeatExpirationInactiveTime` controls when an idle seat is reclaimed. `isUiReadOnly` reports whether the dashboard is locked to read-only regardless of a user's permissions.","private":true,"min_provider_version":"13.1.0","defaults":"name authDomain","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.one.serviceToken":{"id":"cloudflare.one.serviceToken","name":"cloudflare.one.serviceToken","fields":{"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"OAuth 2.0 client ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the token was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"duration":{"name":"duration","type":"\u0007","is_mandatory":true,"title":"Token duration before expiration","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the token expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Token identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastSeenAt":{"name":"lastSeenAt","type":"\t","is_mandatory":true,"title":"Time the token was last seen","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the token was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare One access service token","private":true,"min_provider_version":"13.1.0","defaults":"name id","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.pages":{"id":"cloudflare.pages","fields":{"envVar":{"name":"envVar","type":"\u001bcloudflare.pages.envVar","title":"Cloudflare Pages environment variable (metadata only; values are intentionally not exposed)","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true}},"is_extension":true},"cloudflare.pages.envVar":{"id":"cloudflare.pages.envVar","name":"cloudflare.pages.envVar","fields":{"environment":{"name":"environment","type":"\u0007","is_mandatory":true,"title":"Environment (preview, production)","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Variable name","provider":"go.mondoo.com/mql/providers/cloudflare"},"projectName":{"name":"projectName","type":"\u0007","is_mandatory":true,"title":"Pages project name","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Variable type (plain_text, secret_text)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Pages environment variable (metadata only; values are intentionally not exposed)","private":true,"min_provider_version":"13.1.1","defaults":"projectName environment name type","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.r2":{"id":"cloudflare.r2","name":"cloudflare.r2","fields":{"bucket":{"name":"bucket","type":"\u001bcloudflare.r2.bucket","title":"Cloudflare R2 bucket","desc":"Single R2 storage bucket, identified by its name. A bucket reaches the internet over two independent paths: the managed r2.dev subdomain, reported by publicAccessEnabled and publicAccessDomain, and custom domains, listed by customDomains. The isPublic field reports whether either path currently serves the bucket, alongside its storage location and creation time.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"buckets":{"name":"buckets","type":"\u0019\u001bcloudflare.r2.bucket","title":"R2 buckets in the account","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare R2 namespace","desc":"Object-storage resources for a Cloudflare account. The buckets field enumerates every R2 bucket, which is the starting point for auditing where account data is stored and which buckets serve objects publicly, whether over the managed r2.dev subdomain or a custom domain.","private":true,"min_provider_version":"11.0.0","defaults":"buckets","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.r2.bucket":{"id":"cloudflare.r2.bucket","name":"cloudflare.r2.bucket","fields":{"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the bucket was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"customDomain":{"name":"customDomain","type":"\u001bcloudflare.r2.bucket.customDomain","title":"Custom domain serving a Cloudflare R2 bucket","desc":"Domain in one of the account's zones that publishes an R2 bucket's objects on the internet, separately from the managed r2.dev subdomain. The enabled field reports whether the domain currently serves the bucket, ownershipStatus and sslStatus report how far the domain got through validation and certificate issuance, and minTlsVersion reports the lowest TLS version the domain accepts.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"customDomains":{"name":"customDomains","type":"\u0019\u001bcloudflare.r2.bucket.customDomain","title":"Custom domains registered for the bucket","desc":"Domains in the account's own zones that serve the bucket's objects, each with its enabled flag, ownership and certificate status, and minimum TLS version. Empty when the bucket has no custom domain, and also when the token cannot read the list, so check isPublic for the exposure question.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"isPublic":{"name":"isPublic","type":"\u0004","title":"Whether the bucket is reachable from the internet","desc":"True when the managed r2.dev subdomain is enabled, or when at least one custom domain is registered and enabled. Null when nothing proved the bucket public but one of the two paths could not be read, so a bucket whose exposure is unknown is never reported as private.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Bucket location","desc":"Cloudflare region hint for where the bucket's data is stored. One of apac, eeur, enam, weur, wnam, or oc.","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Bucket name","provider":"go.mondoo.com/mql/providers/cloudflare"},"publicAccessDomain":{"name":"publicAccessDomain","type":"\u0007","title":"Managed r2.dev domain assigned to the bucket (empty when public access is disabled)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"publicAccessEnabled":{"name":"publicAccessEnabled","type":"\u0004","title":"Whether public access over the managed r2.dev subdomain is enabled","desc":"Covers the managed r2.dev subdomain only. A bucket published through a custom domain is served publicly no matter what this reports, so use isPublic to decide whether the bucket is reachable from the internet.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare R2 bucket","desc":"Single R2 storage bucket, identified by its name. A bucket reaches the internet over two independent paths: the managed r2.dev subdomain, reported by publicAccessEnabled and publicAccessDomain, and custom domains, listed by customDomains. The isPublic field reports whether either path currently serves the bucket, alongside its storage location and creation time.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.r2.bucket.customDomain":{"id":"cloudflare.r2.bucket.customDomain","name":"cloudflare.r2.bucket.customDomain","fields":{"certificateActive":{"name":"certificateActive","type":"\u0004","is_mandatory":true,"title":"Whether an SSL certificate is issued and active for the domain","desc":"True only when sslStatus is active. A domain whose certificate is still initializing or pending cannot yet terminate TLS for the bucket.","provider":"go.mondoo.com/mql/providers/cloudflare"},"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Domain name serving the bucket","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the bucket is publicly accessible at this domain","provider":"go.mondoo.com/mql/providers/cloudflare"},"minTlsVersion":{"name":"minTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version the domain accepts for incoming connections","desc":"One of 1.0, 1.1, 1.2, or 1.3. Empty when the API reports no value, in which case the domain accepts TLS 1.0.","provider":"go.mondoo.com/mql/providers/cloudflare"},"ownershipStatus":{"name":"ownershipStatus","type":"\u0007","is_mandatory":true,"title":"Ownership status of the domain","desc":"One of pending, active, deactivated, blocked, error, or unknown.","provider":"go.mondoo.com/mql/providers/cloudflare"},"sslStatus":{"name":"sslStatus","type":"\u0007","is_mandatory":true,"title":"SSL certificate status for the domain","desc":"One of initializing, pending, active, deactivated, error, or unknown.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Custom domain serving a Cloudflare R2 bucket","desc":"Domain in one of the account's zones that publishes an R2 bucket's objects on the internet, separately from the managed r2.dev subdomain. The enabled field reports whether the domain currently serves the bucket, ownershipStatus and sslStatus report how far the domain got through validation and certificate issuance, and minTlsVersion reports the lowest TLS version the domain accepts.","private":true,"min_provider_version":"13.8.1","defaults":"domain enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.streams":{"id":"cloudflare.streams","name":"cloudflare.streams","fields":{"liveInput":{"name":"liveInput","type":"\u001bcloudflare.streams.liveInput","title":"Cloudflare live input (stream)","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"video":{"name":"video","type":"\u001bcloudflare.streams.video","title":"Cloudflare videos and recordings","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true}},"title":"Cloudflare Stream namespace","desc":"Grouping for Cloudflare Stream assets, the managed video platform that serves live-streaming inputs alongside uploaded or recorded video-on-demand files. Live inputs are modeled as cloudflare.streams.liveInput and video assets as cloudflare.streams.video, both enumerated from the account.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.streams.liveInput":{"id":"cloudflare.streams.liveInput","name":"cloudflare.streams.liveInput","fields":{"deleteRecordingAfterDays":{"name":"deleteRecordingAfterDays","type":"\u0005","is_mandatory":true,"title":"Number of days after which to delete the recording","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Input name","provider":"go.mondoo.com/mql/providers/cloudflare"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare live input (stream)","private":true,"min_provider_version":"11.0.0","defaults":"uid name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.streams.video":{"id":"cloudflare.streams.video","name":"cloudflare.streams.video","fields":{"creator":{"name":"creator","type":"\u0007","is_mandatory":true,"title":"Creator ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"dash":{"name":"dash","type":"\u0007","is_mandatory":true,"title":"Dash URL","provider":"go.mondoo.com/mql/providers/cloudflare"},"duration":{"name":"duration","type":"\u0006","is_mandatory":true,"title":"Video duration in seconds","provider":"go.mondoo.com/mql/providers/cloudflare"},"height":{"name":"height","type":"\u0005","is_mandatory":true,"title":"Height (px)","provider":"go.mondoo.com/mql/providers/cloudflare"},"hls":{"name":"hls","type":"\u0007","is_mandatory":true,"title":"HLS URL","provider":"go.mondoo.com/mql/providers/cloudflare"},"liveInput":{"name":"liveInput","type":"\u0007","is_mandatory":true,"title":"Live input ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name of the video","provider":"go.mondoo.com/mql/providers/cloudflare"},"preview":{"name":"preview","type":"\u0007","is_mandatory":true,"title":"Preview URL","provider":"go.mondoo.com/mql/providers/cloudflare"},"ready":{"name":"ready","type":"\u0004","is_mandatory":true,"title":"Whether the video is ready to stream","provider":"go.mondoo.com/mql/providers/cloudflare"},"requireSignedUrls":{"name":"requireSignedUrls","type":"\u0004","is_mandatory":true,"title":"Whether playback requires a signed URL token rather than the plain UID","provider":"go.mondoo.com/mql/providers/cloudflare"},"scheduledDeletion":{"name":"scheduledDeletion","type":"\t","is_mandatory":true,"title":"Date and time at which the video will be deleted (No value or a null value means that the video won't be deleted.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Size in Bytes","provider":"go.mondoo.com/mql/providers/cloudflare"},"thumbnail":{"name":"thumbnail","type":"\u0007","is_mandatory":true,"title":"Thumbnail URL","provider":"go.mondoo.com/mql/providers/cloudflare"},"thumbnailTimestampPct":{"name":"thumbnailTimestampPct","type":"\u0006","is_mandatory":true,"title":"Timestamp for a thumbnail image, as a percentage of the video's duration","desc":"To convert from a second-wise timestamp to a percentage, divide the desired timestamp by the total duration of the video. If this value is not set, the default thumbnail image is taken from 0s of the video.","provider":"go.mondoo.com/mql/providers/cloudflare"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"uploaded":{"name":"uploaded","type":"\t","is_mandatory":true,"title":"Time the video was uploaded","provider":"go.mondoo.com/mql/providers/cloudflare"},"width":{"name":"width","type":"\u0005","is_mandatory":true,"title":"Width (px)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare videos and recordings","private":true,"min_provider_version":"11.0.0","defaults":"name uid","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.tunnel":{"id":"cloudflare.tunnel","name":"cloudflare.tunnel","fields":{"configuration":{"name":"configuration","type":"\u001bcloudflare.tunnel.configuration","title":"Ingress rules and origin connection settings for the tunnel","desc":"The authoritative map of which internal services the tunnel publishes, and how cloudflared connects to each of them. Available only for a remotely managed cloudflared tunnel; a locally managed one keeps its configuration in a YAML file on the connector host and reports null here.","provider":"go.mondoo.com/mql/providers/cloudflare"},"connection":{"name":"connection","type":"\u001bcloudflare.tunnel.connection","title":"Cloudflare tunnel connection","desc":"Active connection between a tunnel's connector and a Cloudflare data center. Each connection records which data center it terminates in (`coloName`), the connector that established it (`clientId`), the connector software version (`clientVersion`), and the origin IP the connector runs on, which helps audit connector fleet health and detect outdated connector versions.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bcloudflare.tunnel.connection","is_mandatory":true,"title":"Active connections for this tunnel","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the tunnel was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"deletedAt":{"name":"deletedAt","type":"\t","is_mandatory":true,"title":"Time the tunnel was deleted","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Tunnel identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"ingressRule":{"name":"ingressRule","type":"\u001bcloudflare.tunnel.ingressRule","title":"Cloudflare tunnel ingress rule","desc":"One mapping in a tunnel's ingress list, from a public hostname and path to the internal service that answers it. The `service` field names the destination as a protocol and address, for example http://10.0.0.5:8080, ssh://10.0.0.6:22, or rdp://10.0.0.7:3389, and is what shows how deep into a private network a public hostname reaches. Rules are evaluated in order, and the last rule of a tunnel is normally a catch-all with no hostname.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tunnel name","provider":"go.mondoo.com/mql/providers/cloudflare"},"remoteConfig":{"name":"remoteConfig","type":"\u0004","is_mandatory":true,"title":"Whether the tunnel is configured remotely","desc":"True when the tunnel's configuration is managed remotely from the Zero Trust dashboard rather than by a local cloudflared config file. Remotely managed tunnels have their ingress rules controlled through the Cloudflare API instead of on the connector host.","provider":"go.mondoo.com/mql/providers/cloudflare"},"route":{"name":"route","type":"\u001bcloudflare.tunnel.route","title":"Cloudflare tunnel route","desc":"Private network route that maps a CIDR range to a tunnel, defining which internal IP ranges are reachable through the tunnel by Cloudflare WARP clients. Reviewing routes shows how much of a private network each tunnel exposes and which virtual network it belongs to, which matters for network segmentation. The `network` field carries the routed CIDR block.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Tunnel health status","desc":"One of inactive (no connections ever registered), degraded (fewer connections than expected for high availability), healthy (all connections established), or down (all connections lost).","provider":"go.mondoo.com/mql/providers/cloudflare"},"tunnelType":{"name":"tunnelType","type":"\u0007","is_mandatory":true,"title":"Tunnel type (cfd_tunnel, warp_connector)","provider":"go.mondoo.com/mql/providers/cloudflare"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bcloudflare.tunnel.virtualNetwork","title":"Cloudflare tunnel virtual network","desc":"Virtual network used to segment tunnel routes, allowing overlapping private CIDR ranges to coexist by isolating them into separate routing scopes. The `isDefaultNetwork` field marks the virtual network that routes fall into when no explicit virtual network is assigned. Select a virtual network by name, for example `cloudflare.tunnel.virtualNetwork(name: \"default\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true}},"title":"Cloudflare tunnel","desc":"Cloudflare Tunnel connecting origin services to Cloudflare's edge over an outbound-only connector, so private applications can be reached without opening inbound firewall ports. Auditing tunnels surfaces their operational health, whether their configuration is managed remotely from the Zero Trust dashboard, and the active connector connections carrying traffic. The `tunnelType` field distinguishes a cloudflared tunnel (cfd_tunnel) from a WARP connector (warp_connector).","private":true,"min_provider_version":"13.1.0","defaults":"name status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.tunnel.configuration":{"id":"cloudflare.tunnel.configuration","name":"cloudflare.tunnel.configuration","fields":{"ingress":{"name":"ingress","type":"\u0019\u001bcloudflare.tunnel.ingressRule","is_mandatory":true,"title":"Public hostname to internal service mappings","provider":"go.mondoo.com/mql/providers/cloudflare"},"originCaPool":{"name":"originCaPool","type":"\u0007","is_mandatory":true,"title":"Path on the connector host to the CA bundle validating the origin certificate","desc":"Set when the origin presents a certificate that Cloudflare does not chain to. Empty when the default trust store is used.","provider":"go.mondoo.com/mql/providers/cloudflare"},"originHttp2":{"name":"originHttp2","type":"\u0004","is_mandatory":true,"title":"Whether cloudflared connects to the origin over HTTP/2","desc":"Null when the configuration does not set it.","provider":"go.mondoo.com/mql/providers/cloudflare"},"originNoTlsVerify":{"name":"originNoTlsVerify","type":"\u0004","is_mandatory":true,"title":"Whether cloudflared skips validating the origin's TLS certificate by default","desc":"True disables certificate validation on the connector-to-origin leg for every ingress rule that does not override it, so that leg is encrypted but unauthenticated. Null when the configuration does not set it.","provider":"go.mondoo.com/mql/providers/cloudflare"},"originProxyType":{"name":"originProxyType","type":"\u0007","is_mandatory":true,"title":"Proxy cloudflared starts when translating HTTP traffic into TCP","desc":"Empty for the regular proxy, or socks for a SOCKS5 proxy used to reach arbitrary destinations through the tunnel.","provider":"go.mondoo.com/mql/providers/cloudflare"},"originServerName":{"name":"originServerName","type":"\u0007","is_mandatory":true,"title":"Hostname cloudflared expects on the origin's certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Where the tunnel's configuration is managed","desc":"Either cloudflare, meaning the configuration is held in the Zero Trust dashboard and readable here, or local, meaning it lives in a YAML file on the connector host.","provider":"go.mondoo.com/mql/providers/cloudflare"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Version of the tunnel configuration","provider":"go.mondoo.com/mql/providers/cloudflare"},"warpRoutingEnabled":{"name":"warpRoutingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether private network routing is on for the tunnel","desc":"True means WARP clients can reach the CIDR ranges routed through this tunnel directly, in addition to any public hostnames in `ingress`. Null when the configuration does not report it.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare tunnel ingress configuration","desc":"Configuration a remotely managed Cloudflare Tunnel runs on: the `ingress` rules that decide which public hostname reaches which internal service, and the origin connection settings cloudflared applies when it does. The ingress list is the authoritative inventory of what a tunnel exposes, and `originNoTlsVerify` reports whether cloudflared validates the origin's certificate on the leg between the connector and the service, which is the half of the path Cloudflare's edge certificate says nothing about.  Reported as null for a locally managed tunnel, whose configuration lives in a YAML file on the connector host and is not readable through the API.","private":true,"min_provider_version":"13.8.1","defaults":"source ingress","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.tunnel.connection":{"id":"cloudflare.tunnel.connection","name":"cloudflare.tunnel.connection","fields":{"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"Client connector ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"clientVersion":{"name":"clientVersion","type":"\u0007","is_mandatory":true,"title":"Client connector version","provider":"go.mondoo.com/mql/providers/cloudflare"},"coloName":{"name":"coloName","type":"\u0007","is_mandatory":true,"title":"Cloudflare data center name","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"isPendingReconnect":{"name":"isPendingReconnect","type":"\u0004","is_mandatory":true,"title":"Whether the connection is pending reconnect","desc":"Always null. Cloudflare removed this value from the tunnel connections API, so it can no longer be read. Retained for backwards compatibility and will be removed in the next major release.","provider":"go.mondoo.com/mql/providers/cloudflare","maturity":"deprecated"},"openedAt":{"name":"openedAt","type":"\t","is_mandatory":true,"title":"Time the connection was opened","provider":"go.mondoo.com/mql/providers/cloudflare"},"originIp":{"name":"originIp","type":"\u0007","is_mandatory":true,"title":"Origin IP address","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare tunnel connection","desc":"Active connection between a tunnel's connector and a Cloudflare data center. Each connection records which data center it terminates in (`coloName`), the connector that established it (`clientId`), the connector software version (`clientVersion`), and the origin IP the connector runs on, which helps audit connector fleet health and detect outdated connector versions.","private":true,"min_provider_version":"13.1.0","defaults":"id coloName","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.tunnel.ingressRule":{"id":"cloudflare.tunnel.ingressRule","name":"cloudflare.tunnel.ingressRule","fields":{"accessRequired":{"name":"accessRequired","type":"\u0004","is_mandatory":true,"title":"Whether cloudflared validates the Cf-Access-Jwt-Assertion header on requests to this origin","desc":"False means a request that reaches the connector by any other route is served without an Access check. Null when the rule does not configure it.","provider":"go.mondoo.com/mql/providers/cloudflare"},"caPool":{"name":"caPool","type":"\u0007","is_mandatory":true,"title":"Path on the connector host to the CA bundle validating this origin's certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Public hostname routed by this rule","desc":"Empty on the catch-all rule that ends every ingress list.","provider":"go.mondoo.com/mql/providers/cloudflare"},"http2Origin":{"name":"http2Origin","type":"\u0004","is_mandatory":true,"title":"Whether cloudflared reaches this origin over HTTP/2","desc":"Null when the rule does not override the tunnel-wide setting.","provider":"go.mondoo.com/mql/providers/cloudflare"},"httpHostHeader":{"name":"httpHostHeader","type":"\u0007","is_mandatory":true,"title":"Host header cloudflared sends to this origin","provider":"go.mondoo.com/mql/providers/cloudflare"},"noTlsVerify":{"name":"noTlsVerify","type":"\u0004","is_mandatory":true,"title":"Whether cloudflared skips validating this origin's TLS certificate","desc":"True leaves the connector-to-origin leg encrypted but unauthenticated, so anything that can answer at the address is accepted as the origin. Null when the rule does not override the tunnel-wide setting.","provider":"go.mondoo.com/mql/providers/cloudflare"},"originServerName":{"name":"originServerName","type":"\u0007","is_mandatory":true,"title":"Hostname cloudflared expects on this origin's certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path prefix this rule matches within the hostname","desc":"Empty when the rule matches every path of the hostname.","provider":"go.mondoo.com/mql/providers/cloudflare"},"service":{"name":"service","type":"\u0007","is_mandatory":true,"title":"Protocol and address of the internal service that answers","desc":"For example http://10.0.0.5:8080, https://internal.local, ssh://10.0.0.6:22, or an http_status:404 response instead of a destination.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare tunnel ingress rule","desc":"One mapping in a tunnel's ingress list, from a public hostname and path to the internal service that answers it. The `service` field names the destination as a protocol and address, for example http://10.0.0.5:8080, ssh://10.0.0.6:22, or rdp://10.0.0.7:3389, and is what shows how deep into a private network a public hostname reaches. Rules are evaluated in order, and the last rule of a tunnel is normally a catch-all with no hostname.","private":true,"min_provider_version":"13.8.1","defaults":"hostname path service","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.tunnel.route":{"id":"cloudflare.tunnel.route","name":"cloudflare.tunnel.route","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Route comment","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the route was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"deletedAt":{"name":"deletedAt","type":"\t","is_mandatory":true,"title":"Time the route was deleted","provider":"go.mondoo.com/mql/providers/cloudflare"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"CIDR network range","provider":"go.mondoo.com/mql/providers/cloudflare"},"tunnelId":{"name":"tunnelId","type":"\u0007","is_mandatory":true,"title":"Tunnel identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"tunnelName":{"name":"tunnelName","type":"\u0007","is_mandatory":true,"title":"Tunnel name","provider":"go.mondoo.com/mql/providers/cloudflare"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bcloudflare.tunnel.virtualNetwork","title":"Virtual network","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare tunnel route","desc":"Private network route that maps a CIDR range to a tunnel, defining which internal IP ranges are reachable through the tunnel by Cloudflare WARP clients. Reviewing routes shows how much of a private network each tunnel exposes and which virtual network it belongs to, which matters for network segmentation. The `network` field carries the routed CIDR block.","private":true,"min_provider_version":"13.1.0","defaults":"network tunnelName","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.tunnel.virtualNetwork":{"id":"cloudflare.tunnel.virtualNetwork","name":"cloudflare.tunnel.virtualNetwork","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Virtual network comment","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the virtual network was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"deletedAt":{"name":"deletedAt","type":"\t","is_mandatory":true,"title":"Time the virtual network was deleted","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual network identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"isDefaultNetwork":{"name":"isDefaultNetwork","type":"\u0004","is_mandatory":true,"title":"Whether this is the default network","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual network name","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare tunnel virtual network","desc":"Virtual network used to segment tunnel routes, allowing overlapping private CIDR ranges to coexist by isolating them into separate routing scopes. The `isDefaultNetwork` field marks the virtual network that routes fall into when no explicit virtual network is assigned. Select a virtual network by name, for example `cloudflare.tunnel.virtualNetwork(name: \"default\")`.","private":true,"min_provider_version":"13.1.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.turnstile":{"id":"cloudflare.turnstile","fields":{"widget":{"name":"widget","type":"\u001bcloudflare.turnstile.widget","title":"Turnstile widget","desc":"Challenge widget that stands in for a CAPTCHA on a site's forms and login pages. The `mode` field decides how much friction a visitor sees, `domains` bounds where the widget may be embedded, and `clearanceLevel` sets the challenge a visitor must pass to earn clearance when the widget sits on a Cloudflare-proxied site. The widget's secret key is not exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true}},"is_extension":true},"cloudflare.turnstile.widget":{"id":"cloudflare.turnstile.widget","name":"cloudflare.turnstile.widget","fields":{"botFightMode":{"name":"botFightMode","type":"\u0004","is_mandatory":true,"title":"Whether Cloudflare issues computationally expensive challenges to malicious bots","provider":"go.mondoo.com/mql/providers/cloudflare"},"clearanceLevel":{"name":"clearanceLevel","type":"\u0007","is_mandatory":true,"title":"Clearance level granted when the widget sits on a Cloudflare-proxied site","desc":"One of no_clearance, jschallenge, managed, or interactive.","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the widget was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"domains":{"name":"domains","type":"\u0019\u0007","is_mandatory":true,"title":"Domains the widget may be embedded on","provider":"go.mondoo.com/mql/providers/cloudflare"},"ephemeralIdEnabled":{"name":"ephemeralIdEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the ephemeral ID is returned in siteverify responses","provider":"go.mondoo.com/mql/providers/cloudflare"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Widget mode","desc":"One of managed, non-interactive, or invisible.","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the widget was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Widget name","provider":"go.mondoo.com/mql/providers/cloudflare"},"offlabel":{"name":"offlabel","type":"\u0004","is_mandatory":true,"title":"Whether Cloudflare branding is hidden on the widget","provider":"go.mondoo.com/mql/providers/cloudflare"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region where the widget can be used","desc":"Either world or china. This cannot be changed after creation.","provider":"go.mondoo.com/mql/providers/cloudflare"},"sitekey":{"name":"sitekey","type":"\u0007","is_mandatory":true,"title":"Widget identifier tag, embedded in the page as the site key","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Turnstile widget","desc":"Challenge widget that stands in for a CAPTCHA on a site's forms and login pages. The `mode` field decides how much friction a visitor sees, `domains` bounds where the widget may be embedded, and `clearanceLevel` sets the challenge a visitor must pass to earn clearance when the widget sits on a Cloudflare-proxied site. The widget's secret key is not exposed.","private":true,"min_provider_version":"13.6.8","defaults":"name mode sitekey","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.workers":{"id":"cloudflare.workers","name":"cloudflare.workers","fields":{"page":{"name":"page","type":"\u001bcloudflare.workers.page","title":"Cloudflare Pages page","desc":"Cloudflare Pages deployment, selected by `shortId`. Exposes the deployment environment (preview or production), its public URL, custom domain aliases, the production branch, and created and modified timestamps. Useful for auditing what a Pages project publishes and where it is reachable.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"pageEnvVars":{"name":"pageEnvVars","type":"\u0019\u001bcloudflare.pages.envVar","title":"Inventory of environment variables bound to Pages projects across preview and production environments (metadata only, values are not exposed)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"pages":{"name":"pages","type":"\u0019\u001bcloudflare.workers.page","title":"List all pages","provider":"go.mondoo.com/mql/providers/cloudflare"},"secret":{"name":"secret","type":"\u001bcloudflare.workers.secret","title":"Cloudflare Workers script secret","desc":"Secret binding attached to a Workers script, selected by script name and secret name. Metadata only: the name and secret type are exposed, never the value, since Cloudflare's API never returns secret values. Useful for inventorying which secrets each script depends on.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"secrets":{"name":"secrets","type":"\u0019\u001bcloudflare.workers.secret","title":"Inventory of secrets bound to all worker scripts (metadata only, values are not exposed)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"worker":{"name":"worker","type":"\u001bcloudflare.workers.worker","title":"Cloudflare worker","desc":"Deployed Workers script and its deployment metadata: code size, placement mode, active deployment and pipeline identifiers, LogPush setting, and created and modified timestamps. Shows which scripts run in an account and how each one is deployed.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"workers":{"name":"workers","type":"\u0019\u001bcloudflare.workers.worker","title":"List all workers","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Workers namespace","desc":"Serverless Workers scripts and Pages projects for an account. Query `workers` for script metadata (size, placement mode, LogPush status), `pages` for Pages deployment details (environment, URL, aliases), `secrets` for the inventory of secrets bound to worker scripts (metadata only, values are never exposed), and `pageEnvVars` for the inventory of environment variables across Pages project environments.","private":true,"min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.workers.page":{"id":"cloudflare.workers.page","name":"cloudflare.workers.page","fields":{"aliases":{"name":"aliases","type":"\u0019\u0007","is_mandatory":true,"title":"Custom domain aliases pointing at this deployment","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the deployment was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"environment":{"name":"environment","type":"\u0007","is_mandatory":true,"title":"Deployment environment (preview or production)","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Deployment ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the deployment was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"productionBranch":{"name":"productionBranch","type":"\u0007","is_mandatory":true,"title":"Branch from which production deployments are built","provider":"go.mondoo.com/mql/providers/cloudflare"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Pages project identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"projectName":{"name":"projectName","type":"\u0007","is_mandatory":true,"title":"Pages project name","provider":"go.mondoo.com/mql/providers/cloudflare"},"shortId":{"name":"shortId","type":"\u0007","is_mandatory":true,"title":"Short deployment ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Public URL of the deployment","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Pages page","desc":"Cloudflare Pages deployment, selected by `shortId`. Exposes the deployment environment (preview or production), its public URL, custom domain aliases, the production branch, and created and modified timestamps. Useful for auditing what a Pages project publishes and where it is reachable.","private":true,"min_provider_version":"11.0.0","defaults":"shortId","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.workers.secret":{"id":"cloudflare.workers.secret","name":"cloudflare.workers.secret","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Secret name (binding identifier)","provider":"go.mondoo.com/mql/providers/cloudflare"},"scriptName":{"name":"scriptName","type":"\u0007","is_mandatory":true,"title":"Worker script name","provider":"go.mondoo.com/mql/providers/cloudflare"},"secretType":{"name":"secretType","type":"\u0007","is_mandatory":true,"title":"Secret type (e.g., secret_text)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Workers script secret","desc":"Secret binding attached to a Workers script, selected by script name and secret name. Metadata only: the name and secret type are exposed, never the value, since Cloudflare's API never returns secret values. Useful for inventorying which secrets each script depends on.","private":true,"min_provider_version":"13.1.1","defaults":"scriptName name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.workers.worker":{"id":"cloudflare.workers.worker","name":"cloudflare.workers.worker","fields":{"binding":{"name":"binding","type":"\u001bcloudflare.workers.worker.binding","title":"Worker binding","desc":"One resource the Worker's code can reach at runtime, selected by `name`, which is the JavaScript variable the binding is exposed as. The `type` field names the kind of resource and `target` names the specific one, so a Worker's bindings together describe how far its code can reach: which buckets it can write, which databases it can query, which other Workers it can invoke.  Bindings that carry a literal value (a secret, a plain-text or JSON constant, a key, an inline blob) report an empty `target`; their values are never exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"bindings":{"name":"bindings","type":"\u0019\u001bcloudflare.workers.worker.binding","title":"Resource bindings attached to the Worker","desc":"Everything the Worker's code can reach at runtime: KV namespaces, R2 buckets, D1 databases, queues, Durable Objects, other Workers reached as services, mTLS certificates, and secrets. This is the Worker's blast radius, since code running under a route can use any of them.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the worker was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"deploymentId":{"name":"deploymentId","type":"\u0007","is_mandatory":true,"title":"Deployment for the worker","provider":"go.mondoo.com/mql/providers/cloudflare"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Worker etag","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Worker ID","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastDeployedFrom":{"name":"lastDeployedFrom","type":"\u0007","is_mandatory":true,"title":"Worker was last deployed from","provider":"go.mondoo.com/mql/providers/cloudflare"},"logPush":{"name":"logPush","type":"\u0004","is_mandatory":true,"title":"Whether LogPush is enabled for the worker","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the worker was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"observabilityEnabled":{"name":"observabilityEnabled","type":"\u0004","title":"Whether observability is turned on for the Worker","desc":"False means the Worker's invocations, logs and exceptions are not retained, so there is nothing to review after an incident. Null when the Worker's settings cannot be read.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"pipelineHash":{"name":"pipelineHash","type":"\u0007","is_mandatory":true,"title":"CI/CD pipeline for the worker","provider":"go.mondoo.com/mql/providers/cloudflare"},"placementMode":{"name":"placementMode","type":"\u0007","is_mandatory":true,"title":"Placement mode for the worker (e.g., smart)","provider":"go.mondoo.com/mql/providers/cloudflare"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Worker size","provider":"go.mondoo.com/mql/providers/cloudflare"},"tailConsumers":{"name":"tailConsumers","type":"\u0019\n","title":"Workers that receive this Worker's logs","desc":"Each entry is `{service, environment, namespace}`, naming the Worker that consumes this one's tail events. A tail consumer receives every request and response this Worker handles, so it is a path the data takes beyond the Worker itself.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare worker","desc":"Deployed Workers script and its deployment metadata: code size, placement mode, active deployment and pipeline identifiers, LogPush setting, and created and modified timestamps. Shows which scripts run in an account and how each one is deployed.","private":true,"min_provider_version":"11.0.0","defaults":"id","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.workers.worker.binding":{"id":"cloudflare.workers.worker.binding","name":"cloudflare.workers.worker.binding","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"JavaScript variable name the binding is exposed as","provider":"go.mondoo.com/mql/providers/cloudflare"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"The specific resource the binding points at","desc":"A bucket name, a namespace id, a database id, a queue name, the name of the Worker a service binding invokes, and so on, according to `type`. Empty for a binding whose value is a literal rather than a reference, and for a kind with no single identifying field.","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of resource the binding provides","desc":"For example kv_namespace, r2_bucket, d1, queue, service, durable_object_namespace, mtls_certificate, hyperdrive, vectorize, analytics_engine, secret_text, or plain_text.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Worker binding","desc":"One resource the Worker's code can reach at runtime, selected by `name`, which is the JavaScript variable the binding is exposed as. The `type` field names the kind of resource and `target` names the specific one, so a Worker's bindings together describe how far its code can reach: which buckets it can write, which databases it can query, which other Workers it can invoke.  Bindings that carry a literal value (a secret, a plain-text or JSON constant, a key, an inline blob) report an empty `target`; their values are never exposed.","private":true,"min_provider_version":"13.8.1","defaults":"name type target","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone":{"id":"cloudflare.zone","name":"cloudflare.zone","fields":{"account":{"name":"account","type":"\u001bcloudflare.zone.account","is_mandatory":true,"title":"Zone owner account","provider":"go.mondoo.com/mql/providers/cloudflare"},"aiAudit":{"name":"aiAudit","type":"\u001bcloudflare.zone.aiAudit","title":"Crawler directives Cloudflare read from the zone's robots.txt","provider":"go.mondoo.com/mql/providers/cloudflare"},"aiSecurity":{"name":"aiSecurity","type":"\u001bcloudflare.zone.aiSecurity","title":"AI Security for Apps configuration","provider":"go.mondoo.com/mql/providers/cloudflare"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"authenticatedOriginPulls":{"name":"authenticatedOriginPulls","type":"\u001bcloudflare.zone.authenticatedOriginPulls","title":"Authenticated origin pull configuration, covering the mTLS handshake between Cloudflare and the origin","provider":"go.mondoo.com/mql/providers/cloudflare"},"botManagement":{"name":"botManagement","type":"\u001bcloudflare.zone.botManagement","title":"Bot management settings","provider":"go.mondoo.com/mql/providers/cloudflare"},"certificatePack":{"name":"certificatePack","type":"\u001bcloudflare.zone.certificatePack","title":"Cloudflare managed certificate pack (Cloudflare-issued)","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"certificatePacks":{"name":"certificatePacks","type":"\u0019\u001bcloudflare.zone.certificatePack","title":"Managed certificate packs (Cloudflare-issued)","provider":"go.mondoo.com/mql/providers/cloudflare"},"clientCertificate":{"name":"clientCertificate","type":"\u001bcloudflare.zone.clientCertificate","title":"Zone client certificate","desc":"Certificate issued by Cloudflare's managed certificate authority for mTLS authentication of clients connecting to the zone. The `status` field reports whether the certificate is active or revoked, with pending_reactivation and pending_revocation marking in-progress transitions, and `expiresOn` bounds its validity. The certificate signing request subject fields record who the certificate was issued to, and `fingerprintSha256` identifies it uniquely. The private key and signing request are never exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"clientCertificates":{"name":"clientCertificates","type":"\u0019\u001bcloudflare.zone.clientCertificate","title":"Client certificates issued for mTLS authentication of API clients","min_provider_version":"13.6.8","provider":"go.mondoo.com/mql/providers/cloudflare"},"contentScanning":{"name":"contentScanning","type":"\u001bcloudflare.zone.contentScanning","title":"Content scanning configuration for uploads passing through the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the zone was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"customCertificate":{"name":"customCertificate","type":"\u001bcloudflare.zone.customCertificate","title":"Cloudflare custom SSL certificate (user-uploaded)","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"customCertificates":{"name":"customCertificates","type":"\u0019\u001bcloudflare.zone.customCertificate","title":"Custom SSL certificates (user-uploaded)","provider":"go.mondoo.com/mql/providers/cloudflare"},"customHostname":{"name":"customHostname","type":"\u001bcloudflare.zone.customHostname","title":"Cloudflare custom hostname","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"customHostnames":{"name":"customHostnames","type":"\u0019\u001bcloudflare.zone.customHostname","title":"Custom hostnames","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"dns":{"name":"dns","type":"\u001bcloudflare.dns","title":"DNS records associated with the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"dnssec":{"name":"dnssec","type":"\u001bcloudflare.zone.dnssec","title":"DNSSEC configuration for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"emailRouting":{"name":"emailRouting","type":"\u001bcloudflare.zone.emailRouting","title":"Email routing configuration (SPF/DKIM/DMARC awareness)","provider":"go.mondoo.com/mql/providers/cloudflare"},"hold":{"name":"hold","type":"\u001bcloudflare.zone.hold","title":"Registrar hold preventing the zone from being added to another account","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Zone identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"ipAccessRules":{"name":"ipAccessRules","type":"\u0019\u001bcloudflare.ipAccessRule","title":"IP Access rules that apply to the zone","desc":"The IP, IP range, ASN, and country rules evaluated ahead of the WAF for this zone, including any inherited from the account. A rule in `whitelist` mode exempts its source from the WAF, rate limiting, and the zone's security level entirely.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"leakedCredentialChecks":{"name":"leakedCredentialChecks","type":"\u001bcloudflare.zone.leakedCredentialChecks","title":"Leaked credential checking configuration","provider":"go.mondoo.com/mql/providers/cloudflare"},"loadBalancer":{"name":"loadBalancer","type":"\u001bcloudflare.zone.loadBalancer","title":"Cloudflare load balancer","desc":"Traffic director that steers requests for a hostname across one or more origin pools. The `steeringPolicy` selects which pool serves a request, `proxied` and `enabled` give its serving state, and session affinity configuration controls stickiness. The `fallbackPool`, `defaultPools`, and `pools` references resolve the backing pools, while `regionPools`, `popPools`, and `countryPools` hold the geo-steering maps of pool IDs.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"loadBalancers":{"name":"loadBalancers","type":"\u0019\u001bcloudflare.zone.loadBalancer","title":"Load balancers","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"lockdown":{"name":"lockdown","type":"\u001bcloudflare.zone.lockdown","title":"Zone Lockdown rule","desc":"Rule restricting a set of URLs to named IP addresses and ranges, used to pin administrative paths such as /wp-admin or a staging host to office addresses. A lockdown with `paused` true is defined but not enforced, and a `configurations` list that has drifted from the addresses actually in use leaves the URLs in `urls` reachable from anywhere with no other signal that anything changed.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"lockdowns":{"name":"lockdowns","type":"\u0019\u001bcloudflare.zone.lockdown","title":"Zone Lockdown rules restricting URLs to named addresses","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"logpushJob":{"name":"logpushJob","type":"\u001bcloudflare.zone.logpushJob","title":"Cloudflare zone logpush job","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"logpushJobs":{"name":"logpushJobs","type":"\u0019\u001bcloudflare.zone.logpushJob","title":"Logpush jobs","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the zone was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"mtlsCertificates":{"name":"mtlsCertificates","type":"\u0019\u001bcloudflare.mtlsCertificate","title":"mTLS certificates","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Zone name","provider":"go.mondoo.com/mql/providers/cloudflare"},"nameServers":{"name":"nameServers","type":"\u0019\u0007","is_mandatory":true,"title":"Nameservers for this zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"originCACertificate":{"name":"originCACertificate","type":"\u001bcloudflare.zone.originCACertificate","title":"Cloudflare origin CA certificate","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"originCACertificates":{"name":"originCACertificates","type":"\u0019\u001bcloudflare.zone.originCACertificate","title":"Origin CA certificates","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"originalNameServers":{"name":"originalNameServers","type":"\u0019\u0007","is_mandatory":true,"title":"Original name servers","provider":"go.mondoo.com/mql/providers/cloudflare"},"owner":{"name":"owner","type":"\u001bcloudflare.zone.owner","is_mandatory":true,"title":"Zone owner","provider":"go.mondoo.com/mql/providers/cloudflare"},"pageRule":{"name":"pageRule","type":"\u001bcloudflare.zone.pageRule","title":"Cloudflare zone page rule","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"pageRules":{"name":"pageRules","type":"\u0019\u001bcloudflare.zone.pageRule","title":"Page rules","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"paused":{"name":"paused","type":"\u0004","is_mandatory":true,"title":"Whether the zone is paused","provider":"go.mondoo.com/mql/providers/cloudflare"},"precursor":{"name":"precursor","type":"\u001bcloudflare.zone.precursor","title":"Precursor request-enforcement configuration for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitRule":{"name":"rateLimitRule","type":"\u001bcloudflare.zone.rateLimitRule","title":"Cloudflare zone rate-limit rule (legacy rate-limiting product)","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"rateLimitRules":{"name":"rateLimitRules","type":"\u0019\u001bcloudflare.zone.rateLimitRule","title":"Rate-limit rules (legacy rate-limiting product)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"ruleset":{"name":"ruleset","type":"\u001bcloudflare.zone.ruleset","title":"Cloudflare zone ruleset","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"rulesets":{"name":"rulesets","type":"\u0019\u001bcloudflare.zone.ruleset","title":"Managed and custom rulesets evaluated for this zone","min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"securityTxt":{"name":"securityTxt","type":"\u001bcloudflare.zone.securityTxt","title":"Vulnerability disclosure policy published at /.well-known/security.txt","provider":"go.mondoo.com/mql/providers/cloudflare"},"settings":{"name":"settings","type":"\u001bcloudflare.zone.settings","title":"Zone security settings","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"The current status of the zone (initializing, pending, active, or moved)","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"DNS zone type (full or partial)","provider":"go.mondoo.com/mql/providers/cloudflare"},"wafRule":{"name":"wafRule","type":"\u001bcloudflare.zone.wafRule","title":"Cloudflare zone WAF rule (a single rule from a managed or custom ruleset)","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"wafRules":{"name":"wafRules","type":"\u0019\u001bcloudflare.zone.wafRule","title":"WAF rules (managed and custom rulesets, expanded into individual rules)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"workerRoute":{"name":"workerRoute","type":"\u001bcloudflare.zone.workerRoute","title":"Worker route","desc":"Binding of a URL pattern to a Workers script, selected by `pattern`. A route puts its script in front of every request matching the pattern, so a route on `example.com/*` runs on every request to the site, ahead of the origin and with access to the request and response. `worker` resolves the script the route names, and reads null when the route points at a script that no longer exists, which leaves the pattern matching with nothing behind it.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"workerRoutes":{"name":"workerRoutes","type":"\u0019\u001bcloudflare.zone.workerRoute","title":"Worker routes that intercept requests to the zone","desc":"Each route binds a URL pattern to a Workers script that runs in front of every matching request. A route on a broad pattern puts its script in the request path of the whole site.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare DNS Zone","desc":"Configuration and security posture of a single Cloudflare DNS zone. A zone corresponds to a registered domain managed through Cloudflare. Query `settings` for TLS, WAF, and HSTS enforcement; `dns` for DNS records; `rulesets` and `wafRules` for firewall policy; `certificatePacks` and `customCertificates` for TLS certificates; `dnssec` for DNSSEC configuration; `botManagement` for bot-mitigation settings; `emailRouting` for SPF/DKIM/DMARC status; and `logpushJobs` for data-export configuration.","private":true,"min_provider_version":"11.0.0","defaults":"name account.name","provider":"go.mondoo.com/mql/providers/cloudflare","root":true},"cloudflare.zone.account":{"id":"cloudflare.zone.account","name":"cloudflare.zone.account","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Account identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Account name","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare account","private":true,"min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.aiAudit":{"id":"cloudflare.zone.aiAudit","name":"cloudflare.zone.aiAudit","fields":{"robotsStatus":{"name":"robotsStatus","type":"\u0005","is_mandatory":true,"title":"HTTP status Cloudflare received fetching the zone's robots.txt","desc":"200 when a file was served. A 404 means the zone publishes no robots.txt, which leaves every crawler undirected rather than denied.","provider":"go.mondoo.com/mql/providers/cloudflare"},"sitemaps":{"name":"sitemaps","type":"\u0019\u0007","is_mandatory":true,"title":"Sitemap URLs advertised in robots.txt","provider":"go.mondoo.com/mql/providers/cloudflare"},"userAgent":{"name":"userAgent","type":"\u001bcloudflare.zone.aiAudit.userAgent","title":"Crawler directives for one user agent","desc":"The robots.txt rules that apply to a single named crawler, selected by userAgent. Covers the allowed and disallowed path patterns, the requested crawl delay, and the content signals that state whether the site permits its content to be used for AI training, as AI input, or for search indexing.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"userAgents":{"name":"userAgents","type":"\u0019\u001bcloudflare.zone.aiAudit.userAgent","title":"Parsed directives, one entry per user agent named in robots.txt","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Crawler directives for the zone","desc":"The zone's robots.txt as Cloudflare fetched and parsed it, which is what governs whether AI crawlers may read the site and whether its content may be used for model training. The robotsStatus field carries the HTTP status of the fetch, so a zone serving no robots.txt at all is visible as a status rather than as an empty rule set, and userAgents lists the parsed rules per crawler.","private":true,"min_provider_version":"13.7.2","defaults":"robotsStatus","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.aiAudit.userAgent":{"id":"cloudflare.zone.aiAudit.userAgent","name":"cloudflare.zone.aiAudit.userAgent","fields":{"allow":{"name":"allow","type":"\u0019\u0007","is_mandatory":true,"title":"Path patterns the crawler is allowed to fetch","provider":"go.mondoo.com/mql/providers/cloudflare"},"contentSignalAiInput":{"name":"contentSignalAiInput","type":"\u0007","is_mandatory":true,"title":"Whether the site permits its content to be used as AI input","desc":"Carries the ai-input content signal, which covers retrieval and grounding rather than training. Empty when robots.txt states none.","provider":"go.mondoo.com/mql/providers/cloudflare"},"contentSignalAiTrain":{"name":"contentSignalAiTrain","type":"\u0007","is_mandatory":true,"title":"Whether the site permits its content to be used for AI training","desc":"Carries the ai-train content signal, empty when robots.txt states none.","provider":"go.mondoo.com/mql/providers/cloudflare"},"contentSignalSearch":{"name":"contentSignalSearch","type":"\u0007","is_mandatory":true,"title":"Whether the site permits its content to be indexed for search","desc":"Carries the search content signal, empty when robots.txt states none.","provider":"go.mondoo.com/mql/providers/cloudflare"},"crawlDelay":{"name":"crawlDelay","type":"\u0006","is_mandatory":true,"title":"Seconds the crawler is asked to wait between requests, 0 when unset","provider":"go.mondoo.com/mql/providers/cloudflare"},"disallow":{"name":"disallow","type":"\u0019\u0007","is_mandatory":true,"title":"Path patterns the crawler is told not to fetch","provider":"go.mondoo.com/mql/providers/cloudflare"},"userAgent":{"name":"userAgent","type":"\u0007","is_mandatory":true,"title":"User agent string the directives apply to, or * for the default rules","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Crawler directives for one user agent","desc":"The robots.txt rules that apply to a single named crawler, selected by userAgent. Covers the allowed and disallowed path patterns, the requested crawl delay, and the content signals that state whether the site permits its content to be used for AI training, as AI input, or for search indexing.","private":true,"min_provider_version":"13.7.2","defaults":"userAgent","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.aiSecurity":{"id":"cloudflare.zone.aiSecurity","name":"cloudflare.zone.aiSecurity","fields":{"customTopic":{"name":"customTopic","type":"\u001bcloudflare.zone.aiSecurity.customTopic","title":"AI Security custom topic category","desc":"A site-specific category AI Security matches prompt and response content against, in addition to the built-in categories. The label selects the topic and the topic field carries the description the classifier matches on.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"customTopics":{"name":"customTopics","type":"\u0019\u001bcloudflare.zone.aiSecurity.customTopic","title":"Site-specific topic categories used for content detection","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether AI Security for Apps is enabled on the zone","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"AI Security for Apps","desc":"Inspection of prompts and responses passing through the zone, which lets Cloudflare classify model traffic by topic and act on it before it reaches an application. The enabled field reports whether that inspection runs at all, so a zone fronting an AI application with it switched off is passing prompts through unexamined. The customTopics collection carries the site-specific categories added on top of the built-in ones.","private":true,"min_provider_version":"13.7.2","defaults":"enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.aiSecurity.customTopic":{"id":"cloudflare.zone.aiSecurity.customTopic","name":"cloudflare.zone.aiSecurity.customTopic","fields":{"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Unique label identifying the topic category","provider":"go.mondoo.com/mql/providers/cloudflare"},"topic":{"name":"topic","type":"\u0007","is_mandatory":true,"title":"Description of the content the category matches","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"AI Security custom topic category","desc":"A site-specific category AI Security matches prompt and response content against, in addition to the built-in categories. The label selects the topic and the topic field carries the description the classifier matches on.","private":true,"min_provider_version":"13.7.2","defaults":"label topic","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.authenticatedOriginPulls":{"id":"cloudflare.zone.authenticatedOriginPulls","name":"cloudflare.zone.authenticatedOriginPulls","fields":{"certificate":{"name":"certificate","type":"\u001bcloudflare.zone.authenticatedOriginPulls.certificate","title":"Zone-level authenticated origin pull certificate","desc":"Certificate Cloudflare presents to the origin for every host in the zone. The `status` field reports where the certificate sits in its activation lifecycle and `expiresOn` bounds its validity, so a review can catch a certificate about to lapse and break origin connectivity.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"certificates":{"name":"certificates","type":"\u0019\u001bcloudflare.zone.authenticatedOriginPulls.certificate","title":"Zone-level certificates Cloudflare presents to the origin","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether zone-level authenticated origin pulls is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostname":{"name":"hostname","type":"\u001bcloudflare.zone.authenticatedOriginPulls.hostname","title":"Per-hostname authenticated origin pull binding","desc":"Binding between one origin hostname and the certificate Cloudflare presents when connecting to it, which overrides the zone-wide setting. The `enabled` field reports whether enforcement is active for that hostname, so a zone with zone-level enforcement on can still have individual hostnames opted out. The `hostname` field names the origin host, and `certificate` resolves the bound certificate.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"hostnameCertificate":{"name":"hostnameCertificate","type":"\u001bcloudflare.zone.authenticatedOriginPulls.hostnameCertificate","title":"Certificate for per-hostname authenticated origin pulls","desc":"Certificate available for binding to individual origin hostnames. Listing these alongside the hostname bindings surfaces certificates that were uploaded but never bound, and reports `expiresOn` and `status` for the ones in use.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"hostnameCertificates":{"name":"hostnameCertificates","type":"\u0019\u001bcloudflare.zone.authenticatedOriginPulls.hostnameCertificate","title":"Certificates available for per-hostname authenticated origin pulls","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostnames":{"name":"hostnames","type":"\u0019\u001bcloudflare.zone.authenticatedOriginPulls.hostname","title":"Per-hostname authenticated origin pull bindings","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Authenticated origin pulls","desc":"Configuration for the mTLS handshake Cloudflare performs when connecting to the zone's origin, which proves to the origin that a request arrived through Cloudflare rather than directly from the internet. The `enabled` field reports whether zone-wide enforcement is on, `certificates` lists the zone-level certificates Cloudflare presents, `hostnames` covers per-hostname enforcement that overrides the zone-wide setting, and `hostnameCertificates` lists the certificates available for those per-hostname bindings.","private":true,"min_provider_version":"13.6.8","defaults":"enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.authenticatedOriginPulls.certificate":{"id":"cloudflare.zone.authenticatedOriginPulls.certificate","name":"cloudflare.zone.authenticatedOriginPulls.certificate","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether this certificate is enabled for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresOn":{"name":"expiresOn","type":"\t","is_mandatory":true,"title":"Date the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate authority that issued the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"signature":{"name":"signature","type":"\u0007","is_mandatory":true,"title":"Type of hash used for the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the certificate activation","provider":"go.mondoo.com/mql/providers/cloudflare"},"uploadedOn":{"name":"uploadedOn","type":"\t","is_mandatory":true,"title":"Time the certificate was uploaded","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Zone-level authenticated origin pull certificate","desc":"Certificate Cloudflare presents to the origin for every host in the zone. The `status` field reports where the certificate sits in its activation lifecycle and `expiresOn` bounds its validity, so a review can catch a certificate about to lapse and break origin connectivity.","private":true,"min_provider_version":"13.6.8","defaults":"id status expiresOn","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.authenticatedOriginPulls.hostname":{"id":"cloudflare.zone.authenticatedOriginPulls.hostname","name":"cloudflare.zone.authenticatedOriginPulls.hostname","fields":{"certStatus":{"name":"certStatus","type":"\u0007","is_mandatory":true,"title":"Status of the bound certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"certUpdatedAt":{"name":"certUpdatedAt","type":"\t","is_mandatory":true,"title":"Time the certificate was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"certUploadedOn":{"name":"certUploadedOn","type":"\t","is_mandatory":true,"title":"Time the certificate was uploaded","provider":"go.mondoo.com/mql/providers/cloudflare"},"certificate":{"name":"certificate","type":"\u001bcloudflare.zone.authenticatedOriginPulls.hostnameCertificate","title":"Certificate bound to this hostname","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the binding was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether hostname-level authenticated origin pulls is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresOn":{"name":"expiresOn","type":"\t","is_mandatory":true,"title":"Date the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Origin hostname the certificate is used for","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate authority that issued the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number on the uploaded certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"signature":{"name":"signature","type":"\u0007","is_mandatory":true,"title":"Type of hash used for the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the binding","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the binding was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Per-hostname authenticated origin pull binding","desc":"Binding between one origin hostname and the certificate Cloudflare presents when connecting to it, which overrides the zone-wide setting. The `enabled` field reports whether enforcement is active for that hostname, so a zone with zone-level enforcement on can still have individual hostnames opted out. The `hostname` field names the origin host, and `certificate` resolves the bound certificate.","private":true,"min_provider_version":"13.6.8","defaults":"hostname enabled status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.authenticatedOriginPulls.hostnameCertificate":{"id":"cloudflare.zone.authenticatedOriginPulls.hostnameCertificate","name":"cloudflare.zone.authenticatedOriginPulls.hostnameCertificate","fields":{"expiresOn":{"name":"expiresOn","type":"\t","is_mandatory":true,"title":"Date the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate authority that issued the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number on the uploaded certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"signature":{"name":"signature","type":"\u0007","is_mandatory":true,"title":"Type of hash used for the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"uploadedOn":{"name":"uploadedOn","type":"\t","is_mandatory":true,"title":"Time the certificate was uploaded","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Certificate for per-hostname authenticated origin pulls","desc":"Certificate available for binding to individual origin hostnames. Listing these alongside the hostname bindings surfaces certificates that were uploaded but never bound, and reports `expiresOn` and `status` for the ones in use.","private":true,"min_provider_version":"13.6.8","defaults":"id status expiresOn","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.botManagement":{"id":"cloudflare.zone.botManagement","name":"cloudflare.zone.botManagement","fields":{"aiBotsProtection":{"name":"aiBotsProtection","type":"\u0007","is_mandatory":true,"title":"AI bots protection setting (block, disabled)","provider":"go.mondoo.com/mql/providers/cloudflare"},"autoUpdateModel":{"name":"autoUpdateModel","type":"\u0004","is_mandatory":true,"title":"Whether the model auto-updates","provider":"go.mondoo.com/mql/providers/cloudflare"},"enableJs":{"name":"enableJs","type":"\u0004","is_mandatory":true,"title":"Whether JavaScript detections are enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"fightMode":{"name":"fightMode","type":"\u0004","is_mandatory":true,"title":"Whether bot fight mode is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"optimizeWordpress":{"name":"optimizeWordpress","type":"\u0004","is_mandatory":true,"title":"Whether WordPress optimization is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"sbfmDefinitelyAutomated":{"name":"sbfmDefinitelyAutomated","type":"\u0007","is_mandatory":true,"title":"Action for definitely automated requests (block, managed_challenge, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"sbfmLikelyAutomated":{"name":"sbfmLikelyAutomated","type":"\u0007","is_mandatory":true,"title":"Action for likely automated requests","provider":"go.mondoo.com/mql/providers/cloudflare"},"sbfmStaticResourceProtection":{"name":"sbfmStaticResourceProtection","type":"\u0004","is_mandatory":true,"title":"Whether static resource protection is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"sbfmVerifiedBots":{"name":"sbfmVerifiedBots","type":"\u0007","is_mandatory":true,"title":"Action for verified bots","provider":"go.mondoo.com/mql/providers/cloudflare"},"usingLatestModel":{"name":"usingLatestModel","type":"\u0004","is_mandatory":true,"title":"Whether the latest model is being used","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone bot management settings","private":true,"min_provider_version":"13.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.certificatePack":{"id":"cloudflare.zone.certificatePack","name":"cloudflare.zone.certificatePack","fields":{"certificateAuthority":{"name":"certificateAuthority","type":"\u0007","is_mandatory":true,"title":"Certificate authority used","provider":"go.mondoo.com/mql/providers/cloudflare"},"hosts":{"name":"hosts","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames covered by the certificate pack","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate pack identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Certificate pack status","provider":"go.mondoo.com/mql/providers/cloudflare"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Certificate pack type","provider":"go.mondoo.com/mql/providers/cloudflare"},"validationMethod":{"name":"validationMethod","type":"\u0007","is_mandatory":true,"title":"Domain control validation method","provider":"go.mondoo.com/mql/providers/cloudflare"},"validityDays":{"name":"validityDays","type":"\u0005","is_mandatory":true,"title":"Certificate validity in days","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare managed certificate pack (Cloudflare-issued)","private":true,"min_provider_version":"11.1.0","defaults":"id status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.clientCertificate":{"id":"cloudflare.zone.clientCertificate","name":"cloudflare.zone.clientCertificate","fields":{"certificateAuthorityId":{"name":"certificateAuthorityId","type":"\u0007","is_mandatory":true,"title":"Identifier of the certificate authority that issued the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"certificateAuthorityName":{"name":"certificateAuthorityName","type":"\u0007","is_mandatory":true,"title":"Name of the certificate authority that issued the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"commonName":{"name":"commonName","type":"\u0007","is_mandatory":true,"title":"Common name of the client certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"country":{"name":"country","type":"\u0007","is_mandatory":true,"title":"Country from the certificate signing request","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresOn":{"name":"expiresOn","type":"\t","is_mandatory":true,"title":"Date the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"fingerprintSha256":{"name":"fingerprintSha256","type":"\u0007","is_mandatory":true,"title":"SHA-256 fingerprint of the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuedOn":{"name":"issuedOn","type":"\t","is_mandatory":true,"title":"Date the certificate was issued by the certificate authority","provider":"go.mondoo.com/mql/providers/cloudflare"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location from the certificate signing request","provider":"go.mondoo.com/mql/providers/cloudflare"},"organization":{"name":"organization","type":"\u0007","is_mandatory":true,"title":"Organization from the certificate signing request","provider":"go.mondoo.com/mql/providers/cloudflare"},"organizationalUnit":{"name":"organizationalUnit","type":"\u0007","is_mandatory":true,"title":"Organizational unit from the certificate signing request","provider":"go.mondoo.com/mql/providers/cloudflare"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number on the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"signature":{"name":"signature","type":"\u0007","is_mandatory":true,"title":"Type of hash used for the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"ski":{"name":"ski","type":"\u0007","is_mandatory":true,"title":"Subject key identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State from the certificate signing request","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Certificate status","desc":"One of active, pending_reactivation, pending_revocation, or revoked.","provider":"go.mondoo.com/mql/providers/cloudflare"},"validityDays":{"name":"validityDays","type":"\u0005","is_mandatory":true,"title":"Number of days the certificate stays valid after its issue date","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Zone client certificate","desc":"Certificate issued by Cloudflare's managed certificate authority for mTLS authentication of clients connecting to the zone. The `status` field reports whether the certificate is active or revoked, with pending_reactivation and pending_revocation marking in-progress transitions, and `expiresOn` bounds its validity. The certificate signing request subject fields record who the certificate was issued to, and `fingerprintSha256` identifies it uniquely. The private key and signing request are never exposed.","private":true,"min_provider_version":"13.6.8","defaults":"commonName status expiresOn","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.contentScanning":{"id":"cloudflare.zone.contentScanning","name":"cloudflare.zone.contentScanning","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether content scanning is enabled for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"modified":{"name":"modified","type":"\t","is_mandatory":true,"title":"Time the content scanning status last changed","provider":"go.mondoo.com/mql/providers/cloudflare"},"payload":{"name":"payload","type":"\u001bcloudflare.zone.contentScanning.payload","title":"Content scanning custom expression","desc":"Ruleset expression that tells the scanner where to find content objects in a request body Cloudflare cannot parse on its own.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"payloads":{"name":"payloads","type":"\u0019\u001bcloudflare.zone.contentScanning.payload","title":"Custom scan expressions","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Content scanning","desc":"Scanning of files uploaded through the zone for malicious content, which lets a ruleset block a request carrying a detected object before it reaches the origin. The `enabled` field reports whether scanning is switched on, `modified` records when that status last changed, and `payloads` lists the custom expressions that point the scanner at content objects in request bodies it cannot parse on its own.","private":true,"min_provider_version":"13.6.8","defaults":"enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.contentScanning.payload":{"id":"cloudflare.zone.contentScanning.payload","name":"cloudflare.zone.contentScanning.payload","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Expression identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"payload":{"name":"payload","type":"\u0007","is_mandatory":true,"title":"Ruleset expression matching content objects in a request","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Content scanning custom expression","desc":"Ruleset expression that tells the scanner where to find content objects in a request body Cloudflare cannot parse on its own.","private":true,"min_provider_version":"13.6.8","defaults":"id payload","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.customCertificate":{"id":"cloudflare.zone.customCertificate","name":"cloudflare.zone.customCertificate","fields":{"bundleMethod":{"name":"bundleMethod","type":"\u0007","is_mandatory":true,"title":"Certificate bundle method","provider":"go.mondoo.com/mql/providers/cloudflare"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"hosts":{"name":"hosts","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames covered by the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate issuer","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedAt":{"name":"modifiedAt","type":"\t","is_mandatory":true,"title":"Time the certificate was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Certificate priority","provider":"go.mondoo.com/mql/providers/cloudflare"},"signature":{"name":"signature","type":"\u0007","is_mandatory":true,"title":"Signature type","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Certificate status","provider":"go.mondoo.com/mql/providers/cloudflare"},"uploadedAt":{"name":"uploadedAt","type":"\t","is_mandatory":true,"title":"Time the certificate was uploaded","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare custom SSL certificate (user-uploaded)","private":true,"min_provider_version":"11.1.0","defaults":"id status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.customHostname":{"id":"cloudflare.zone.customHostname","name":"cloudflare.zone.customHostname","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the custom hostname was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"customOriginServer":{"name":"customOriginServer","type":"\u0007","is_mandatory":true,"title":"Custom origin server","provider":"go.mondoo.com/mql/providers/cloudflare"},"customOriginSni":{"name":"customOriginSni","type":"\u0007","is_mandatory":true,"title":"Custom origin SNI","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"The custom hostname","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Custom hostname identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"sslMethod":{"name":"sslMethod","type":"\u0007","is_mandatory":true,"title":"SSL validation method","provider":"go.mondoo.com/mql/providers/cloudflare"},"sslStatus":{"name":"sslStatus","type":"\u0007","is_mandatory":true,"title":"SSL certificate status","provider":"go.mondoo.com/mql/providers/cloudflare"},"sslType":{"name":"sslType","type":"\u0007","is_mandatory":true,"title":"SSL certificate type","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Custom hostname status","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare custom hostname","private":true,"min_provider_version":"13.1.0","defaults":"hostname status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.dnssec":{"id":"cloudflare.zone.dnssec","name":"cloudflare.zone.dnssec","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"DNSKEY algorithm","provider":"go.mondoo.com/mql/providers/cloudflare"},"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"DS digest hex value","provider":"go.mondoo.com/mql/providers/cloudflare"},"digestAlgorithm":{"name":"digestAlgorithm","type":"\u0007","is_mandatory":true,"title":"DS digest algorithm","provider":"go.mondoo.com/mql/providers/cloudflare"},"digestType":{"name":"digestType","type":"\u0007","is_mandatory":true,"title":"DS digest type","provider":"go.mondoo.com/mql/providers/cloudflare"},"ds":{"name":"ds","type":"\u0007","is_mandatory":true,"title":"DS resource record (parent-zone-ready string)","provider":"go.mondoo.com/mql/providers/cloudflare"},"flags":{"name":"flags","type":"\u0005","is_mandatory":true,"title":"DNSKEY flags","provider":"go.mondoo.com/mql/providers/cloudflare"},"keyTag":{"name":"keyTag","type":"\u0005","is_mandatory":true,"title":"DNSKEY key tag","provider":"go.mondoo.com/mql/providers/cloudflare"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"DNSKEY key type","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the configuration was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"publicKey":{"name":"publicKey","type":"\u0007","is_mandatory":true,"title":"DNSKEY public key","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"DNSSEC status (active, disabled, pending)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone DNSSEC configuration","private":true,"min_provider_version":"13.1.1","defaults":"status algorithm","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.emailRouting":{"id":"cloudflare.zone.emailRouting","name":"cloudflare.zone.emailRouting","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the configuration was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"dmarcConfigured":{"name":"dmarcConfigured","type":"\u0004","title":"Whether a DMARC (TXT v=DMARC1) record is published for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"dnsRecords":{"name":"dnsRecords","type":"\u0019\n","title":"Suggested DNS records (MX, SPF/TXT, DKIM/TXT, DMARC) required for email-routing configuration","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether email routing is enabled for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedAt":{"name":"modifiedAt","type":"\t","is_mandatory":true,"title":"Time the configuration was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"mxConfigured":{"name":"mxConfigured","type":"\u0004","title":"Whether at least one MX record consistent with email-routing is in place","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Email routing display name","provider":"go.mondoo.com/mql/providers/cloudflare"},"spfConfigured":{"name":"spfConfigured","type":"\u0004","title":"Whether an SPF (TXT v=spf1) record consistent with email-routing is in place","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Email routing status (ready, unconfigured, misconfigured, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare email-routing configuration","private":true,"min_provider_version":"13.1.1","defaults":"enabled status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.hold":{"id":"cloudflare.zone.hold","name":"cloudflare.zone.hold","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether a hold is in force on the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"holdAfter":{"name":"holdAfter","type":"\t","is_mandatory":true,"title":"Time the hold takes effect","desc":"Null when the hold is already in force or none is scheduled. A hold with a future date is not protecting the zone yet.","provider":"go.mondoo.com/mql/providers/cloudflare"},"includeSubdomains":{"name":"includeSubdomains","type":"\u0007","is_mandatory":true,"title":"Whether the hold also covers subdomains of the zone","desc":"Reported as the API does, a string rather than a boolean. Without it a hold on the apex still leaves every subdomain free to be claimed in another account.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Registrar hold on a zone","desc":"Hold that stops the zone from being added to any Cloudflare account after it is removed from this one. Without a hold, deleting a zone frees the domain for anyone to re-add and start serving, which is the standard takeover path for a Cloudflare-fronted domain. Reported as null when the hold state cannot be read, so an unreadable zone is never reported as one with no hold.","private":true,"min_provider_version":"13.8.1","defaults":"enabled includeSubdomains","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.leakedCredentialChecks":{"id":"cloudflare.zone.leakedCredentialChecks","name":"cloudflare.zone.leakedCredentialChecks","fields":{"detection":{"name":"detection","type":"\u001bcloudflare.zone.leakedCredentialChecks.detection","title":"Leaked credential check custom detection","desc":"Pair of ruleset expressions that locate the username and password in a request whose shape Cloudflare cannot infer. The `username` and `password` fields hold the expressions themselves, never credential values.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"detections":{"name":"detections","type":"\u0019\u001bcloudflare.zone.leakedCredentialChecks.detection","title":"Custom detection expressions","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether leaked credential checks are enabled for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Leaked credential checks","desc":"Detection of credentials that appear in known breach corpora as they pass through the zone, which lets a ruleset act on the request before it reaches the origin. The `enabled` field reports whether the feature is switched on, and `detections` lists the custom expressions that tell Cloudflare where usernames and passwords live in request bodies it cannot parse on its own.","private":true,"min_provider_version":"13.6.8","defaults":"enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.leakedCredentialChecks.detection":{"id":"cloudflare.zone.leakedCredentialChecks.detection","name":"cloudflare.zone.leakedCredentialChecks.detection","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Detection identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"password":{"name":"password","type":"\u0007","is_mandatory":true,"title":"Ruleset expression matching the password in a request","provider":"go.mondoo.com/mql/providers/cloudflare"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Ruleset expression matching the username in a request","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Leaked credential check custom detection","desc":"Pair of ruleset expressions that locate the username and password in a request whose shape Cloudflare cannot infer. The `username` and `password` fields hold the expressions themselves, never credential values.","private":true,"min_provider_version":"13.6.8","defaults":"id","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.loadBalancer":{"id":"cloudflare.zone.loadBalancer","name":"cloudflare.zone.loadBalancer","fields":{"countryPools":{"name":"countryPools","type":"\n","is_mandatory":true,"title":"Pool IDs keyed by country code, used under geo steering","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the load balancer was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"defaultPools":{"name":"defaultPools","type":"\u0019\u001bcloudflare.loadBalancerPool","title":"Pools used in the default (non-geo) ordering","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the load balancer is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"fallbackPool":{"name":"fallbackPool","type":"\u001bcloudflare.loadBalancerPool","title":"Pool used when no other pool is healthy","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Load balancer identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the load balancer was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"DNS hostname the load balancer answers for","provider":"go.mondoo.com/mql/providers/cloudflare"},"pools":{"name":"pools","type":"\u0019\u001bcloudflare.loadBalancerPool","title":"Every distinct pool the load balancer references (default, fallback, and geo)","provider":"go.mondoo.com/mql/providers/cloudflare"},"popPools":{"name":"popPools","type":"\n","is_mandatory":true,"title":"Pool IDs keyed by Cloudflare PoP, used under geo steering","provider":"go.mondoo.com/mql/providers/cloudflare"},"proxied":{"name":"proxied","type":"\u0004","is_mandatory":true,"title":"Whether traffic is proxied through Cloudflare (orange-cloud)","provider":"go.mondoo.com/mql/providers/cloudflare"},"regionPools":{"name":"regionPools","type":"\n","is_mandatory":true,"title":"Pool IDs keyed by region code, used under geo steering","provider":"go.mondoo.com/mql/providers/cloudflare"},"sessionAffinity":{"name":"sessionAffinity","type":"\u0007","is_mandatory":true,"title":"Session affinity mode (none, cookie, ip_cookie, header)","provider":"go.mondoo.com/mql/providers/cloudflare"},"sessionAffinityAttributes":{"name":"sessionAffinityAttributes","type":"\n","is_mandatory":true,"title":"Session affinity cookie attributes (samesite, secure, drain_duration, zero_downtime_failover, headers, require_all_headers)","provider":"go.mondoo.com/mql/providers/cloudflare"},"sessionAffinityTtl":{"name":"sessionAffinityTtl","type":"\u0005","is_mandatory":true,"title":"Session affinity TTL, in seconds","provider":"go.mondoo.com/mql/providers/cloudflare"},"steeringPolicy":{"name":"steeringPolicy","type":"\u0007","is_mandatory":true,"title":"Pool selection logic (off, geo, dynamic_latency, random, proximity, least_outstanding_requests, least_connections)","provider":"go.mondoo.com/mql/providers/cloudflare"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"DNS record TTL, in seconds (ignored when proxied)","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare load balancer","desc":"Traffic director that steers requests for a hostname across one or more origin pools. The `steeringPolicy` selects which pool serves a request, `proxied` and `enabled` give its serving state, and session affinity configuration controls stickiness. The `fallbackPool`, `defaultPools`, and `pools` references resolve the backing pools, while `regionPools`, `popPools`, and `countryPools` hold the geo-steering maps of pool IDs.","private":true,"min_provider_version":"13.3.6","defaults":"name steeringPolicy enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.lockdown":{"id":"cloudflare.zone.lockdown","name":"cloudflare.zone.lockdown","fields":{"configurations":{"name":"configurations","type":"\u0019\n","is_mandatory":true,"title":"Addresses permitted to reach the restricted URLs","desc":"Each entry is `{target, value}`, where `target` is `ip` or `ip_range` and `value` is the address or CIDR block.","provider":"go.mondoo.com/mql/providers/cloudflare"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"Time the rule was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Summary recorded with the rule","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Lockdown rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"Time the rule was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"},"paused":{"name":"paused","type":"\u0004","is_mandatory":true,"title":"Whether the rule is defined but not enforced","desc":"True means the URLs are open to every source while the rule stays in the configuration looking like a control.","provider":"go.mondoo.com/mql/providers/cloudflare"},"urls":{"name":"urls","type":"\u0019\u0007","is_mandatory":true,"title":"URL patterns the rule restricts","desc":"Simple wildcard patterns, for example `example.com/wp-admin*`.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Zone Lockdown rule","desc":"Rule restricting a set of URLs to named IP addresses and ranges, used to pin administrative paths such as /wp-admin or a staging host to office addresses. A lockdown with `paused` true is defined but not enforced, and a `configurations` list that has drifted from the addresses actually in use leaves the URLs in `urls` reachable from anywhere with no other signal that anything changed.","private":true,"min_provider_version":"13.8.1","defaults":"description paused urls","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.logpushJob":{"id":"cloudflare.zone.logpushJob","name":"cloudflare.zone.logpushJob","fields":{"dataset":{"name":"dataset","type":"\u0007","is_mandatory":true,"title":"Dataset being pushed","provider":"go.mondoo.com/mql/providers/cloudflare"},"destinationConf":{"name":"destinationConf","type":"\u0007","is_mandatory":true,"title":"Destination configuration URI","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the job is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"errorMessage":{"name":"errorMessage","type":"\u0007","is_mandatory":true,"title":"Last error message","provider":"go.mondoo.com/mql/providers/cloudflare"},"frequency":{"name":"frequency","type":"\u0007","is_mandatory":true,"title":"Push frequency (high, low)","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Job identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastComplete":{"name":"lastComplete","type":"\t","is_mandatory":true,"title":"Time of last successful push","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastError":{"name":"lastError","type":"\t","is_mandatory":true,"title":"Time of last error","provider":"go.mondoo.com/mql/providers/cloudflare"},"logpullOptions":{"name":"logpullOptions","type":"\u0007","is_mandatory":true,"title":"Logpull options string","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Job name","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone logpush job","private":true,"min_provider_version":"13.1.0","defaults":"name dataset","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.originCACertificate":{"id":"cloudflare.zone.originCACertificate","name":"cloudflare.zone.originCACertificate","fields":{"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the certificate expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames covered by the certificate","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"requestType":{"name":"requestType","type":"\u0007","is_mandatory":true,"title":"Certificate request type (origin-rsa, origin-ecc)","provider":"go.mondoo.com/mql/providers/cloudflare"},"requestValidity":{"name":"requestValidity","type":"\u0005","is_mandatory":true,"title":"Requested validity in days","provider":"go.mondoo.com/mql/providers/cloudflare"},"revokedAt":{"name":"revokedAt","type":"\t","is_mandatory":true,"title":"Time the certificate was revoked","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare origin CA certificate","private":true,"min_provider_version":"13.1.0","defaults":"id requestType","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.owner":{"id":"cloudflare.zone.owner","name":"cloudflare.zone.owner","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Owner identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Owner name","provider":"go.mondoo.com/mql/providers/cloudflare"},"ownerType":{"name":"ownerType","type":"\u0007","is_mandatory":true,"title":"Owner type","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone owner","private":true,"min_provider_version":"11.1.0","defaults":"name","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.pageRule":{"id":"cloudflare.zone.pageRule","name":"cloudflare.zone.pageRule","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the page rule was created","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Page rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Page rule priority","provider":"go.mondoo.com/mql/providers/cloudflare"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Page rule status (active, disabled)","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the page rule was last modified","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone page rule","private":true,"min_provider_version":"13.1.0","defaults":"id status","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.precursor":{"id":"cloudflare.zone.precursor","name":"cloudflare.zone.precursor","fields":{"defaultMode":{"name":"defaultMode","type":"\u0007","is_mandatory":true,"title":"Enforcement mode applied to requests matching no enforcement rule","desc":"One of `off`, `min-friction`, or `max-security`.","provider":"go.mondoo.com/mql/providers/cloudflare"},"enforcementRule":{"name":"enforcementRule","type":"\u001bcloudflare.zone.precursor.enforcementRule","title":"Cloudflare Precursor enforcement rule","desc":"A single override in a zone's Precursor rule list. `expression` is the filter that decides which requests the rule matches and `mode` is the enforcement applied to them. `enabled` reports whether the rule is evaluated at all, so a rule that appears to tighten the posture may be inert.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"enforcementRules":{"name":"enforcementRules","type":"\u0019\u001bcloudflare.zone.precursor.enforcementRule","is_mandatory":true,"title":"Ordered list of rules that override the default enforcement mode","desc":"Empty when the zone relies on `defaultMode` alone. Cloudflare evaluates the rules in the order returned.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Precursor enforcement for a zone","desc":"Enforcement posture Precursor applies to requests arriving at the zone. `defaultMode` is the mode used for any request that matches no rule: `off` disables enforcement entirely, `min-friction` favors letting visitors through, and `max-security` favors challenging or blocking them. `enforcementRules` is the ordered list of overrides evaluated ahead of that default. Use it to find zones left with enforcement off, or rules that relax the posture for a subset of traffic.","private":true,"min_provider_version":"13.8.1","defaults":"defaultMode","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.precursor.enforcementRule":{"id":"cloudflare.zone.precursor.enforcementRule","name":"cloudflare.zone.precursor.enforcementRule","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the rule (empty when none was provided)","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is currently evaluated","provider":"go.mondoo.com/mql/providers/cloudflare"},"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"Filter expression deciding which requests the rule matches","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier assigned by Cloudflare","provider":"go.mondoo.com/mql/providers/cloudflare"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Enforcement mode applied to matching requests","desc":"One of `min-friction` or `max-security`. Unlike the zone-level `defaultMode`, a rule cannot set `off`.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare Precursor enforcement rule","desc":"A single override in a zone's Precursor rule list. `expression` is the filter that decides which requests the rule matches and `mode` is the enforcement applied to them. `enabled` reports whether the rule is evaluated at all, so a rule that appears to tighten the posture may be inert.","private":true,"min_provider_version":"13.8.1","defaults":"mode expression enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.rateLimitRule":{"id":"cloudflare.zone.rateLimitRule","name":"cloudflare.zone.rateLimitRule","fields":{"action":{"name":"action","type":"\n","is_mandatory":true,"title":"Action taken when the threshold is exceeded ({mode, timeout, response})","provider":"go.mondoo.com/mql/providers/cloudflare"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Rule description","provider":"go.mondoo.com/mql/providers/cloudflare"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is disabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"methods":{"name":"methods","type":"\u0019\u0007","is_mandatory":true,"title":"HTTP methods matched by this rule","provider":"go.mondoo.com/mql/providers/cloudflare"},"period":{"name":"period","type":"\u0005","is_mandatory":true,"title":"Window over which `threshold` is measured (seconds)","provider":"go.mondoo.com/mql/providers/cloudflare"},"responseStatuses":{"name":"responseStatuses","type":"\u0019\u0005","is_mandatory":true,"title":"Origin response status codes matched by this rule","provider":"go.mondoo.com/mql/providers/cloudflare"},"schemes":{"name":"schemes","type":"\u0019\u0007","is_mandatory":true,"title":"HTTP schemes matched by this rule (HTTP, HTTPS, _ALL_)","provider":"go.mondoo.com/mql/providers/cloudflare"},"threshold":{"name":"threshold","type":"\u0005","is_mandatory":true,"title":"Number of requests allowed within `period` before the action triggers","provider":"go.mondoo.com/mql/providers/cloudflare"},"urlPattern":{"name":"urlPattern","type":"\u0007","is_mandatory":true,"title":"Request URL pattern matched by this rule","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone rate-limit rule (legacy rate-limiting product)","private":true,"min_provider_version":"13.1.1","defaults":"id action.mode threshold","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.ruleset":{"id":"cloudflare.zone.ruleset","name":"cloudflare.zone.ruleset","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Ruleset description","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Ruleset identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Ruleset kind (managed, root, zone, custom)","provider":"go.mondoo.com/mql/providers/cloudflare"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Ruleset name","provider":"go.mondoo.com/mql/providers/cloudflare"},"phase":{"name":"phase","type":"\u0007","is_mandatory":true,"title":"Ruleset phase (http_request_firewall_managed, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the ruleset was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Ruleset version","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone ruleset","private":true,"min_provider_version":"13.1.0","defaults":"name phase","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.securityTxt":{"id":"cloudflare.zone.securityTxt","name":"cloudflare.zone.securityTxt","fields":{"acknowledgments":{"name":"acknowledgments","type":"\u0019\u0007","is_mandatory":true,"title":"Links acknowledging researchers who reported vulnerabilities","provider":"go.mondoo.com/mql/providers/cloudflare"},"canonical":{"name":"canonical","type":"\u0019\u0007","is_mandatory":true,"title":"Canonical URIs the security.txt file is served from","provider":"go.mondoo.com/mql/providers/cloudflare"},"contact":{"name":"contact","type":"\u0019\u0007","is_mandatory":true,"title":"Channels for reporting a vulnerability","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether a security.txt file is published for the zone","provider":"go.mondoo.com/mql/providers/cloudflare"},"encryption":{"name":"encryption","type":"\u0019\u0007","is_mandatory":true,"title":"Links to keys for encrypting vulnerability reports","provider":"go.mondoo.com/mql/providers/cloudflare"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Date after which the published policy is no longer valid","provider":"go.mondoo.com/mql/providers/cloudflare"},"hiring":{"name":"hiring","type":"\u0019\u0007","is_mandatory":true,"title":"Links to security-related job openings","provider":"go.mondoo.com/mql/providers/cloudflare"},"policy":{"name":"policy","type":"\u0019\u0007","is_mandatory":true,"title":"Links to the zone's vulnerability disclosure policy","provider":"go.mondoo.com/mql/providers/cloudflare"},"preferredLanguages":{"name":"preferredLanguages","type":"\u0007","is_mandatory":true,"title":"Preferred languages for vulnerability reports","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Vulnerability disclosure policy (security.txt)","desc":"Contents of the security.txt file Cloudflare serves at /.well-known/security.txt for the zone, which tells researchers how to report a vulnerability. The `enabled` field reports whether the file is published at all, `contact` carries the reporting channels, and `expires` marks the date after which the published policy should no longer be trusted.","private":true,"min_provider_version":"13.6.8","defaults":"enabled expires","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.settings":{"id":"cloudflare.zone.settings","name":"cloudflare.zone.settings","fields":{"alwaysUseHttps":{"name":"alwaysUseHttps","type":"\u0007","is_mandatory":true,"title":"Whether HTTPS is always used (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"automaticHttpsRewrites":{"name":"automaticHttpsRewrites","type":"\u0007","is_mandatory":true,"title":"Automatic HTTPS rewrites (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"browserCheck":{"name":"browserCheck","type":"\u0007","is_mandatory":true,"title":"Browser integrity check (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"challengeTtl":{"name":"challengeTtl","type":"\u0005","is_mandatory":true,"title":"Challenge page TTL, how long a visitor's challenge clearance lasts, in seconds","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"ciphers":{"name":"ciphers","type":"\u0019\u0007","is_mandatory":true,"title":"Cipher suites the zone accepts from visitors","desc":"The explicit allowlist of TLS cipher suites, by IANA name, for example ECDHE-ECDSA-AES128-GCM-SHA256. Empty means the zone accepts Cloudflare's default set for its plan. A weak suite listed here is negotiable even when minTlsVersion looks correct, because the allowlist overrides the default set rather than narrowing it.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"developmentMode":{"name":"developmentMode","type":"\u0007","is_mandatory":true,"title":"Development mode (on, off)","desc":"While on, Cloudflare bypasses its edge cache and disables the performance features that rewrite responses. It expires on its own after three hours, so a zone found with it on is either mid-change or has had it re-enabled.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"emailObfuscation":{"name":"emailObfuscation","type":"\u0007","is_mandatory":true,"title":"Email obfuscation (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"hotlinkProtection":{"name":"hotlinkProtection","type":"\u0007","is_mandatory":true,"title":"Hotlink protection (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"hstsEnabled":{"name":"hstsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether HSTS (Strict-Transport-Security) is enabled for the zone","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"hstsIncludeSubdomains":{"name":"hstsIncludeSubdomains","type":"\u0004","is_mandatory":true,"title":"Whether HSTS applies to subdomains","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"hstsMaxAge":{"name":"hstsMaxAge","type":"\u0005","is_mandatory":true,"title":"HSTS max-age (in seconds)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"hstsNoSniff":{"name":"hstsNoSniff","type":"\u0004","is_mandatory":true,"title":"Whether the X-Content-Type-Options: nosniff header is sent alongside HSTS","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"hstsPreload":{"name":"hstsPreload","type":"\u0004","is_mandatory":true,"title":"Whether the domain is signaled as eligible for HSTS preload list inclusion","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"http3":{"name":"http3","type":"\u0007","is_mandatory":true,"title":"HTTP/3 (QUIC) support (on, off)","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"ipGeolocation":{"name":"ipGeolocation","type":"\u0007","is_mandatory":true,"title":"IP geolocation header that adds CF-IPCountry to origin requests (on, off)","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"minTlsVersion":{"name":"minTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version (1.0, 1.1, 1.2, 1.3)","provider":"go.mondoo.com/mql/providers/cloudflare"},"nelEnabled":{"name":"nelEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Network Error Logging is enabled for the zone","desc":"NEL asks browsers to report failed requests back to Cloudflare. Null when the setting is not present in the zone's settings response, which is not the same as it being turned off.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"opportunisticEncryption":{"name":"opportunisticEncryption","type":"\u0007","is_mandatory":true,"title":"Opportunistic encryption (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"replaceInsecureJs":{"name":"replaceInsecureJs","type":"\u0007","is_mandatory":true,"title":"Automatic rewriting of insecure JavaScript URLs (on, off)","desc":"When on, Cloudflare rewrites http:// script sources in HTML responses to https://, so a page served over HTTPS does not pull scripts over plain HTTP. Off leaves mixed active content to the browser to block or not.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"securityLevel":{"name":"securityLevel","type":"\u0007","is_mandatory":true,"title":"Security level (essentially_off, low, medium, high, under_attack)","provider":"go.mondoo.com/mql/providers/cloudflare"},"serverSideExcludes":{"name":"serverSideExcludes","type":"\u0007","is_mandatory":true,"title":"Server-side excludes (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"ssl":{"name":"ssl","type":"\u0007","is_mandatory":true,"title":"SSL/TLS encryption mode (off, flexible, full, strict)","provider":"go.mondoo.com/mql/providers/cloudflare"},"tls13":{"name":"tls13","type":"\u0007","is_mandatory":true,"title":"TLS 1.3 support (on, off, zrt)","provider":"go.mondoo.com/mql/providers/cloudflare"},"trueClientIpHeader":{"name":"trueClientIpHeader","type":"\u0007","is_mandatory":true,"title":"True-Client-IP header sent to the origin (on, off; Enterprise only)","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"waf":{"name":"waf","type":"\u0007","is_mandatory":true,"title":"Web Application Firewall (on, off)","provider":"go.mondoo.com/mql/providers/cloudflare"},"websockets":{"name":"websockets","type":"\u0007","is_mandatory":true,"title":"WebSocket connections support (on, off)","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"},"zeroRtt":{"name":"zeroRtt","type":"\u0007","is_mandatory":true,"title":"0-RTT connection resumption (on, off)","min_provider_version":"13.3.6","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone security settings","private":true,"min_provider_version":"11.1.0","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.wafRule":{"id":"cloudflare.zone.wafRule","name":"cloudflare.zone.wafRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action (block, challenge, managed_challenge, log, skip, etc.)","provider":"go.mondoo.com/mql/providers/cloudflare"},"categoryOverride":{"name":"categoryOverride","type":"\u001bcloudflare.zone.wafRule.categoryOverride","title":"Override applied to one category of a deployed managed ruleset","desc":"Substitution the deploying rule makes for every rule of the managed ruleset tagged with a given category, selected by `category`. Disabling a category removes a whole class of detections while the managed ruleset itself stays deployed.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Rule description","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"Filter expression","provider":"go.mondoo.com/mql/providers/cloudflare"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"lastUpdated":{"name":"lastUpdated","type":"\t","is_mandatory":true,"title":"Time the rule was last updated","provider":"go.mondoo.com/mql/providers/cloudflare"},"loggingEnabled":{"name":"loggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether a match on this rule is written to the security event log","desc":"Null when the rule carries no logging block, which the API omits for rules where logging is not configurable. False means matches leave no entry in Security Events, so a block or a skip happens with no forensic trail behind it.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"overriddenCategories":{"name":"overriddenCategories","type":"\u0019\u001bcloudflare.zone.wafRule.categoryOverride","is_mandatory":true,"title":"Overrides applied to whole categories of the deployed managed ruleset","desc":"Each entry names one rule category (for example wordpress or joomla) and the action or enablement substituted for every rule tagged with it.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"overriddenRules":{"name":"overriddenRules","type":"\u0019\u001bcloudflare.zone.wafRule.override","is_mandatory":true,"title":"Overrides applied to individual rules of the deployed managed ruleset","desc":"Each entry names one rule of the managed ruleset and the action, enablement, score threshold, or sensitivity substituted for it. A rule disabled here no longer runs even though the managed ruleset it belongs to is deployed and enabled.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"override":{"name":"override","type":"\u001bcloudflare.zone.wafRule.override","title":"Override applied to one rule of a deployed managed ruleset","desc":"Substitution the deploying rule makes for a single rule of the managed ruleset it deploys, selected by `ruleId`. A managed ruleset can be deployed and enabled while individual rules inside it are turned off or downgraded to log through these entries, so the ruleset reads as active while specific detections no longer stop anything.","is_private":true,"provider":"go.mondoo.com/mql/providers/cloudflare","is_implicit_resource":true},"overrideAction":{"name":"overrideAction","type":"\u0007","is_mandatory":true,"title":"Action the override substitutes for every rule of the deployed managed ruleset","desc":"Set when the rule deploys a managed ruleset and overrides the action of every rule inside it, for example rewriting block to log so the ruleset still matches but no longer stops anything. Empty when the deployment carries no ruleset-wide action override.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"overrideEnabled":{"name":"overrideEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the override turns the deployed managed ruleset on or off as a whole","desc":"False disables every rule of the managed ruleset while the deployment rule itself still reads enabled, which is one of the commonest ways a WAF is left in place but stops enforcing. Null when the deployment carries no ruleset-wide enable override.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"overrideSensitivityLevel":{"name":"overrideSensitivityLevel","type":"\u0007","is_mandatory":true,"title":"Sensitivity level the override applies to the deployed managed ruleset","desc":"One of default, low, medium, high, or eoff. The value eoff turns the managed ruleset's detections off entirely.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitCharacteristics":{"name":"rateLimitCharacteristics","type":"\u0019\u0007","is_mandatory":true,"title":"Fields the rate-limit counter groups requests by","desc":"For example ip.src or cf.colo.id. A counter keyed on a field an attacker controls, or keyed so broadly that unrelated clients share a bucket, does not hold in practice.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitCountingExpression":{"name":"rateLimitCountingExpression","type":"\u0007","is_mandatory":true,"title":"Expression selecting which requests the rate-limit counter counts","desc":"When set, requests are counted only while this expression matches, which can be narrower than the rule's own expression. Empty when the rule counts every request it matches.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitMitigationTimeout":{"name":"rateLimitMitigationTimeout","type":"\u0005","is_mandatory":true,"title":"Seconds a rate-limit mitigation stays in force once the threshold is crossed","desc":"Null on rules that carry no rate-limit configuration.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitPeriod":{"name":"rateLimitPeriod","type":"\u0005","is_mandatory":true,"title":"Rate-limit counting window in seconds","desc":"One of 10, 60, 600, 3600, or 86400. Null on rules that carry no rate-limit configuration.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitRequestsPerPeriod":{"name":"rateLimitRequestsPerPeriod","type":"\u0005","is_mandatory":true,"title":"Requests allowed per counting period before mitigation starts","desc":"Null on rules that carry no rate-limit configuration. Together with rateLimitPeriod this is the threshold a rate-limit rule enforces.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"rateLimitRequestsToOrigin":{"name":"rateLimitRequestsToOrigin","type":"\u0004","is_mandatory":true,"title":"Whether the rate limit counts only requests that reached the origin","desc":"True means cached responses are not counted, so the threshold applies to origin load rather than to total request volume. Null on rules that carry no rate-limit configuration.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"ref":{"name":"ref","type":"\u0007","is_mandatory":true,"title":"Rule reference tag","provider":"go.mondoo.com/mql/providers/cloudflare"},"rulesetId":{"name":"rulesetId","type":"\u0007","is_mandatory":true,"title":"Ruleset this rule belongs to","provider":"go.mondoo.com/mql/providers/cloudflare"},"rulesetKind":{"name":"rulesetKind","type":"\u0007","is_mandatory":true,"title":"Ruleset kind (managed, custom, root, zone)","provider":"go.mondoo.com/mql/providers/cloudflare"},"rulesetName":{"name":"rulesetName","type":"\u0007","is_mandatory":true,"title":"Ruleset name","provider":"go.mondoo.com/mql/providers/cloudflare"},"rulesetPhase":{"name":"rulesetPhase","type":"\u0007","is_mandatory":true,"title":"Ruleset phase (e.g., http_request_firewall_managed, http_request_firewall_custom)","provider":"go.mondoo.com/mql/providers/cloudflare"},"scoreThreshold":{"name":"scoreThreshold","type":"\u0005","is_mandatory":true,"title":"Score threshold for the rule (managed rulesets)","provider":"go.mondoo.com/mql/providers/cloudflare"},"skipPhases":{"name":"skipPhases","type":"\u0019\u0007","is_mandatory":true,"title":"Phases a skip rule bypasses","desc":"Set only on rules whose action is skip. Each entry names a ruleset phase (for example http_request_firewall_managed or http_ratelimit) that is not evaluated at all for a matching request.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"skipProducts":{"name":"skipProducts","type":"\u0019\u0007","is_mandatory":true,"title":"Security products a skip rule bypasses","desc":"Set only on rules whose action is skip. Values include waf, uaBlock, bic, hot, securityLevel, rateLimit, and zoneLockdown. A skip rule naming waf turns the whole Web Application Firewall off for every request its expression matches.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"skipRules":{"name":"skipRules","type":"\n","is_mandatory":true,"title":"Individual managed rules a skip rule bypasses","desc":"Set only on rules whose action is skip. The dict maps a managed ruleset identifier to the list of rule identifiers within it that are skipped.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"skipRulesets":{"name":"skipRulesets","type":"\u0019\u0007","is_mandatory":true,"title":"Managed rulesets a skip rule bypasses in full","desc":"Set only on rules whose action is skip, and carries the identifiers of the managed rulesets that are skipped in their entirety.","min_provider_version":"13.8.1","provider":"go.mondoo.com/mql/providers/cloudflare"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Rule version","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Cloudflare zone WAF rule (a single rule from a managed or custom ruleset)","private":true,"min_provider_version":"13.1.1","defaults":"rulesetKind action description","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.wafRule.categoryOverride":{"id":"cloudflare.zone.wafRule.categoryOverride","name":"cloudflare.zone.wafRule.categoryOverride","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action substituted for every rule in the category","desc":"Empty when the override changes only enablement.","provider":"go.mondoo.com/mql/providers/cloudflare"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Rule category this override applies to","desc":"For example wordpress, joomla, or drupal.","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rules in the category are turned on","desc":"False removes every rule of the category from evaluation. Null when the override changes only the action.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Override applied to one category of a deployed managed ruleset","desc":"Substitution the deploying rule makes for every rule of the managed ruleset tagged with a given category, selected by `category`. Disabling a category removes a whole class of detections while the managed ruleset itself stays deployed.","private":true,"min_provider_version":"13.8.1","defaults":"category action enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.wafRule.override":{"id":"cloudflare.zone.wafRule.override","name":"cloudflare.zone.wafRule.override","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action substituted for the rule","desc":"For example block, log, challenge, or managed_challenge. Empty when the override changes only the rule's enablement or scoring.","provider":"go.mondoo.com/mql/providers/cloudflare"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is turned on","desc":"False takes the rule out of evaluation entirely. Null when the override changes only the action, score threshold, or sensitivity.","provider":"go.mondoo.com/mql/providers/cloudflare"},"ruleId":{"name":"ruleId","type":"\u0007","is_mandatory":true,"title":"Identifier of the managed rule this override applies to","provider":"go.mondoo.com/mql/providers/cloudflare"},"scoreThreshold":{"name":"scoreThreshold","type":"\u0005","is_mandatory":true,"title":"Score threshold substituted for the rule","desc":"Null when the override does not change scoring. A raised threshold makes the rule match less often.","provider":"go.mondoo.com/mql/providers/cloudflare"},"sensitivityLevel":{"name":"sensitivityLevel","type":"\u0007","is_mandatory":true,"title":"Sensitivity level substituted for the rule","desc":"One of default, low, medium, high, or eoff. The value eoff turns the rule's detections off entirely. Empty when the override does not change sensitivity.","provider":"go.mondoo.com/mql/providers/cloudflare"},"sensitivityStatus":{"name":"sensitivityStatus","type":"\u0007","is_mandatory":true,"title":"Rule status reported alongside the override","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Override applied to one rule of a deployed managed ruleset","desc":"Substitution the deploying rule makes for a single rule of the managed ruleset it deploys, selected by `ruleId`. A managed ruleset can be deployed and enabled while individual rules inside it are turned off or downgraded to log through these entries, so the ruleset reads as active while specific detections no longer stop anything.","private":true,"min_provider_version":"13.8.1","defaults":"ruleId action enabled","provider":"go.mondoo.com/mql/providers/cloudflare"},"cloudflare.zone.workerRoute":{"id":"cloudflare.zone.workerRoute","name":"cloudflare.zone.workerRoute","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Route identifier","provider":"go.mondoo.com/mql/providers/cloudflare"},"pattern":{"name":"pattern","type":"\u0007","is_mandatory":true,"title":"URL pattern the route matches","desc":"For example `example.com/*` or `api.example.com/v1/*`. Wildcards are matched against the whole request URL.","provider":"go.mondoo.com/mql/providers/cloudflare"},"scriptName":{"name":"scriptName","type":"\u0007","is_mandatory":true,"title":"Name of the Workers script the route runs","desc":"Empty when the route disables Workers for the pattern rather than running a script.","provider":"go.mondoo.com/mql/providers/cloudflare"},"worker":{"name":"worker","type":"\u001bcloudflare.workers.worker","title":"Workers script the route runs","desc":"Null when the route names no script, or names one that is not in the account's script list.","provider":"go.mondoo.com/mql/providers/cloudflare"}},"title":"Worker route","desc":"Binding of a URL pattern to a Workers script, selected by `pattern`. A route puts its script in front of every request matching the pattern, so a route on `example.com/*` runs on every request to the site, ahead of the origin and with access to the request and response. `worker` resolves the script the route names, and reads null when the route points at a script that no longer exists, which leaves the pattern matching with nothing behind it.","private":true,"min_provider_version":"13.8.1","defaults":"pattern scriptName","provider":"go.mondoo.com/mql/providers/cloudflare"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/cloudflare":"cloudflare"}}