Add dedicated article for Limit data export rule

docs/6.x/llms.md

@@ -115,6 +115,7 @@ search:
 - [Virtual Patching](https://docs.wallarm.com/user-guides/rules/vpatch-rule.md): Block requests matching a specific CVE/vulnerability pattern without changing application code (also: vpatch, hotpatch, runtime patching).
 - [Custom Regex Rules](https://docs.wallarm.com/user-guides/rules/regex-rule.md): Define custom attack indicators using regular expressions on chosen request parts (also: regex rule, custom detector).
 - [Sensitive Data Masking](https://docs.wallarm.com/user-guides/rules/sensitive-data-rule.md): Mask sensitive request parts so they are not stored or exported (also: data masking, PII masking, redaction).
+- [Limit Data Export](https://docs.wallarm.com/user-guides/rules/limit-data-export-rule.md): Control whether the Node exports full request and response data to the Cloud, or metadata only, per endpoint (also: limit data export, metadata only, full data export).
 - [Request Parser Configuration](https://docs.wallarm.com/user-guides/rules/request-processing.md): Override how the node parses specific endpoints/parameters (JSON, XML, etc.).
 - [Response Header Manipulation](https://docs.wallarm.com/user-guides/rules/add-replace-response-header.md): Add, remove, or replace response headers (also: HSTS, CSP injection rule).
 - [Overlimit Detection Configuration](https://docs.wallarm.com/user-guides/rules/configure-overlimit-res-detection.md): Tune behavior when request processing exceeds the per-request time budget.

docs/6.x/llms.txt

@@ -111,6 +111,7 @@
 - [Virtual Patching](https://docs.wallarm.com/user-guides/rules/vpatch-rule.md): Block requests matching a specific CVE/vulnerability pattern without changing application code (also: vpatch, hotpatch, runtime patching).
 - [Custom Regex Rules](https://docs.wallarm.com/user-guides/rules/regex-rule.md): Define custom attack indicators using regular expressions on chosen request parts (also: regex rule, custom detector).
 - [Sensitive Data Masking](https://docs.wallarm.com/user-guides/rules/sensitive-data-rule.md): Mask sensitive request parts so they are not stored or exported (also: data masking, PII masking, redaction).
+- [Limit Data Export](https://docs.wallarm.com/user-guides/rules/limit-data-export-rule.md): Control whether the Node exports full request and response data to the Cloud, or metadata only, per endpoint (also: limit data export, metadata only, full data export).
 - [Request Parser Configuration](https://docs.wallarm.com/user-guides/rules/request-processing.md): Override how the node parses specific endpoints/parameters (JSON, XML, etc.).
 - [Response Header Manipulation](https://docs.wallarm.com/user-guides/rules/add-replace-response-header.md): Add, remove, or replace response headers (also: HSTS, CSP injection rule).
 - [Overlimit Detection Configuration](https://docs.wallarm.com/user-guides/rules/configure-overlimit-res-detection.md): Tune behavior when request processing exceeds the per-request time budget.

docs/6.x/user-guides/rules/limit-data-export-rule.md

@@ -0,0 +1 @@
+--8<-- "latest/user-guides/rules/limit-data-export-rule.md"

docs/7.x/llms.md

@@ -116,6 +116,7 @@ search:
 - [Virtual Patching](https://docs.wallarm.com/7.x/user-guides/rules/vpatch-rule.md): Block requests matching a specific CVE/vulnerability pattern without changing application code (also: vpatch, hotpatch, runtime patching).
 - [Custom Regex Rules](https://docs.wallarm.com/7.x/user-guides/rules/regex-rule.md): Define custom attack indicators using regular expressions on chosen request parts (also: regex rule, custom detector).
 - [Sensitive Data Masking](https://docs.wallarm.com/7.x/user-guides/rules/sensitive-data-rule.md): Mask sensitive request parts so they are not stored or exported (also: data masking, PII masking, redaction).
+- [Limit Data Export](https://docs.wallarm.com/7.x/user-guides/rules/limit-data-export-rule.md): Control whether the Node exports full request and response data to the Cloud, or metadata only, per endpoint (also: limit data export, metadata only, full data export).
 - [Request Parser Configuration](https://docs.wallarm.com/7.x/user-guides/rules/request-processing.md): Override how the node parses specific endpoints/parameters (JSON, XML, etc.).
 - [Response Header Manipulation](https://docs.wallarm.com/7.x/user-guides/rules/add-replace-response-header.md): Add, remove, or replace response headers (also: HSTS, CSP injection rule).
 - [Overlimit Detection Configuration](https://docs.wallarm.com/7.x/user-guides/rules/configure-overlimit-res-detection.md): Tune behavior when request processing exceeds the per-request time budget.

docs/7.x/llms.txt

@@ -112,6 +112,7 @@
 - [Virtual Patching](https://docs.wallarm.com/7.x/user-guides/rules/vpatch-rule.md): Block requests matching a specific CVE/vulnerability pattern without changing application code (also: vpatch, hotpatch, runtime patching).
 - [Custom Regex Rules](https://docs.wallarm.com/7.x/user-guides/rules/regex-rule.md): Define custom attack indicators using regular expressions on chosen request parts (also: regex rule, custom detector).
 - [Sensitive Data Masking](https://docs.wallarm.com/7.x/user-guides/rules/sensitive-data-rule.md): Mask sensitive request parts so they are not stored or exported (also: data masking, PII masking, redaction).
+- [Limit Data Export](https://docs.wallarm.com/7.x/user-guides/rules/limit-data-export-rule.md): Control whether the Node exports full request and response data to the Cloud, or metadata only, per endpoint (also: limit data export, metadata only, full data export).
 - [Request Parser Configuration](https://docs.wallarm.com/7.x/user-guides/rules/request-processing.md): Override how the node parses specific endpoints/parameters (JSON, XML, etc.).
 - [Response Header Manipulation](https://docs.wallarm.com/7.x/user-guides/rules/add-replace-response-header.md): Add, remove, or replace response headers (also: HSTS, CSP injection rule).
 - [Overlimit Detection Configuration](https://docs.wallarm.com/7.x/user-guides/rules/configure-overlimit-res-detection.md): Tune behavior when request processing exceeds the per-request time budget.

docs/7.x/user-guides/rules/limit-data-export-rule.md

@@ -0,0 +1 @@
+--8<-- "latest/user-guides/rules/limit-data-export-rule.md"

docs/latest/admin-en/export-to-cloud.md

@@ -47,7 +47,7 @@ This is what data is sent from Wallarm node to Cloud and how you can control it:
 To control:
 
 * [**Mask sensitive data**](../user-guides/rules/sensitive-data-rule.md): create rules of this type for your endpoints or applications to set which request point values should be cut before sending - values will never leave your security perimeter.
-* **Limit data export**: create rules of this type for your endpoints or applications to avoid sending full malicious request data to the Cloud. When the rule is applied, the node preserves the request structure (parameter names and nesting) but masks the values, so parameter values never leave your security perimeter. "Keep headers" mode is available.
+* [**Limit data export**](../user-guides/rules/limit-data-export-rule.md): create rules of this type for your endpoints or applications to avoid sending full malicious request data to the Cloud. When the rule is applied, the node preserves the request structure (parameter names and nesting) but masks the values, so parameter values never leave your security perimeter. "Keep headers" mode is available.
 
     !!! info "Behavior change in NGINX Node 6.12.4"
         Starting from NGINX Node 6.12.4, an applied **Limit data export** rule preserves the request structure (parameter names and nesting) and masks only the values. In earlier versions, the rule switched the matched traffic to metadata only — the node sent just the request method, URI, IP address, HTTP status code, request time, and the `Host` header, while the body, query parameters, and other headers were excluded from both requests and responses.

docs/latest/user-guides/rules/limit-data-export-rule.md

@@ -0,0 +1,48 @@
+[img-limit-data-export]:            ../../images/user-guides/rules/limit-data-export-rule.png
+[api-discovery-enable-link]:        ../../api-discovery/setup.md
+
+# Limiting Data Export
+
+The **Limit data export** [rule](../rules/rules.md) controls whether Wallarm Nodes export full request and response data to the Wallarm Cloud. It allows configuring the export mode per endpoint - either full data or metadata only. This article describes how to use this rule.
+
+## Overview
+
+In the [hybrid](../../about-wallarm/shared-responsibility.md#overview) Wallarm installations, when you manage the Wallarm Nodes in your infrastructure, and Wallarm manages the Wallarm Cloud component, you decide how much of your traffic data leaves your infrastructure. Wallarm provides full visibility of what data is sent from Node to Cloud and a [set of tools](../../admin-en/export-to-cloud.md) to shape this transfer to your needs - limiting data export is one of these tools.
+
+A **Limit data export** rule applies to the traffic matching its [conditions](rules.md#configuring), so you can keep full export for most of your API and reduce it for the endpoints that carry the most sensitive data.
+
+## Export modes
+
+The export mode is set by the **Full data export** value:
+
+| **Full data export** | What the Node exports |
+| ----- | ----- |
+| **Enabled** | Full request and response data. |
+| **Disabled** | Metadata only: the request method, URI, IP address, HTTP status code, request time, and the `Host` header. The body, query parameters, and other headers are excluded from both requests and responses. |
+| **Keep headers** | Metadata and headers. |
+
+!!! warning ""
+    If a request matches the rule conditions, the selected setting applies to both the request and the response data.
+
+## Side effects
+
+Limiting export reduces the data available for analysis, so consider that it can affect:
+
+* The details of [attacks](../../user-guides/events/check-attack.md) and [incidents](../../user-guides/events/check-incident.md)
+* The [API Sessions](../../api-sessions/overview.md) data
+* The [security issues](../../about-wallarm/detecting-vulnerabilities.md) data
+* The accuracy of Threat Replay Testing
+
+To exclude only specific parameters identified as containing sensitive data, such as passwords or tokens, use the [**Mask sensitive data**](sensitive-data-rule.md) rule instead - it cuts the values of the specified request points and keeps the rest of the data exported.
+
+## Creating and applying rule
+
+To set the export mode:
+
+--8<-- "../include/rule-creation-initial-step.md"
+1. Choose **Limit data export**.
+1. In **If request is**, [describe](rules.md#configuring) the scope to apply the rule to.
+1. In **Then**, set **Full data export** to the required [mode](#export-modes).
+1. Wait for the [rule compilation and uploading to the filtering node to complete](rules.md#ruleset-lifecycle).
+
+![Limit data export rule][img-limit-data-export]

docs/latest/user-guides/rules/rules.md

@@ -46,6 +46,7 @@ Using rules, you can control how Wallarm mitigates attacks on your applications
 * Change requests/responses:
 
     * [Mask sensitive data](../../user-guides/rules/sensitive-data-rule.md)
+    * [Limit data export](../../user-guides/rules/limit-data-export-rule.md) to the Wallarm Cloud
     * Configure an additional layer of application security by [changing response headers](../../user-guides/rules/add-replace-response-header.md)
 
 ## Rule branches

mkdocs-6.x.yml

@@ -105,6 +105,7 @@ nav:
         - Virtual Patching: user-guides/rules/vpatch-rule.md
         - Custom Regex Rules: user-guides/rules/regex-rule.md
         - Sensitive Data Masking: user-guides/rules/sensitive-data-rule.md
+        - Limit Data Export: user-guides/rules/limit-data-export-rule.md
         - Request Processing: user-guides/rules/request-processing.md
         - Response Headers: user-guides/rules/add-replace-response-header.md
         - Overlimit Detection: user-guides/rules/configure-overlimit-res-detection.md

mkdocs-7.x.yml

@@ -108,6 +108,7 @@ nav:
         - Virtual Patching: user-guides/rules/vpatch-rule.md
         - Custom Regex Rules: user-guides/rules/regex-rule.md
         - Sensitive Data Masking: user-guides/rules/sensitive-data-rule.md
+        - Limit Data Export: user-guides/rules/limit-data-export-rule.md
         - Request Processing: user-guides/rules/request-processing.md
         - Response Headers: user-guides/rules/add-replace-response-header.md
         - Overlimit Detection: user-guides/rules/configure-overlimit-res-detection.md