CASB - Detect organization-specific risks with CASB custom finding types

<p><a href="https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/">Cloudflare CASB</a> now supports <a href="https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/"><strong>custom finding types</strong></a>, giving security teams full control over the security conditions CASB detects across their SaaS and cloud integrations.</p> <p>In addition to CASB's library of standard finding types, you can now write your own detection logic using <a href="https://www.openpolicyagent.org/docs/policy-language" target="_blank" rel="noopener">Rego<span class="external-link"> ↗︎</span></a>, the open-source policy language from Open Policy Agent (OPA). Use custom finding types to match your organization's own thresholds and exceptions, such as flagging admin accounts without two-factor authentication, and get higher-confidence findings to act on.</p> <img src="https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1194,height=1194,format=webp/_astro/create-custom-finding-type.CF3GXoPZ.png" alt="Create a custom finding type with a name, severity, scope, and Rego detection logic" loading="lazy" decoding="async" width="1194" height="1194"> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="key-capabilities">Key capabilities</h4><a class="anchor-link" href="#key-capabilities"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <ul> <li><strong>Write your own detection logic</strong> — Define exactly what CASB flags using Rego expressions evaluated against asset data from your connected integrations.</li> <li><strong>Target any supported provider and asset class</strong> — Scope a custom finding type to a provider (such as Google Workspace or Microsoft 365) and asset class (such as users, files, or groups), and apply it to all integrations for that provider or a selected subset.</li> <li><strong>Built-in validation</strong> — Select <strong>Validate</strong> to check your expression for syntax errors and schema issues before you create the finding type.</li> <li><strong>Inspect and duplicate standard finding types</strong> — Open any standard finding type to view its detection logic, then duplicate it as the starting point for a custom finding type.</li> <li><strong>Works with CASB policies</strong> — Use custom finding types in <a href="https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/">CASB remediation policies</a> to send matching findings to Slack, ServiceNow, or any other webhook destination.</li> </ul> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="get-started">Get started</h4><a class="anchor-link" href="#get-started"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <ol> <li>In <a href="https://one.dash.cloudflare.com" target="_blank" rel="noopener">Cloudflare One<span class="external-link"> ↗︎</span></a>, go to <strong>Cloud &amp; SaaS findings</strong> &gt; <strong>Findings library</strong>.</li> <li>Select <strong>Create finding</strong>.</li> <li>Enter a name, description, and severity.</li> <li>Select a provider and asset class, then set the integration scope.</li> <li>Write your Rego expression and select <strong>Validate</strong>.</li> <li>Select <strong>Create finding</strong>.</li> </ol> <p>CASB evaluates the custom finding type against assets as they are created or updated within the selected scope. Matching assets appear as posture finding instances under <strong>Posture Findings</strong>.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="learn-more">Learn more</h4><a class="anchor-link" href="#learn-more"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <ul> <li>Learn how to <a href="https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/">create and manage custom finding types</a> in Cloudflare One.</li> <li>Learn how to <a href="https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/">manage findings</a> in Cloudflare One.</li> <li>Learn how to <a href="https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/">create and manage CASB remediation policies</a> in Cloudflare One.</li> </ul> <p>CASB custom finding types are now available in Cloudflare One.</p>