CASB custom finding types for organization-specific risk detection
Cloudflare CASB now supports custom finding types, allowing security teams to write their own detection logic using Rego to identify organization-specific security conditions across SaaS and cloud integrations. Custom finding types can be scoped to specific providers and asset classes, validated for syntax errors, and integrated with CASB remediation policies for automated response.
Cloudflare CASB now supports custom finding types, giving security teams full control over the security conditions CASB detects across their SaaS and cloud integrations.
In addition to CASB's library of standard finding types, you can now write your own detection logic using Rego ↗︎, the open-source policy language from Open Policy Agent (OPA). Use custom finding types to match your organization's own thresholds and exceptions, such as flagging admin accounts without two-factor authentication, and get higher-confidence findings to act on.
Key capabilities
- Write your own detection logic — Define exactly what CASB flags using Rego expressions evaluated against asset data from your connected integrations.
- Target any supported provider and asset class — Scope a custom finding type to a provider (such as Google Workspace or Microsoft 365) and asset class (such as users, files, or groups), and apply it to all integrations for that provider or a selected subset.
- Built-in validation — Select Validate to check your expression for syntax errors and schema issues before you create the finding type.
- Inspect and duplicate standard finding types — Open any standard finding type to view its detection logic, then duplicate it as the starting point for a custom finding type.
- Works with CASB policies — Use custom finding types in CASB remediation policies to send matching findings to Slack, ServiceNow, or any other webhook destination.
Get started
- In Cloudflare One ↗︎, go to Cloud & SaaS findings > Findings library.
- Select Create finding.
- Enter a name, description, and severity.
- Select a provider and asset class, then set the integration scope.
- Write your Rego expression and select Validate.
- Select Create finding.
CASB evaluates the custom finding type against assets as they are created or updated within the selected scope. Matching assets appear as posture finding instances under Posture Findings.
Learn more
- Learn how to create and manage custom finding types in Cloudflare One.
- Learn how to manage findings in Cloudflare One.
- Learn how to create and manage CASB remediation policies in Cloudflare One.
CASB custom finding types are now available in Cloudflare One.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare API MCP server now serves Cloudflare skills
The Cloudflare API MCP server now integrates with the Skills over MCP extension, allowing MCP clients to discover and access Cloudflare skills. Users can add the MCP server endpoint to compatible MCP clients to access these skills.
WAF failed detections field now available in Rules
A new cf.appsec.request.failed_detections field lets you control how rules handle requests when security detections fail. This array of detection IDs covers content scanning, WAF attack scoring, attack signatures, leaked credentials, and AI-based PII/prompt injection/custom topic detection failures, and works across custom rules, rate limiting rules, and request header transform rules.
Markdown for Agents: More efficient in-process streaming conversion
Markdown for Agents now uses an in-process streaming engine at the edge to convert HTML, reducing overhead and memory use. The conversion limit increased from 2 MiB to 6 MiB, and token count headers are no longer generated.