JA EN
shiichan

CASB Custom Finding Types: Write Your Own Detections in Rego

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security

Hi, it's Shii-chan! Today I have news that lets you shape CASB to fit your own rules.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Cloudflare CASB now supports custom finding types. Security teams can decide what CASB detects across their SaaS and cloud integrations.

You write the detection logic in Rego, the open-source policy language from Open Policy Agent (OPA).

The story so far

Until now, CASB relied on its library of standard finding types. Standard rules don't always match each organization's thresholds and exceptions. Custom finding types let you close that gap with your own rules.

What changes

  • You can turn organization-specific conditions, like admin accounts without two-factor authentication, into detection rules
  • You get higher-confidence findings that match your own standards
  • You can use findings in CASB remediation policies to send them to Slack, ServiceNow, or any webhook

Dive Deep

Here is what you can do.

  • Detection logic: Rego expressions are evaluated against asset data from your connected integrations
  • Scope: pick a provider (such as Google Workspace or Microsoft 365) and an asset class (such as users, files, or groups), then apply it to all integrations for that provider or a selected subset
  • Validation: select Validate to check for syntax errors and schema issues before you create it
  • Duplicate standard types: open a standard finding type to see its logic and duplicate it as a starting point

The flow looks like this.

  • In Cloudflare One, go to Cloud & SaaS findings, then Findings library
  • Select Create finding and enter a name, description, and severity
  • Choose the provider, asset class, and integration scope
  • Write the Rego expression, select Validate, then select Create finding

After that, CASB evaluates assets as they are created or updated within the scope, and matches appear under Posture Findings. The post doesn't list limits or plan requirements.

Wrap-up

  • CASB now has custom finding types
  • Detection logic is written in Rego
  • You can scope by provider and asset class
  • Validate checks your expression, and you can duplicate standard types
  • Pair it with remediation policies to notify Slack and more

This is a great fit if you want to turn your own security standards into CASB detections!

Related posts