Cloudflare CASB Introduces Automatic Remediation Policies

Cloudflare CASB Introduces Automatic Remediation Policies Cloudflare has added automatic remediation policies to Cloudflare CASB, enabling security teams to automatically revoke risky file shares and dispatch webhooks without manual intervention. CASB policies automatically execute remediation actions or trigger webhooks as soon as a SaaS security finding is detected. The system is built on Cloudflare Queues, Workers, and Workflows to manage resilient execution and API rate-limiting with a target completion time of five minutes or less. Two log streams—Admin Activity logs and Cloud & SaaS Security policies logs—record configuration changes and runtime execution outcomes for compliance and audits. The capability requires Read-Write permissions on connected Microsoft 365 or Google Workspace tenants, with custom finding definitions planned soon. Automated Misconfiguration Response Traditional SaaS Security Posture Management tools act as passive alarms that produce backlogs of findings, requiring administrators to review and resolve issues manually across multiple SaaS portals or dashboard prompts. With automatic remediation policies, security teams define response logic once—such as revoking public file shares or routing alerts to a SOC or SOAR platform—which executes immediately upon detection to reduce the exposure window. Architecture on Cloudflare Workflows The automation engine operates entirely on Cloudflare's developer platform. When a finding occurs, the detection engine sends a message to Cloudflare Queues, where a Worker consumer checks for matching policy configurations. Matched jobs run on Cloudflare Workflows for durable execution across restarts, incorporating automatic backoff and retry mechanisms to manage third-party API rate limits toward a target remediation time of under five minutes. Audit Logging and Availability Policy operations generate two categories of logs under Cloudflare One: Admin Activity logs that record policy modifications for tracking who changed rules, and Cloud & SaaS Security policies logs that provide runtime execution details and error reporting for compliance verification. The feature is available in the Cloudflare dashboard for Microsoft 365 and Google Workspace integrations updated to Read-Write permissions, with custom finding rules scheduled for release in upcoming weeks.

Cloudflare CASB 推出自动修复策略，实现 SaaS 风险自动响应 Cloudflare 为其云访问安全代理（CASB）引入自动修复策略，允许安全团队配置事件驱动逻辑，在检测到风险时自动撤销违规共享并触发 Webhook，无需人工干预。 CASB 自动修复策略将响应逻辑自动化，目标在检测到违规后 5 分钟内完成修复。 系统基于 Cloudflare Queues、Workers 和 Workflows 构建，具备容错重试和处理第三方 API 速率限制的能力。 平台提供管理活动日志和策略执行日志两类审计记录，以便追溯策略变更和提供合规修复证明。 支持 Microsoft 365 与 Google Workspace 集成，未来数周内将进一步上线自定义检测功能（Custom Findings）。 从被动告警走向自动化修复 以往 SaaS 安全巡检（SSPM）工具主要充当被动告警角色，发现错误配置后需管理员手动逐条处理，容易造成安全窗口期延误。虽然 Cloudflare CASB 此前支持在控制台手动修复，但仍需人工逐项确认。新推出的自动修复策略通过内置于 Cloudflare One 的自动化引擎，允许用户预先设定规则；一旦系统发现高危共享或权限异常，便可即刻执行撤销文件权限或向 SOC/SOAR 发送 Webhook 操作。 基于 Cloudflare 开发者平台的底层架构 该自动修复策略完全构建于 Cloudflare 自有开发者平台。检测引擎发现问题后将消息推送到 Cloudflare Queue，由 Worker 消费者匹配策略，再交由运行在 Cloudflare Workflows 上的修复流水线执行。这一架构保证了任务在进程重启时的容错持久性，并能在遭遇第三方 SaaS API 速率限制时自动退避重试，将检测到修复的目标时间控制在 5 分钟以内。 审计日志与后续规划 系统在 Cloudflare One 中生成两类日志：记录策略创建、修改与停用历史的“管理活动日志”，以及记录每次触发对象、执行状态及错误详情的“云与 SaaS 安全策略日志”，可作为合规审计的修复凭据。目前该功能已在控制台上线，需为集成配置读写权限，官方还计划在未来几周推出支持自定义检测逻辑的 Custom Findings 功能。

Today, we’re making Cloudflare CASB more powerful than ever by introducing automatic remediation policies. This means security teams can now design event-driven logic to revoke risky file shares and dispatch custom webhooks, without manual intervention. When we launched [Cloudflare CASB](https://blog.cloudflare.com/cloudflare-zero-trust-casb/), a cloud access security broker, we wanted to provide security teams complete visibility into the posture of their SaaS applications before misconfigurations became incidents. With a quick, clientless integration, CASB surfaces risks like overshared files, dormant admin keys and tokens, OAuth apps with excessive permissions — continuously, across users in the organization. For years, [SaaS Security Posture Management](https://www.cloudflare.com/learning/cloud/what-is-sspm/) (SSPM) tools such as Cloudflare CASB have functioned as a passive alarm system. Most SSPM tools tell you what’s wrong but do not help you fix the issue, placing the burden on administrators to manage an ever-growing to-do list. A single misconfigured file-sharing policy across a Google Workspace tenant can generate thousands of findings in seconds, and even a disciplined team faces a window between detection and remediation measured in hours or days — more than enough time for a sensitive file to be downloaded, forwarded, or indexed. With automatic remediation policies, CASB customers can now configure the actions that should be invoked immediately after a new finding is identified. When we launched [manual remediation actions](https://blog.cloudflare.com/remediation-in-cloudflare-casb/) earlier this year, we gave security teams the ability to resolve misconfigurations directly from the Cloudflare dashboard. This removed the need for customers to log in to multiple SaaS portals to take action on the security and content findings detected by Cloudflare CASB. Still, this required a human to confirm and initiate each individual remediation — even if they’d seen this exact finding type before. CASB policies are a native automation engine built directly into [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) that takes action the moment a finding is detected. Security teams define their response logic once, whether that is revoking access to a file share, dispatching a webhook to your security operations center (SOC), or forwarding the event to a security orchestration, automation and response platform (SOAR). The engine handles matches automatically by executing the customer-configured action. As an example, many organizations implement controls that prohibit files from being shared publicly. However, they may apply an exception to users and groups in their marketing department who are frequently required to collaborate with external parties. SSPMs allow their customers to be alerted of any files that are shared publicly in violation of their policy. With many solutions, this permitted behavior lands in a queue with hundreds of possible violations, forcing administrators to take action on each individual instance. CASB policies are designed for exactly this scenario. Rather than waiting for a human to see and act on a finding, automation fires the moment detection happens. The public share is revoked within minutes, keeping the backlog of findings clean and clear. At their core, CASB policies are automated workflows that tell our scanning service what action to take when a new finding is detected. From there, the configured policy will tell CASB to either trigger a remediation action, send a webhook, or both. This gives organizations the flexibility to rely on native CASB remediation capabilities or their own internal automation services and communication channels — without having to take action in disparate platforms or create their own event processing system. The architecture behind CASB policies is built entirely on the Cloudflare developer platform — the same platform available to every Cloudflare customer. When a finding is detected, the findings engine enqueues an orchestration message to a [Cloudflare Queue](https://developers.cloudflare.com/queues/). A [Worker](https://workers.cloudflare.com/) consumer then checks whether a policy configuration matches the incoming finding. If a match exists, it creates the corresponding job and hands it to the remediations pipeline, which runs on [Cloudflare Workflows](https://developers.cloudflare.com/workflows/) for durable, fault-tolerant execution. That means jobs survive process restarts and retries are handled automatically. Cloudflare Workflows also handle third-party API rate limits gracefully. If a vendor returns a rate limit error, the Workflow pauses for the appropriate backoff window and retries without dropping the job. Our target from detection to completed remediation is five minutes or less. To get started, navigate to the Cloudflare dashboard and create your first policy. Policies can include both a remediation and a webhook action, but at a minimum: Each policy action produces two categories of logs, visible under Insights in Cloudflare One. **Admin Activity logs.** These capture changes to a policy definition: who created it, who edited it, who disabled it, and when. If a policy was turned off and a risk slipped through, this audit trail surfaces a timeline of the event. **Cloud & SaaS Security policies logs.** This new class of logs captures the runtime outcome of policy invocations. This includes details like which finding triggered the policy, which file was acted on, whether it succeeded or failed, and the specific error if it did not — for example, a 401 Unauthorized or an API rate limit response from the vendor. For compliance use cases, the execution log is the proof of fix. It ties a specific finding, like an overshared file (e.g. Q4\_Financials.pdf), to a specific automated action and event timestamp. Customers can find CASB Policies in the **Cloud & SaaS findings** section of the dashboard today. Connect or update your Microsoft 365 or Google Workspace integration to Read-Write permissions, and create your first remediation policy. In the coming weeks, we’ll also be adding support for Custom Findings to CASB. Different organizations have unique needs when it comes to detection, and we want to give customers the ability to augment or define finding logic to fit those needs. New to Cloudflare One? [Sign up for 50 free seats](https://dash.cloudflare.com/sign-up/zero-trust) to get started with CASB, or [talk to our team](https://www.cloudflare.com/contact/sase/) about a deployment at scale. For full setup instructions, visit our [developer documentation](https://developers.cloudflare.com/cloudflare-one/).