Remediation Policies

Use CASB policies to automatically remediate a finding or send a webhook as soon as CASB detects it. A policy defines the vendor, the finding type match, and the action Cloudflare should take.

Policies build on manual remediation and CASB webhooks. Instead of each finding instance needing to be actioned manually, a configured policy automatically triggers action on all newly discovered matching finding instances.

• A configured Cloud or SaaS integration.
• Read-Write permissions on the integration, required for remediation actions.
• A configured webhook destination, required for webhook actions.

When CASB detects a finding, it checks whether the finding matches a customer-configured policy. If a policy matches, Cloudflare runs the policy's configured action against that finding instance automatically.

A policy can run a remediation action, send a webhook, or both.

1. In Cloudflare One ↗, go to Cloud & SaaS findings > Policies.
2. Select Create a policy.
3. Under Basic information, enter a Policy name. Optionally, enter a Description.
4. Under Choose how you want to trigger the policy, select a Vendor.
5. Select one or more Integrations, or select Apply to all integrations to apply the policy to every integration for the vendor.
6. Select a Finding type. Only finding types available for the selected vendor and integrations appear here.
7. Under Define what to do with findings that match your trigger, choose one or both actions:
   • Run Remediation to have Cloudflare perform a first-party remediation action against the SaaS integration API. This option is only available for select finding types.
   • Send webhooks to send a notification to one or more webhook destinations.
8. Under Status, turn on Enable policy.
9. Select Create policy.

Policies will be in effect for all newly discovered finding instances going forward. New or updated policies are not applied retroactively to existing finding instances.

CASB policies appear in a list showing each policy's name, integration, finding type, webhook, remediation action, status, and the time it last ran.

Remediation actions perform a first-party fix directly against the integration's API, such as revoking a public file share.

CASB currently supports remediation actions for Microsoft 365 and Google Workspace file and folder finding types. If a finding type does not support remediation, Run Remediation displays No automated remediation available for this finding type and cannot be enabled.

Remediation requires Read-Write permissions on the integration. If the integration only has Read permissions, upgrade the integration before the policy can remediate matching findings.

For more information, refer to Manage remediated findings.

Webhook actions send the finding instance to a previously configured webhook destination. Use this to route findings to systems such as Slack, Microsoft Teams, Jira, ServiceNow, Tines, or a custom HTTPS endpoint.

When a policy sends a webhook, the payload uses the same format as a webhook sent manually from a finding instance. For the payload structure and field descriptions, refer to Payload format.

1. In Cloudflare One ↗, go to Cloud & SaaS findings > Policies.
2. Select the policy to update.
3. Modify the policy's basic information, trigger, or actions.
4. Select Save changes.

To turn a policy on or off, use the Enable policy toggle under Status. A policy's status displays as Enabled or Disabled in the policy list. A disabled policy stops matching new findings until enabled again.

To delete a policy, open the policy and select Delete.

Every policy produces two categories of logs, available under Insights in Cloudflare One:

• Admin Activity logs record changes to a policy definition, including who created, edited, or disabled the policy, and when.
• Cloud & SaaS Security policies logs record the runtime outcome of each policy invocation, including the finding that triggered the policy, the asset acted on, whether the action succeeded or failed, and the error returned by the vendor if it failed (for example, a 401 Unauthorized response or a rate limit error).

For compliance reporting, the Cloud & SaaS Security policies log ties a specific finding to a specific automated action and timestamp.

For more information, refer to Cloudflare One Logs.

• Remediation actions in a policy are only available for Microsoft 365 and Google Workspace file and folder finding types.
• A policy only applies to new instances of a finding type detected after the policy is created.

For help diagnosing issues, refer to CASB troubleshooting.