• You have added aCloud and SaaS integration.
• Your scan has surfaced at least one security finding.

Posture findings include misconfigurations, unauthorized user activity, and other data security issues.

To view details about the posture findings that CASB found:

1. InCloudflare One ↗, go toCloud & SaaS findings >Posture Findings.
2. ChooseSaaS orCloud.
3. To view details about a finding, select the finding's name

Cloud & SaaS findings will display details about your posture finding, including the finding type,severity level, number of instances, associated integration, current status, and date detected. For more information on each instance of the finding, selectManage.

To manage the finding's visibility, you can update the finding'sseverity level orhide the finding from view. Additionally, some findings provide a remediation guide to resolve the issue or supportcreating a Gateway HTTP policy to block the traffic.

Cloudflare CASB labels each finding with one of the following severity levels:

You can change the severity level for a finding at any time in case the default assignment does not suit your environment:

1. InCloudflare One ↗, go toCloud & SaaS findings >Posture Findings.
2. Locate the finding you want to modify and selectManage.
3. In the severity level drop-down menu, choose your desired setting (Critical,High,Medium, orLow).

The new severity level will only apply to the posture finding within this specific integration. If you added multiple integrations of the same application, the other integrations will not be impacted by this change.

Content findings include instances of potential data exposure as identified byDLP.

To view details about the content findings that CASB found:

1. InCloudflare One ↗, go toCloud & SaaS findings >Content Findings.
2. ChooseSaaS orCloud.
3. To view details about a finding, select the finding's name.

Cloud & SaaS findings will display details about your content finding, including the file name, a link to the file, matching DLP profiles, associated integration, and date detected.

AWS users can configure acompute account to scan for data security resources within their S3 resources.

File findings for some integrations (such asMicrosoft 365 andBox) may link to an inaccessible file. To access the actual shared file:

After reviewing your findings, you may decide that certain posture findings are not applicable to your organization. Cloudflare CASB allows you to remove findings or individual instances of findings from your list of active issues. CASB will continue to scan for these issues, but any detections will appear in a separate tab.

1. InCloudflare One ↗, go toCloud & SaaS findings >Posture Findings.
2. Locate the active finding you want to hide.
3. In the three-dot menu, selectMove to ignore.

The finding's status will change fromActive toIgnored. CASB will continue to scan for these findings and report detections. You can change ignored findings back toActive with the same process at any time.

1. InCloudflare One ↗, go toCloud & SaaS findings >Posture Findings.
2. Choose the active finding you want to hide, then selectManage.
3. InActive, find the instance you want to hide.
4. In the three-dot menu, selectMove to hidden.

The instance will be moved fromActive toHidden within the finding. If the finding occurs again for the same user, CASB will report the new instance quietly in theHidden tab. You can move hidden instances back to theActive tab at any time.

In addition to detecting and surfacing misconfigurations or issues with SaaS and cloud applications, CASB can also remediate findings directly in applications.

CASB supports remediation for findings from theMicrosoft 365 integration:

Before you can remediate findings,add a new integration and chooseRead-Write mode during setup. Alternatively, you can update an existing integration:

1. InCloudflare One ↗, go toCloud & SaaS findings >Integrations.
2. Choose your integration, then selectConfigure.
3. InIntegration permissions, chooseRead-Write mode.
4. SelectUpdate integration. CASB will redirect you to your Microsoft 365 configuration.
5. Sign in to your organization, then selectAccept.

CASB can now remediate supported findings directly.

To remediate a supported finding:

1. InCloudflare One ↗, go toCloud & SaaS findings >Posture Findings.
2. Choose a supported finding type, then selectManage.
3. InActive Instances, select an instance.
4. InRemediation details, choose a remediation action to take.

CASB will begin remediating the instance.

Remediated findings will appear inCloud & SaaS findings >Posture Findings. The status of the finding will change depending on what action CASB has taken:

If the status isCompleted, remediation succeeded. If the status isFailed orRejected, remediation failed, and you can select the finding to take action again.

CASB will log remediation actions inLogs >Admin. For more information, refer toCloudflare One Logs.

Using the security findings from CASB allows for fine-grained Gateway policies which prevent future unwanted behavior while still allowing usage that aligns to your organization's security policy. You can view a CASB finding, like the use of an unapproved application, then immediately prevent or control access with Gateway.

CASB supports creating a Gateway policy for findings from theGoogle Workspace integration:

To create a Gateway policy directly from a CASB finding:

1. InCloudflare One ↗, go toCloud & SaaS findings >Posture Findings orCloud & SaaS findings >Content Findings.
2. ChooseSaaS orCloud.
3. Choose the finding you want to modify, then selectManage.
4. Find the instance you want to block and select its three-dot menu.
5. SelectBlock with Gateway HTTP policy. A new browser tab will open with a pre-filled HTTP policy.

   Note

   Not all CASB findings will have theBlock with Gateway HTTP policy option. Unsupported findings can only be resolved from your application dashboard or through your domain provider.

6. (Optional)Configure the HTTP policy. For example, if the policy blocks an unsanctioned third-party app, you can apply the policy to some or all users, or only block uploads or downloads.
7. SelectSave.

Your HTTP policy will now prevent future instances of the security finding.