Crowswatch

Documentation · Beta

CASB (Cloudflare)

The CASB integration brings Cloudflare's Cloud Access Security Broker findings — misconfigurations and risks across your connected SaaS and cloud apps — into Crowswatch, where you can review them alongside everything else and alert your team.

CASB is a Beta feature and requires a Cloudflare Zero Trust plan with the SaaS Security (CASB) add-on.

How it works

Crowswatch connects to Cloudflare CASB in two parts:

  • An API token lets Crowswatch list your connected integrations (SaaS/cloud apps) and flagged assets, refreshed periodically.
  • Findings — the security issues themselves — are delivered to Crowswatch, because Cloudflare has no API to list them. You choose how: manual sends, or automatic delivery via Logpush.

Step 1: Connect your token

  1. In Cloudflare, create an account-scoped API token with Cloudflare CASB Read permission.
  2. In Crowswatch, open CASB in the sidebar and enter your API token and Cloudflare Account ID.
  3. Save. Crowswatch generates a per-team webhook secret and shows it once — copy it now; you can regenerate it later if needed.

Once connected, Crowswatch pulls your connected apps and assets and keeps them refreshed (about every 15 minutes).

Step 2: Choose how findings arrive

Cloudflare CASB doesn't push findings automatically by default. Two options:

MethodBest forDelivery
Manual sendTrying it out, or sending a specific findingYou pick findings in Cloudflare and click Send webhook
Logpush (Enterprise)Hands-off, ongoing deliveryCloudflare pushes every new finding automatically

Option A: Manual webhook

  1. On the Crowswatch CASB Setup tab, copy the Webhook URL and HMAC secret.
  2. In Cloudflare One, go to Integrations → Webhooks and add a destination using that URL and secret with HMAC-Signing. Use Test delivery to confirm it's reachable.
  3. To send findings, open Cloud & SaaS findings in Cloudflare, select an instance, and choose Send webhook → your Crowswatch destination.
A Cloudflare test delivery contains no finding, so it confirms connectivity but doesn't create a row in Crowswatch. Send a real finding instance to see it appear.

Option B: Automatic delivery with Logpush

On a Cloudflare Enterprise plan, a Logpush job delivers every new finding automatically.

  1. On the Crowswatch CASB Setup tab, copy the Logpush destination URL (it embeds your secret as an Authorization header parameter). If the secret shows as a placeholder, regenerate it first so the real value is filled in.
  2. In Cloudflare One, go to Insights → Logs → Manage Logpush and create a job.
  3. Choose the CASB Findings dataset and an HTTP endpoint destination, and paste the URL.
  4. Submit. Cloudflare validates the endpoint, then pushes new findings in near-real-time batches.
Logpush streams new findings only — it doesn't back-fill ones detected before the job existed. To load existing findings, use a one-off manual send.

Reviewing findings & alerting

Findings appear on the CASB page with severity (critical/high/medium/low), finding type, the connected app, and the affected asset. To be notified, add a CASB rule to an alert channel — see the Alerts guide — where you can set a severity threshold and scope by application and finding type.

Troubleshooting

Cloudflare says the destination is invalid (401)

The URL is still carrying the placeholder secret. Replace <HMAC_SECRET> with your actual webhook secret (regenerate and copy it from the Setup tab if you no longer have it).

I sent a finding but nothing appeared

Confirm the destination URL points at your team’s integration and the secret matches. A Cloudflare test ping is acknowledged but intentionally stores nothing.

Findings show but fields are blank

Make sure you’re on the latest Crowswatch — the finding parser handles both the Logpush schema and Cloudflare’s manual-send shape. Re-sending the same finding refreshes the stored row.

Next steps

AlertsRoute CASB findings to your teamIntegrationsOther Cloudflare integrations