Crowswatch

Documentation · Beta

CASB (Cloudflare)

The CASB integration brings Cloudflare's Cloud Access Security Broker findings — misconfigurations and risks across your connected SaaS and cloud apps — into Crowswatch, where you can review them alongside everything else and alert your team.

CASB is a Beta feature and requires a Cloudflare Zero Trust plan with the SaaS Security (CASB) add-on.

How it works

Crowswatch connects to Cloudflare CASB in two parts:

  • An API token lets Crowswatch list your connected integrations (SaaS/cloud apps) and flagged assets, refreshed periodically.
  • Findings — the security issues themselves — are delivered to Crowswatch, because Cloudflare has no API to list them. You choose how: automatic delivery via a CASB policy (recommended), manual sends, or Logpush.
Connecting the token alone won't bring in any findings — delivery is configured on the Cloudflare side. As soon as you've connected, add the webhook destination and create the CASB policies you want feeding Crowswatch. Don't wait: policies only capture findings discovered afterthey're enabled. Findings that already exist (or arrive before your policy is live) can be pushed manually with Send webhookfrom Cloud & SaaS findings.

Step 1: Connect your token

  1. In Cloudflare, create an account-scoped API token with Cloudflare CASB Read permission.
  2. In Crowswatch, open CASB in the sidebar and enter your API token and Cloudflare Account ID.
  3. Save. Crowswatch generates a per-team webhook secret and shows it once — copy it now; you can regenerate it later if needed.

Once connected, Crowswatch pulls your connected apps and assets and keeps them refreshed (about every 15 minutes).

Step 2: Add the webhook destination

Every delivery method goes through the same webhook destination, so set that up first:

  1. On the Crowswatch CASB Setup tab, copy the Webhook URL and HMAC secret.
  2. In Cloudflare One, go to Integrations → Webhooks and add a destination using that URL and secret with HMAC-Signing. Use Test delivery to confirm it's reachable.
A Cloudflare test delivery contains no finding, so it confirms connectivity but doesn't create a row in Crowswatch. Send a real finding instance to see it appear.

Step 3: Choose how findings arrive

MethodBest forDelivery
Policy (recommended)Hands-off, ongoing deliveryCloudflare sends every new matching finding automatically
Manual sendTrying it out, back-filling existing findingsYou pick findings in Cloudflare and click Send webhook
Logpush (Enterprise)Enterprise plans already using Logpush pipelinesCloudflare pushes every new finding in batches

Option A: Automatic delivery with a policy

CASB policies trigger a webhook (and optionally an automated remediation) as soon as Cloudflare detects a finding.

  1. In Cloudflare One, go to Cloud & SaaS findings → Policies and select Create a policy.
  2. Name it, choose the vendor(s), integrations, and finding types to match. Create one broad policy or several scoped ones — every matching finding lands in Crowswatch either way.
  3. Under actions, select Send webhooks and pick your Crowswatch destination.
  4. Toggle Enable policy and create it.
Policies apply to findings discovered after they're enabled — they don't back-fill. To load existing findings, use a one-off manual send. Policies require a paid CASB plan.

Option B: Manual webhook

To send a specific finding — or back-fill findings that existed before your policy — open Cloud & SaaS findings in Cloudflare, select an instance, and choose Send webhook → your Crowswatch destination.

Option C: Automatic delivery with Logpush

On a Cloudflare Enterprise plan, a Logpush job delivers every new finding automatically.

  1. On the Crowswatch CASB Setup tab, copy the Logpush destination URL (it embeds your secret as an Authorization header parameter). If the secret shows as a placeholder, regenerate it first so the real value is filled in.
  2. In Cloudflare One, go to Insights → Logs → Manage Logpush and create a job.
  3. Choose the CASB Findings dataset and an HTTP endpoint destination, and paste the URL.
  4. Submit. Cloudflare validates the endpoint, then pushes new findings in near-real-time batches.
Logpush streams new findings only — it doesn't back-fill ones detected before the job existed. To load existing findings, use a one-off manual send.

Reviewing findings & alerting

Findings appear on the CASB page with severity (critical/high/medium/low), finding type, the connected app, and the affected asset. To be notified, add a CASB rule to an alert channel — see the Alerts guide — where you can set a severity threshold and scope by application and finding type.

Troubleshooting

Cloudflare says the destination is invalid (401)

The URL is still carrying the placeholder secret. Replace <HMAC_SECRET> with your actual webhook secret (regenerate and copy it from the Setup tab if you no longer have it).

I sent a finding but nothing appeared

Confirm the destination URL points at your team’s integration and the secret matches. A Cloudflare test ping is acknowledged but intentionally stores nothing.

My policy is enabled but no findings arrive

Policies only fire for findings discovered after the policy was enabled, and only for the vendors, integrations, and finding types it matches. Check the policy scope, and back-fill older findings with a manual send.

Findings show but fields are blank

Make sure you’re on the latest Crowswatch — the finding parser handles both the Logpush schema and Cloudflare’s manual-send shape. Re-sending the same finding refreshes the stored row.

Next steps

AlertsRoute CASB findings to your teamIntegrationsOther Cloudflare integrations