Skip to content

Commit ddfe77e

Browse files
maxvpmaxvp
authored
[CASB] M365 remediation (#23744)
1 parent bcab4de commit ddfe77e

File tree

4 files changed

+94
-10
lines changed

4 files changed

+94
-10
lines changed

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/microsoft-365/index.mdx

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,11 @@ rss: file
77
import { DirectoryListing, GlossaryTooltip, Render } from "~/components";
88

99
<Render
10-
file="casb/integration-description"
11-
params={{ integrationName: "Microsoft 365 (M365)", integrationAccountType: "Microsoft 365 account" }}
10+
file="casb/integration-description"
11+
params={{
12+
integrationName: "Microsoft 365 (M365)",
13+
integrationAccountType: "Microsoft 365 account",
14+
}}
1215
/>
1316

1417
This integration covers the following Microsoft 365 products:
@@ -36,13 +39,37 @@ For the Microsoft 365 integration to function, Cloudflare CASB requires the foll
3639
- `Files.Read.All`
3740
- `AuditLog.Read.All`
3841

39-
These permissions follow the principle of least privilege to ensure that only the minimum required access is granted. To learn more about each permission, refer to the [Microsoft Graph permissions documentation](https://docs.microsoft.com/en-us/graph/permissions-reference).
42+
These permissions follow the principle of least privilege to ensure that only the minimum required access is granted.
43+
44+
Additionally, to [remediate findings](/cloudflare-one/applications/casb/manage-findings/#remediate-findings), CASB requires the following permissions:
45+
46+
- `Application.ReadWrite.All`
47+
- `AuditLog.Read.All`
48+
- `Calendars.ReadWrite`
49+
- `Domain.ReadWrite.All`
50+
- `Files.ReadWrite.All`
51+
- `Group.ReadWrite.All`
52+
- `InformationProtectionPolicy.Read.All`
53+
- `MailboxSettings.ReadWrite`
54+
- `IdentityRiskyUser.ReadWrite.All`
55+
- `RoleManagement.ReadWrite.Directory`
56+
- `User.ReadWrite.All`
57+
- `UserAuthenticationMethod.ReadWrite.All`
58+
- `Directory.ReadWrite.All`
59+
- `GroupMember.ReadWrite.All`
60+
- `Organization.ReadWrite.All`
61+
- `Mail.ReadWrite`
62+
63+
To learn more about each permission, refer to the [Microsoft Graph permissions documentation](https://docs.microsoft.com/en-us/graph/permissions-reference).
4064

4165
## Security findings
4266

4367
<Render
44-
file="casb/security-findings"
45-
params={{ integrationName: "Microsoft 365", slugRelativePath: "microsoft-365" }}
68+
file="casb/security-findings"
69+
params={{
70+
integrationName: "Microsoft 365",
71+
slugRelativePath: "microsoft-365",
72+
}}
4673
/>
4774

4875
### User account settings

‎src/content/docs/cloudflare-one/applications/casb/manage-findings.mdx

Lines changed: 59 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ File findings for some integrations (such as [Microsoft 365](/cloudflare-one/app
9393

9494
After reviewing your findings, you may decide that certain posture findings are not applicable to your organization. Cloudflare CASB allows you to remove findings or individual instances of findings from your list of active issues. CASB will continue to scan for these issues, but any detections will appear in a separate tab.
9595

96-
### Hide a finding
96+
### Ignore a finding
9797

9898
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **CASB** > **Posture**.
9999
2. Locate the active finding you want to hide.
@@ -108,13 +108,68 @@ The finding's status will change from **Active** to **Ignored**. CASB will conti
108108
3. In **Active**, find the instance you want to hide.
109109
4. In the three-dot menu, select **Move to hidden**.
110110

111-
The instance will be moved from **Active** to **Hidden** within the finding. If the finding occurs again for the same user, CASB will report the new instance in the **Hidden** tab. You can move hidden instances back to the **Active** tab at any time.
111+
The instance will be moved from **Active** to **Hidden** within the finding. If the finding occurs again for the same user, CASB will report the new instance quietly in the **Hidden** tab. You can move hidden instances back to the **Active** tab at any time.
112+
113+
## Remediate findings
114+
115+
In addition to detecting and surfacing misconfigurations or issues with SaaS and cloud applications, CASB can also remediate findings directly in applications.
116+
117+
CASB supports remediation for findings from the [Microsoft 365 integration](/cloudflare-one/applications/casb/casb-integrations/microsoft-365/):
118+
119+
<Details header="Supported CASB findings for remediation">
120+
121+
- Microsoft: File publicly accessible with edit access
122+
- Microsoft: File publicly accessible with view access
123+
- Microsoft: File publicly accessible with edit access with DLP Profile match
124+
- Microsoft: File publicly accessible with view access with DLP Profile match
125+
126+
</Details>
127+
128+
### Configure remediation permissions
129+
130+
Before you can remediate findings, [add a new integration](/cloudflare-one/applications/casb/#add-an-integration) and choose _Read-Write mode_ during setup. Alternatively, you can update an existing integration:
131+
132+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **CASB** > **Integrations**.
133+
2. Choose your integration, then select **Configure**.
134+
3. In **Integration permissions**, choose _Read-Write mode_.
135+
4. Select **Update integration**. CASB will redirect you to your Microsoft 365 configuration.
136+
5. Sign in to your organization, then select **Accept**.
137+
138+
CASB can now remediate supported findings directly.
139+
140+
### Remediate a finding
141+
142+
To remediate a supported finding:
143+
144+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **CASB** > **Posture Findings**.
145+
2. Choose a supported finding type, then select **Manage**.
146+
3. In **Active Instances**, select an instance.
147+
4. In **Remediation details**, choose a remediation action to take.
148+
149+
CASB will begin remediating the instance.
150+
151+
### Manage remediated findings
152+
153+
Remediated findings will appear in **CASB** > **Posture Findings** > **Remediated findings**. The status of the finding will change depending on what action CASB has taken:
154+
155+
| Status | Description |
156+
| ---------- | -------------------------------------------------------------------- |
157+
| Pending | CASB has set the finding to be remediated. |
158+
| Queued | CASB has queued the finding for remediation. |
159+
| Processing | CASB is currently remediating the finding. |
160+
| Completed | CASB successfully remediated the finding. |
161+
| Failed | CASB unsuccessfully remediated the finding. |
162+
| Rejected | CASB does not have the correct permissions to remediate the finding. |
163+
164+
If the status is **Completed**, remediation succeeded. If the status is **Failed** or **Rejected**, remediation failed, and you can select the finding to take action again.
165+
166+
CASB will log remediation actions in **Logs** > **Admin**. For more information, refer to [Zero Trust Logs](/cloudflare-one/insights/logs/).
112167

113168
## Resolve finding with a Gateway policy
114169

115-
Using the security findings from CASB allows for fine-grained Gateway policies which prevent future unwanted behavior while still allowing usage that aligns to your organization's security policy. This means going from viewing a CASB finding, like the use of an unapproved application, to preventing or controlling access in minutes.
170+
Using the security findings from CASB allows for fine-grained Gateway policies which prevent future unwanted behavior while still allowing usage that aligns to your organization's security policy. You can view a CASB finding, like the use of an unapproved application, then immediately prevent or control access with Gateway.
116171

117-
CASB supports creating a Gateway policy with findings from the [Google Workspace integration](/cloudflare-one/applications/casb/casb-integrations/google-workspace/):
172+
CASB supports creating a Gateway policy for findings from the [Google Workspace integration](/cloudflare-one/applications/casb/casb-integrations/google-workspace/):
118173

119174
<Details header="Supported CASB findings for Gateway policies">
120175

‎src/content/partials/cloudflare-one/casb/microsoft/file-sharing.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{}
33
---
44

5-
Get alerted when files in your Microsoft 365 account have their permissions changed to a less secure setting.
5+
Get alerted when files in your Microsoft 365 account have their permissions changed to a less secure setting. Additionally, you can automatically remediate certain finding types directly from CASB. For more information, refer to [Remediate findings](/cloudflare-one/applications/casb/manage-findings/#remediate-findings).
66

77
| Finding type | FindingTypeID | Severity |
88
| ------------------------------------------------------ | -------------------------------------- | -------- |

‎src/content/partials/cloudflare-one/casb/microsoft/m365-dlp-findings.mdx

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
{}
33
---
44

5+
Additionally, you can automatically remediate certain finding types directly from CASB. For more information, refer to [Remediate findings](/cloudflare-one/applications/casb/manage-findings/#remediate-findings).
6+
57
| Finding type | FindingTypeID | Severity |
68
| --------------------------------------------------------------------------- | -------------------------------------- | -------- |
79
| Microsoft: File publicly accessible with edit access with DLP Profile match | `7b6ecb52-852f-4184-bf19-175fe59202b7` | Critical |

0 commit comments

Comments
 (0)