You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[CF1] add details on serial numbers in posture checks (cloudflare#22790)
* [CF1] add details on serial numbers in posture checks
* edits
* sentinelone edit
* Update src/content/partials/cloudflare-one/posture/service-provider-intro.mdx
Ranbel edit
* Apply suggestions from code review
PCX suggestion
Co-authored-by: Jun Lee <[email protected]>
---------
Co-authored-by: Jun Lee <[email protected]>
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/identity/devices/service-providers/custom.mdx
+35-21Lines changed: 35 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,10 +6,9 @@ sidebar:
6
6
order: 1
7
7
8
8
description: Configure custom device posture checks in Cloudflare Zero Trust using a service-to-service integration.
9
-
10
9
---
11
10
12
-
import { Render } from"~/components"
11
+
import { Render } from"~/components";
13
12
14
13
Cloudflare Zero Trust allows you to enforce custom device posture checks on your applications. This involves configuring a WARP service-to-service integration that periodically calls the external API of your choice, whether it is a third-party endpoint provider or a home built solution. When called, the API will receive device identifying information from Cloudflare and be expected to return a value between `0` to `100`. You can then set up a device posture check that determines if the returned value counts as a pass or fail; for example, you could allow access to a user only if their device has a posture value greater than `60`.
15
14
@@ -23,6 +22,7 @@ sequenceDiagram
23
22
WARP->>External API: JSON with user and device identity
24
23
External API-->>WARP: JSON with 0-100 result
25
24
```
25
+
26
26
## External API requirements
27
27
28
28
The custom service provider integration works with any API service that meets the following specifications. For an example of a custom device posture integration API, refer to our [Cloudflare Workers sample code](https://github.com/cloudflare/custom-device-posture-integration-example-worker).
@@ -35,16 +35,23 @@ The WARP client authenticates to the external API through Cloudflare Access. The
35
35
36
36
Cloudflare will pass the following parameters to the configured API endpoint. You can use this data to identify the device and assign a posture score. For some devices, not all identifying information will apply, in which case the field will be blank. A maximum of 1,000 devices will be sent per a request.
37
37
38
-
| Field | Description |
39
-
| ----- | ----------- |
40
-
|`device_id`| Device UUID assigned by the WARP client |
41
-
|`email`| Email address used to authenticate the WARP client |
|`device_id`| Device UUID assigned by the WARP client |
41
+
|`email`| Email address used to authenticate the WARP client |
42
+
|`serial_number`| Device serial number |
43
+
|`mac_address`| Device MAC address |
44
+
|`virtual_ipv4`| Device virtual IPv4 address |
45
+
|`hostname`| Device name |
46
+
47
+
:::note
48
+
49
+
Devices are identified by their serial numbers. You must ensure that each of your devices has a unique serial number. If multiple devices have the same serial number, Cloudflare and your external API will not be able to accurately match them.
50
+
51
+
:::
46
52
47
53
Example request body:
54
+
48
55
```json
49
56
{
50
57
"devices": {
@@ -68,12 +75,13 @@ Example request body:
68
75
69
76
For each Cloudflare `device_id`, the API service is expected to return a posture score and optionally a third-party device ID.
| Service Auth | Include | Service Token |`<TOKEN-NAME>`|
106
114
107
115
### 3. Add a service provider integration
108
116
109
117
To create a custom service-to-service integration:
110
118
111
-
<Renderfile="posture/add-service-provider"params={{ provider: "Custom service provider" }} />
119
+
<Render
120
+
file="posture/add-service-provider"
121
+
params={{ provider: "Custom service provider" }}
122
+
/>
112
123
5. In **Access client ID** and **Access client secret**, enter the Access service token used to authenticate to your external API.
113
124
6. In **Rest API URL**, enter the external API endpoint that Cloudflare will query for posture information (for example, `https://api.example.com`). For more information, refer to [External API requirements](#external-api-requirements).
114
125
7. In **Polling frequency**, choose how often Cloudflare Zero Trust should query the external API for information.
@@ -118,10 +129,13 @@ Next, [configure a device posture check](#4-configure-the-posture-check) to dete
118
129
119
130
### 4. Configure the posture check
120
131
121
-
<Renderfile="posture/configure-posture-check"params={{ one: "Custom service provider" }} />
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/identity/devices/service-providers/sentinelone.mdx
+24-16Lines changed: 24 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,34 +6,39 @@ sidebar:
6
6
head:
7
7
- tag: title
8
8
content: SentinelOne - Posture checks
9
-
10
9
---
11
10
12
-
import { Render } from"~/components"
11
+
import { Render } from"~/components";
13
12
14
-
Cloudflare Zero Trust can integrate with SentinelOne to require that users connect to certain applications from managed devices. Our service-to-service posture check identifies devices based on their serial numbers.
Device posture data is gathered from the SentinelOne Management APIs. For more information, refer to `https://<S1-DOMAIN>.sentinelone.net/api-doc/overview`.
| Active Threats | Number of active threats on the device |
62
-
| Is Active | Whether the SentinelOne Agent is active |
63
-
| Network status | Whether the SentinelOne Agent is connected to the SentinelOne service |
64
-
| Operational State | The [operational state](https://community.sentinelone.com/s/login/?ec=302&startURL=%2Fs%2Farticle%2F000005285) of the SentinelOne Agent.|
| Active Threats | Number of active threats on the device|
70
+
| Is Active | Whether the SentinelOne Agent is active|
71
+
| Network status | Whether the SentinelOne Agent is connected to the SentinelOne service|
72
+
| Operational State | The [operational state](https://community.sentinelone.com/s/login/?ec=302&startURL=%2Fs%2Farticle%2F000005285) of the SentinelOne Agent.|
Cloudflare Zero Trust can integrate with {props.one} to require that users connect to certain applications from managed devices. This service-to-service posture check uses the WARP client to read endpoint data from {props.one}. Devices are identified by their serial numbers.
7
+
Cloudflare Zero Trust can integrate with {props.one} to require that users connect to certain applications from managed devices. This service-to-service posture check uses the WARP client to read endpoint data from {props.one}. Devices are identified by their serial numbers. If multiple devices have the same serial number, Cloudflare cannot accurately match a WARP device with a third-party provider device. You must ensure that each of your devices has a unique serial number.
0 commit comments