What is CASB?

NIST describes the CASB as software that "sits on the network between the cloud service customers (CSC) and the cloud service providers (CSP)" (SP 800-215, November 2022). The first generation only discovered which cloud services people used. Current products also enforce policy: data loss prevention on what goes into and out of cloud apps, detection of account hijacking through behavior analytics, and alerts on misconfigured cloud tenants.

The four pillars, from the queue's point of view

How a CASB works: API, forward proxy or reverse proxy

The way the CASB reaches the traffic decides what it can stop and what it can only report.

Microsoft's reverse proxy is Conditional Access App Control. On browsers other than Edge the app's address gains an *.mcas.ms suffix (myapp.com becomes myapp.com.mcas.ms), and Microsoft tells admins to block native clients so nobody skips the session controls by opening the desktop app. Edge users get the same protection in the browser, without the redirect. Know the suffix before you flag an odd mcas.ms hostname in proxy logs as phishing. The modes are not exclusive: you can connect Microsoft 365 by API and still route browser sessions from unmanaged devices through the reverse proxy.

What reaches the SIEM: the CloudAppEvents table

Microsoft's CASB, Defender for Cloud Apps, writes its activity records to the CloudAppEvents table in Defender XDR advanced hunting. That covers Exchange Online, SharePoint Online, Teams, Power BI and other Microsoft apps, plus connected third-party apps such as Dropbox, Salesforce, GitHub and Atlassian. Check one prerequisite before you write a query: the table is filled by Defender for Cloud Apps, and Microsoft's reference says that without the service deployed, queries against it "aren't going to work or return any results".

Two hunting queries

The first counts downloads per user per hour, the same shape as Microsoft's mass-download hunting query.

// Users with a burst of file downloads in any one hour of the last day
// Requires Defender for Cloud Apps: without it, CloudAppEvents stays empty
CloudAppEvents
| where Timestamp > ago(1d)
| where ActionType == "FileDownloaded"
| summarize Downloads = count(), Files = dcount(ObjectName),
    IPs = make_set(IPAddress, 5), Countries = make_set(CountryCode, 5),
    AnonProxyEvents = countif(IsAnonymousProxy == true)
    by AccountObjectId, AccountDisplayName, Application, bin(Timestamp, 1h)
| where Downloads > 100
| order by Downloads desc

The second lists sharing that leaves the organization: anonymous "anyone" links, and invitations to people outside your directory, which is how Microsoft's audit log reference defines SharingInvitationCreated.

// Anonymous links and external sharing invitations, per user per hour
CloudAppEvents
| where Timestamp > ago(1d)
| where ActionType in ("AnonymousLinkCreated", "SharingInvitationCreated")
| extend FileName = tostring(RawEventData.SourceFileName),
    TargetType = tostring(RawEventData.TargetUserOrGroupType)
| summarize Shares = count(), Files = make_set(FileName, 10), TargetTypes = make_set(TargetType)
    by AccountObjectId, AccountDisplayName, Application, bin(Timestamp, 1h)
| where Shares >= 10
| order by Shares desc

Both use the documented CloudAppEvents columns and the operation names from Microsoft's audit log reference; SOCSimulator has not run them against a live tenant. Microsoft lists sync software as a known false positive for its own unusual-download alert, so expect OneDrive sync and backup tools in the first query and set the threshold from a week of your own data.

Triage: impossible travel and a new OAuth app

Impossible travel. Defender for Cloud Apps raises it when the same user is active from two places closer in time than real travel allows. It learns each user for seven days first and ignores pairs where both IP addresses are tagged as corporate. Microsoft's documented false positives are an untagged sanctioned VPN (dismiss, then tag the range) and a phone that stays connected through airplane mode and reconnects on landing. Before deciding, check IsAnonymousProxy on both sides, then look at what the account did next: filter CloudAppEvents on its AccountObjectId for downloads, new sharing links and inbox rules after the second sign-in. On a confirmed true positive the guidance is to suspend the user, mark them compromised and reset the password. The impossible travel playbook walks the full sequence.

A new OAuth app with broad permissions. Microsoft's own overview warns that OAuth apps "often behave unnoticed, while still having extensive permissions". Find the consent in Entra ID AuditLogs (OperationName "Consent to application"), note who consented and whether it was an admin, and read the permissions the app asked for. Then pivot to CloudAppEvents on its OAuthAppId to see what it has done since. Defender for Cloud Apps also flags apps whose names use look-alike characters ("Misleading OAuth app name") and unusual credentials added to an existing app. A mail-reading app consented by one user an hour after a phishing click is a business email compromise lead.

CASB vs SASE and SSE

SASE delivers networking and security together from the cloud. NIST's guide lists CASB among the minimal security services in most commercial SASE offerings, next to firewall, secure web gateway, anti-malware, IPS and DLP. Vendors call the security half without the SD-WAN networking SSE (security service edge): Zscaler sells its multimode CASB as part of its SSE platform, and Netskope's menu splits "Security Convergence (SSE)" from "Security and Network Convergence (SASE)".

For a SOC the difference shows up in the logs. On a SASE or SSE platform, CASB, web gateway and ZTNA events come from one vendor, keyed to the same user, so one search shows the sign-in, the web traffic and the file activity. With Defender for Cloud Apps you get the CASB records in CloudAppEvents and do the joins yourself, on AccountObjectId or the user principal name, against sign-in and proxy logs.