Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count. Use when auditing an organization for unsanctioned cloud/SaaS usage or generating a shadow IT discovery report with remediation recommendations.
Start a fresh conversation. Replace the highlighted placeholders.
Use detecting-shadow-it-cloud-usage to analyze [proxy or DNS logs] against [SaaS catalog/blocklist] and return a shadow-IT discovery report with discovered services, traffic volumes, user counts, approval status, risk scores, and the highest-risk unauthorized services.
Required inputs
[proxy or DNS logs]
[SaaS catalog/blocklist]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: detecting-shadow-it-cloud-usagedescription: Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count. Use when auditing an organization for unsanctioned cloud/SaaS usage or generating a shadow IT discovery report with remediation recommendations.domain: cybersecuritysubdomain: cloud-securitytags: - shadow-IT- SaaS-discovery- proxy-logs- DNS-analysis- netflow- cloud-security- pandasversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- ID.AM-08- GV.SC-06- DE.CM-01mitre_attack: - T1567.002- T1526- T1078.004- T1213
Detecting Shadow IT Cloud Usage
Overview
Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.
When to Use
When investigating security incidents that require detecting shadow it cloud usage
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Python 3.9+ with pandas, tldextract
Proxy logs (Squid, Zscaler, or Palo Alto format) or DNS query logs
SaaS application catalog/blocklist for classification
Network firewall logs with FQDN resolution (optional)
Steps
Parse proxy access logs and extract destination domains with traffic volumes
Parse DNS query logs to identify resolved cloud service domains
Aggregate traffic by domain using pandas — total bytes, request counts, unique users
Classify domains against known SaaS categories (storage, email, dev tools, AI)
Flag unauthorized services not on the approved application list
Calculate risk scores based on data volume, user count, and service category
Generate shadow IT discovery report with remediation recommendations
Expected Output
JSON report listing discovered cloud services with traffic volumes, user counts, risk scores, and approval status
Top unauthorized services ranked by data exfiltration risk