skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-shadow-it-cloud-usage

Detect unauthorized SaaS and cloud service usage by analyzing proxy logs, DNS queries, and netflow data.

954|172|Updated Mar 13, 2026
Search Tags:#Pandas#cloud security#shadow IT#netflow#DNS analysis#proxy logs#saas discovery
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-shadow-it-cloud-usage
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-shadow-it-cloud-usage
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/detecting-shadow-it-cloud-usage
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-shadow-it-cloud-usage

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pandas, tldextract.

What problem does it solve?

Organizations lose visibility when employees adopt unauthorized SaaS and cloud services without IT approval, creating data exfiltration and compliance risks. This Skill analyzes proxy logs, DNS query logs, and netflow data to discover shadow IT, classify discovered services, and rank them by risk.

Core Features & Use Cases

  • Traffic Aggregation: Parse proxy and DNS logs and aggregate bytes, request counts, and unique users per domain using pandas.
  • SaaS Classification: Classify discovered domains against known SaaS categories (storage, email, dev tools, AI) and flag services not on the approved application list.
  • Risk Scoring & Reporting: Score services by data volume, user count, and category, then generate a JSON shadow IT discovery report with remediation recommendations.
  • Use Case: A SOC analyst investigating a data leak runs this analysis over the last 30 days of Zscaler proxy logs to find unsanctioned file-sharing services receiving large outbound transfers.

Quick Start

Analyze my proxy and DNS logs to identify unauthorized cloud services and produce a shadow IT risk report ranked by data exfiltration risk.

Frequently Asked Questions about detecting-shadow-it-cloud-usage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect shadow IT cloud usage from proxy logs?▼

Parse proxy access logs (Squid, Zscaler, or Palo Alto format) to extract destination domains and traffic volumes, then aggregate by registered domain with pandas. Classify domains against known SaaS categories and flag any service not on the approved application list.

How to analyze DNS query logs for unauthorized SaaS services?▼

Extract resolved domains from DNS query logs and normalize them with tldextract's registered_domain before aggregation. Compare results against a SaaS catalog to identify unsanctioned services, but note that DNS-over-HTTPS traffic will be invisible to this method.

Why does shadow IT detection miss services using DNS-over-HTTPS?▼

DoH routes DNS lookups through encrypted channels to resolvers like 1.1.1.1, bypassing enterprise DNS logs entirely. Flag connections to known DoH resolvers as a meta-signal and rely on proxy SNI or netflow data instead.

Can pandas aggregation miscount traffic for SaaS domains?▼

Yes, grouping by raw FQDN splits subdomains like drive.google.com from google.com, fragmenting counts and volumes. Normalize domains with tldextract(...).registered_domain before running groupby aggregations.

What are the limitations of proxy-log-based shadow IT detection?▼

QUIC/UDP 443 traffic bypasses HTTP proxies, encrypted SNI breaks SNI-based identification, and CDN fronting hides real SaaS domains behind CNAME chains. Reconcile proxy byte counts against netflow data to surface these visibility gaps.

Related Skills

Explore More Data & Analytics Skills→
RayzerrekRayzerrek

cloudflare-one-migrations

Plan Cloudflare One migrations from Zscaler, Palo Alto, VPN, SWG, and SASE environments.

Community
Advanced
zscalerzscaler
44

zins-audit-shadow-it

Identify and quantify shadow IT and unsanctioned SaaS usage via Zscaler Analytics.

Official
Advanced
skills-ilskills-il
10

israeli-drug-database

Retrieves Israeli MoH drug registry data including pricing, coverage, and generics.

Official
Intermediate
moonpaymoonpay
110

myriad-prediction-markets

Automate trading on Myriad prediction markets via the Myriad CLI and MCP servers.

Official
Intermediate