Skill Market

detecting shadow it cloud usage

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow

GitHub
githubcommunityai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hacking
0.0
0 installs33.4K GitHub starsby mukul975

Skill Introduction

Overview
Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow

Core value

Turns reusable Debugging know-how into an installable skill, helping users complete github, community, ai-agents, claude-code work faster.

Target users

  • Developers, testers, and maintainers who handle Debugging tasks in Focus Code.
  • Teams that already trust workflows or content from mukul975.
  • Users who want standardized prompts, steps, or conventions instead of repeating setup work.

Best practices

  • Read the skill content first to confirm required inputs, expected outputs, and dependencies.
  • Try it on a small task before relying on it for critical work.
  • Add project-specific constraints such as coding style, target platform, test expectations, and delivery format.
  • For external sources, verify the source link, version, and recent maintenance activity.

Best use cases

  • Tasks related to github, community, ai-agents, claude-code that need a reusable execution flow.
  • Converting a community repo, team convention, or personal workflow into day-to-day assistance.
  • Starting from a proven skill instead of writing prompts or procedures from scratch.

Limits and boundaries

  • Results depend on the quality of the original skill content and may need human correction.
  • It does not replace code review, tests, security review, or professional judgment.
  • External tools, APIs, account permissions, and local dependencies still need separate setup.

Differentiation

  • Structured around Debugging, making it easier to discover and reuse than loose prompt snippets.
  • Marked as GitHub, which helps users judge trust and maintenance expectations.
  • Keeps the original source link available for repository, documentation, or discussion follow-up.
  • Tagged with github, community, ai-agents, claude-code, so it can be filtered by concrete task intent.

Install and use

Install
Copy Install Command
focus install detecting-shadow-it-cloud-usage-91b62f
View source

Detail Preview

SKILL.md

Primary filemarkdown3 KB

name: detecting-shadow-it-cloud-usage description: Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification. domain: cybersecurity subdomain: cloud-security tags:

  • shadow-IT
  • SaaS-discovery
  • proxy-logs
  • DNS-analysis
  • netflow
  • cloud-security
  • pandas version: '1.0' author: mahipal license: Apache-2.0 nist_csf:
  • PR.IR-01
  • ID.AM-08
  • GV.SC-06
  • DE.CM-01

Detecting Shadow IT Cloud Usage

Overview

Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.

When to Use

  • When investigating security incidents that require detecting shadow it cloud usage
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with pandas, tldextract
  • Proxy logs (Squid, Zscaler, or Palo Alto format) or DNS query logs
  • SaaS application catalog/blocklist for classification
  • Network firewall logs with FQDN resolution (optional)

Steps

  1. Parse proxy access logs and extract destination domains with traffic volumes
  2. Parse DNS query logs to identify resolved cloud service domains
  3. Aggregate traffic by domain using pandas — total bytes, request counts, unique users
  4. Classify domains against known SaaS categories (storage, email, dev tools, AI)
  5. Flag unauthorized services not on the approved application list
  6. Calculate risk scores based on data volume, user count, and service category
  7. Generate shadow IT discovery report with remediation recommendations

Expected Output

  • JSON report listing discovered cloud services with traffic volumes, user counts, risk scores, and approval status
  • Top unauthorized services ranked by data exfiltration risk

Reviews

Overall rating

0.0
0.0

0 comments

No reviews yet