security analyst security skill risk: medium
Shadow IT Cloud Usage Detector
The prompt defines a procedure to detect unauthorized SaaS and cloud services by parsing proxy logs, DNS query logs, and netflow data, classifying domains, aggregating traffic volu…
SKILL 4 files · 2 folders
SKILL.md
--- name: detecting-shadow-it-cloud-usage description: "Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow" --- # Detecting Shadow IT Cloud Usage ## Overview Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements. ## When to Use - When investigating security incidents that require detecting shadow it cloud usage - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Python 3.9+ with `pandas`, `tldextract` - Proxy logs (Squid, Zscaler, or Palo Alto format) or DNS query logs - SaaS application catalog/blocklist for classification - Network firewall logs with FQDN resolution (optional) ## Steps 1. Parse proxy access logs and extract destination domains with traffic volumes 2. Parse DNS query logs to identify resolved cloud service domains 3. Aggregate traffic by domain using pandas — total bytes, request counts, unique users 4. Classify domains against known SaaS categories (storage, email, dev tools, AI) 5. Flag unauthorized services not on the approved application list 6. Calculate risk scores based on data volume, user count, and service category 7. Generate shadow IT discovery report with remediation recommendations ## Expected Output - JSON report listing discovered cloud services with traffic volumes, user counts, risk scores, and approval status - Top unauthorized services ranked by data exfiltration risk
REQUIRED CONTEXT
- proxy logs
- DNS query logs
- SaaS application catalog/blocklist
OPTIONAL CONTEXT
- network firewall logs with FQDN resolution
EXPECTED OUTPUT
- Format
- json
- Schema
- json · discovered cloud services with traffic volumes, user counts, risk scores, and approval status, Top unauthorized services ranked by data exfiltration risk
- Constraints
-
- list discovered cloud services with traffic volumes, user counts, risk scores, and approval status
- rank top unauthorized services by data exfiltration risk
SUCCESS CRITERIA
- Generate shadow IT discovery report with remediation recommendations
CAVEATS
- Dependencies
-
- Python 3.9+ with `pandas`, `tldextract`
- Proxy logs (Squid, Zscaler, or Palo Alto format) or DNS query logs
- SaaS application catalog/blocklist for classification
- Network firewall logs with FQDN resolution (optional)
- Missing context
-
- Exact schema or fields for the JSON report
- Format and sample entries for the SaaS application catalog/blocklist
- Ambiguities
-
- Risk score calculation method (data volume, user count, category) is not detailed.
- Exact classification rules or matching logic against SaaS categories not specified.
QUALITY
- OVERALL
- 0.78
- CLARITY
- 0.90
- SPECIFICITY
- 0.70
- REUSABILITY
- 0.80
- COMPLETENESS
- 0.75
IMPROVEMENT SUGGESTIONS
- Add a subsection under Steps or Expected Output that defines the risk scoring formula and weights.
- Include one concrete example of each supported log format (Squid, Zscaler, DNS) in the Prerequisites section.
USAGE
Copy the prompt above and paste it into your AI of choice — Claude, ChatGPT, Gemini, or anywhere else you're working. Replace any placeholder sections with your own context, then ask for the output.
MORE FOR SECURITY ANALYST
- Ransomware Network Indicators Analyzer security analyst security
- APT TTP Mapping with MITRE Navigator security analyst security
- Linux Persistence Mechanisms Analyzer security analyst security
- Azure AD Lateral Movement KQL Detector security analyst security
- Kerberos Golden Ticket Forgery Detector security analyst security
- LOLBAS Abuse Detection with Sigma Rules security analyst security
- Registry Run Key Persistence Detection Guide security analyst security
- Detect Risky OAuth Consent Grants in Entra ID security analyst security
- Windows Service Installation Threat Hunter security analyst security
- Web Server Log Intrusion Analyzer security analyst security
- RDP Brute Force Event Log Analyzer security analyst security
- Rekall Memory Forensics Artifact Extractor security analyst security
- Azure Activity Logs Threat Analyzer security analyst security
- Scapy Network Packet Analysis Guide security analyst security
- TLS Certificate Transparency Log Analyzer security analyst security
- Cobalt Strike Malleable C2 Profile Analyzer security analyst security
- Email Account Compromise Detection Procedures security analyst security
- Credential Stuffing Auth Log Analyzer security analyst security
- MISP Threat Intelligence Sharing with PyMISP security analyst security
- MISP Threat Landscape Analysis Guide security analyst security
- Malicious Scheduled Task Sysmon Detector security analyst security
- Kerberos Pass-the-Ticket Attack Detector security analyst security
- NTLM Relay Attack Event Log Analyzer security analyst security
- Linux Memory Forensics with LiME and Volatility security analyst security
- Insider Data Exfiltration DLP Analyzer security analyst security