Detecting Shadow IT Cloud Usage is a Python-based skill designed to help organizations uncover unauthorized use of SaaS applications and cloud services. By analyzing proxy access logs, DNS query logs, and firewall/netflow data, this skill provides a comprehensive overview of cloud service usage that is not sanctioned by IT departments. It uses the powerful data manipulation capabilities of the pandas library to aggregate and analyze traffic data, allowing security teams to identify potential risks associated with shadow IT.

The skill begins by parsing proxy access logs to extract destination domains and their associated traffic volumes. It then examines DNS query logs to identify resolved domains that may be linked to cloud services. By aggregating this information, the skill can provide insights into total bytes transferred, request counts, and the number of unique users accessing these services. Each discovered domain is classified against a predefined list of known SaaS categories, enabling organizations to quickly assess which services are being used without approval.

One of the key features of this skill is its ability to calculate risk scores based on data volume, user count, and the category of the service. This scoring mechanism helps prioritize which unauthorized services pose the greatest risk to the organization, allowing for targeted remediation efforts. The output is a structured JSON report that details discovered cloud services, their traffic volumes, user counts, risk scores, and whether they are on the approved application list.

This skill is particularly useful for security analysts and SOC teams who need to conduct audits of cloud service usage. It provides a systematic approach to identifying shadow IT, validating security monitoring coverage, and generating reports that can guide remediation strategies. By leveraging this tool, organizations can enhance their cloud security posture and ensure compliance with internal policies.