saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/detecting-shadow-it-cloud-usage/SKILL.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.2 KiB
Raw Blame History

name description domain subdomain tags version author license nist_csf
detecting-shadow-it-cloud-usage Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification. cybersecurity cloud-security
shadow-IT
SaaS-discovery
proxy-logs
DNS-analysis
netflow
cloud-security
pandas
1.0 mahipal Apache-2.0
PR.IR-01
ID.AM-08
GV.SC-06
DE.CM-01

Detecting Shadow IT Cloud Usage

Overview

Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.

When to Use

  • When investigating security incidents that require detecting shadow it cloud usage
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with pandas, tldextract
  • Proxy logs (Squid, Zscaler, or Palo Alto format) or DNS query logs
  • SaaS application catalog/blocklist for classification
  • Network firewall logs with FQDN resolution (optional)

Steps

  1. Parse proxy access logs and extract destination domains with traffic volumes
  2. Parse DNS query logs to identify resolved cloud service domains
  3. Aggregate traffic by domain using pandas — total bytes, request counts, unique users
  4. Classify domains against known SaaS categories (storage, email, dev tools, AI)
  5. Flag unauthorized services not on the approved application list
  6. Calculate risk scores based on data volume, user count, and service category
  7. Generate shadow IT discovery report with remediation recommendations

Expected Output

  • JSON report listing discovered cloud services with traffic volumes, user counts, risk scores, and approval status
  • Top unauthorized services ranked by data exfiltration risk