shadow-it-discovery
Skill0 starsChanged 12 days agoMITView on GitHub
Discover unsanctioned SaaS, cloud accounts, AI tools and infrastructure — via proxy/DNS/CASB logs, SSO and OAuth grant data, expense and procurement records, cloud org enrollment, email sign-up notifications and external attack surface data — and bring them under governance without just blocking. Use when assessing unmanaged technology risk, preparing SaaS governance, or after finding unknown assets.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
Shadow IT Discovery
Sources
| Source | Finds |
| Proxy / SWG / DNS logs | SaaS domains used, volume of uploads, users |
| CASB (Defender for Cloud Apps, Netskope, Zscaler) | App catalog with risk scores, discovered apps |
| OAuth consent / token data | Apps users connected to corporate identities (oauth-app-review) |
| Sign-up/verification emails from SaaS vendors to corporate addresses (search mail logs for "verify your email", "welcome to") | |
| Finance | Expense reports and card transactions for software/cloud vendors |
| Cloud providers | Accounts/subscriptions/projects using corporate emails outside the organization (AWS Organizations, Azure tenant discovery, GCP org) |
| External ASM | Hosts under corporate domains not in inventory (external-attack-surface-review) |
| Browser extensions | Extension inventory via EDR/MDM |
DNS example (Zeek): zeek-cut query < dns.log | awk -F. '{print $(NF-1)"."$NF}' | sort | uniq -c | sort -rn | head -100 → compare with sanctioned app list.
Triage
For each discovered app/account: users and departments, data types uploaded, authentication (SSO? local passwords?), vendor security posture (vendor-security-assessment), business need.
Decide: sanction (onboard to SSO/SCIM, contract, DPA), tolerate with controls (no sensitive data, monitored), replace with an approved alternative, or block (with communication). Generative AI tools deserve explicit policy and an approved option (llm-gateway-controls).
Output
App/asset | Category | Users | Data | Auth | Risk | Decision | Owner
Related skills
asset-inventory-reconciliation, oauth-app-review, vendor-security-assessment, llm-gateway-controls
References
- Microsoft Defender for Cloud Apps Cloud Discovery: https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery
- CIS Controls v8.1 Control 2 (Inventory of Software Assets): https://www.cisecurity.org/controls/inventory-and-control-of-software-assets
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.