Shadow AI FinderShadow AI detector: find the unsanctioned AI apps in your logs
Upload or paste a proxy, DNS or firewall log, a sign-in export or a SaaS or expense list. Every AI app in it is flagged, with the exact line that gave it away, who used it, and whether it is on your approved list.
Nothing is uploaded. The file is read on your computer and the page is blocked from making network requests.
Names or domains, separated by commas or new lines. Anything found that isn't on this list is flagged as unsanctioned.
Drop log files here or
Proxy, DNS, firewall and sign-in logs, JSON lines, SaaS app lists and card or expense exports. Several files at once is fine.
Or paste lines instead
Exports it reads
These are recognised from their columns or line layout, so people, devices and first and last seen times come from the right fields:
| Format | Person from | Device from |
|---|---|---|
| Cloudflare Gateway DNS log | email | devicename |
| Cloudflare Gateway HTTP log | email | devicename |
| Microsoft Defender for Endpoint network events (DeviceNetworkEvents) | initiatingprocessaccountupn | devicename |
| Palo Alto Networks URL filtering log | source user | source address |
| Zscaler Internet Access web log | login | cip |
| Google Workspace OAuth log events | actor | ip address |
| Microsoft Entra ID sign-in log (SigninLogs or Graph signIn) | userprincipalname | ipaddress |
| Zeek dns, http or ssl log | — | id orig h |
| W3C extended log (#Fields: header) | cs username | c ip |
| Card or expense export (merchant column) | cardholder | — |
| SaaS app list or inventory export | owner | — |
| Squid native access.log | user field | client address |
JSON lines work as well as CSV, including Cloudflare Logpush's default JSON output, and a whole JSON document such as a Microsoft Graph sign-in export. Exports not listed above still work: host names are found anywhere in a line, including Windows DNS debug logs and Pi-hole query logs.
How each match is explained
An app is flagged for one of two reasons, and the report shows which one, with the value, the column and the line number:
- Domain. A host name in the line is one of 122 domains in the catalogue, or a subdomain of one. Each domain belongs to a single AI product, so
files.oaiusercontent.commeans ChatGPT and nothing else. - Product name. An application, merchant or app-list column contains one of 42 distinctive product names, such as "Otter.ai" in a sign-in log or "OPENAI *CHATGPT" on a card statement. Common words are left out, so a name match is worth a quick look, not proof.
What you can export
- Findings CSV: one row per app with status, data-risk tier, agent flag, requests, people or devices, domains seen, first and last seen, the first line and the reason it was flagged.
- Shadow AI report (Markdown) for a ticket or a risk register.
- Block or allow lists for DNS filters, proxies and firewalls, from your approve or block decisions.
What it recognises
79 AI services across 8 categories.
Browse the domains each service uses, or download them all as CSV or JSON (open data, CC BY 4.0).
What a log can't tell you
Traffic to a domain shows that a service was reached, not what was typed or uploaded. Personal phones and home networks don't appear in company logs, and AI features built into software you already use share that software's domains.
Read next
What shadow AI is, the risks it creates and how to detect it with the logs you already have.
Questions
Is my log uploaded anywhere?
No. Files are read on your computer and nothing you paste or upload is sent anywhere. The page's security policy lets it contact only Cloudflare's cookieless page-view counter (connect-src https://cloudflareinsights.com), which never receives your log. Files are read on your computer and are gone when you close the tab.
Which exports does it recognise?
12 formats by their columns or line layout: Cloudflare Gateway DNS log; Cloudflare Gateway HTTP log; Microsoft Defender for Endpoint network events (DeviceNetworkEvents); Palo Alto Networks URL filtering log; Zscaler Internet Access web log; Google Workspace OAuth log events; Microsoft Entra ID sign-in log (SigninLogs or Graph signIn); Zeek dns, http or ssl log; W3C extended log (#Fields: header); Card or expense export (merchant column); SaaS app list or inventory export; Squid native access.log. JSON lines and whole JSON documents are read too. Any other DNS, proxy, firewall or sign-in export still works: host names are found anywhere in each line.
What counts as unsanctioned?
Every AI service found that is not on the approved list you type in. With no list, everything found is flagged, so add the tools you have already approved to see only the rest.
How does it decide a line is an AI app?
Two rules. A host name in the line is one of the catalogue's AI domains or a subdomain of one, or an application, merchant or app-list column contains a distinctive AI product name. Each flagged app shows the exact value, the rule it matched, the column and the line.
How big a file can it handle?
Files are read line by line, so hundreds of megabytes work on a normal laptop. Very large exports take longer. A whole JSON document (rather than JSON lines) is read in one piece, up to 50 MB.
What does the data-risk tier mean?
It reflects what that kind of tool receives or can do: agents and model APIs are Critical, tools people paste text, code, documents or recordings into are High, and image, video and voice generators are Medium. It is not a rating of any vendor's security.
Should we block everything it finds?
Usually not. Most teams approve a few tools with proper terms, review the rest and block a small number. Mark each service in the report and export block or allow lists for IT.