From cybersec-toolkit
Detects unauthorized SaaS and cloud service usage by analyzing proxy logs, DNS query logs, and netflow data with Python pandas for traffic pattern analysis and domain classification.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:detecting-shadow-it-cloud-usageThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.
Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.
pandas, tldextractnpx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitDetects unauthorized SaaS and cloud service usage by analyzing proxy logs, DNS query logs, and netflow data with Python pandas for traffic pattern analysis and domain classification.
Detects shadow IT by analyzing proxy logs, DNS queries, and netflow data with Python pandas; classifies SaaS domains, flags unauthorized services, scores risks, generates reports. For SOC threat hunting and compliance audits.
Analyzes proxy, DNS query, and netflow logs using Python pandas to detect Shadow IT: unauthorized SaaS/cloud services. Aggregates traffic by domain, classifies SaaS categories, scores risks, generates JSON reports.