Umbrella sits at the DNS layer, which means it already saw every AI tool anyone resolved, on every network it protects. This guide turns its activity export into a per-user shadow AI inventory.
Umbrella's vantage point catches AI use that URL-level tools miss, and it does so for every device behind it.
Browsers, desktop apps, mobile apps and scripts all start with a DNS query. An AI tool cannot be used from your network without appearing in Umbrella's logs at least once.
Umbrella attaches the requesting identity to each query: AD users, roaming clients, network devices or internal networks. That single column is what turns totals into accountability.
Laptops running the roaming client keep logging DNS wherever they are. Umbrella exports often cover the coffee-shop usage other log sources structurally miss.
The trade-off: DNS sees hostnames, not URLs. You learn that chatgpt.com was reached 412 times, not which conversations happened. For an inventory audit, hostnames are exactly enough, and they are why the upload contains nothing sensitive.
You want the DNS activity export as CSV, over your chosen window, with identities included. Conceptually it lives in the reporting area's activity search; the exact menu label varies by Umbrella package and console version.
TimestampWhen the query happened. Keeps your window honest and lets re-runs compare cleanly.IdentitiesThe user, device or network that made the query. This is the column that unlocks the per-user breakdown, so keep it in the export.DomainThe hostname that was resolved. The only strictly required field: every match starts here.ActionAllowed or blocked. Keep both: allowed shows exposure, blocked shows attempts your policy already stops.CategoriesUmbrella's own labels. Not needed for matching, but interesting to compare against the audit's verdicts afterwards.Six realistic lines. Highlighted domains are the ones the audit will match; api.otter.ai walks up to the same tool as otter.ai, so hits aggregate correctly.
Size tip: filter the export to allowed traffic if your file runs long. The free preview takes 5,000 lines or 2 MB; a full report takes 2,000,000 lines or 25 MB.
A 120-person investment advisory, Umbrella on all sites, roaming clients on laptops. Names and numbers are sample data; the pattern is one we designed the audit around.
The operations lead pulls 30 days of DNS activity as CSV: 41,000 lines with identities. Too big for the free tier, so it goes straight into a paid full report.
19 AI tools across 7 categories. Compliance expected chatbots. What they did not expect: otter.ai as the third most-used AI domain in the firm.
The per-user table shows six identities in the advisory team reaching otter.ai daily, hundreds of hits each. Someone has been transcribing client calls through a personal account for months.
The tool's verdict row explains the stakes: meeting audio, trains unless opted out, and nobody had opted out because nobody knew.
The firm sanctions an enterprise transcription tool with no-training terms, migrates the six users, and blocks the consumer domain at the Umbrella policy level.
The audit PDF goes into the compliance file with a note: found via DNS evidence, dated, resolved in 48 hours.
Otter runs as a bot that joins calls, so its traffic comes from app and API subdomains, not browsing. Umbrella logged every one of those resolutions; nobody's browser history would have shown it.
Without identities, "otter.ai, 1,900 hits" is a curiosity. With them, it is six specific advisory-team members and a concrete remediation plan.
Umbrella's identity model maps cleanly onto every report section.
| Report section | With an Umbrella CSV |
|---|---|
| Summary tiles | Full totals: tools found, high-risk, training exposure, abusive-purpose, unsanctioned. |
| Tool table | Every matched domain with category, risk, sovereignty, dated training verdict and policy verdict. |
| Per-user breakdown | Populated from the Identities column: users, roaming clients and network identities, each with tools and hit counts. |
| Sanctioned split | Your approved list against reality, per tool and per identity. |
| Blocked vs allowed | If you kept the Action column, attempts against already-blocked AI domains stay visible as policy evidence. |
| CSV + PDF | Machine-readable tool table plus the evidence pack, full report tier. |
The Umbrella export is read once and discarded after matching. The report lives 90 days in your account, deletable earlier. No agent, no API keys, no console access needed.
Four Umbrella-shaped details that change how you read the results.
The sample evidence pack shows the exact document an Umbrella export produces: tiles, tool table, per-identity breakdown, on sample data.
Umbrella attaches one of four identity shapes to every query. Knowing which your deployment emits sets expectations for the per-user table.
The audit ends with verdicts. Umbrella is where three of them become configuration, and the next audit proves they held.
Tools the report marks Block, typically abusive-purpose and high-risk domains, go into a destination list attached to your policy. Minutes of work with the report's CSV open.
Tools worth keeping move to enterprise tiers with no-training terms, then onto your approved list. The next audit's sanctioned split measures adoption.
Same window length next month. Blocked domains should show only attempts; if allowed hits persist, a device is bypassing DNS policy, which is its own finding.
This loop, audit, configure, re-audit, is what plans with monthly audit allowances are for. Costs are on the pricing page; the cadence logic is on how it works.
DNS volume scales with headcount and chattiness. Planning numbers for the two audit tiers.
A week of activity often fits the free preview if you filter to allowed web traffic. A month belongs in a full report.
Expect tens to hundreds of thousands of lines a month. Comfortably inside the 2,000,000-line full-report ceiling.
Trim to two weeks, filter to allowed, or ask us to take the whole quarter as a custom run.
The DNS activity export as CSV, over your chosen window, with the Identities and Domain columns. Allowed and blocked rows both help.
No. The audit matches raw domains against its own register, which adds per-tool risk, dated training verdicts and the sanctioned split that category reporting cannot express.
Yes. Hostname evidence is exactly what the audit consumes; the whole methodology is built on it. See how detection works.
Free preview: 5,000 lines or 2 MB. Full report: 2,000,000 lines or 25 MB. A month from a mid-size Umbrella deployment usually fits the full tier easily.
Yes, roaming identities log DNS wherever the laptop is, so off-site AI use shows up attributed to the device.
Yes, and verdict changes between runs are findings: a tool that changed its training terms shows a different dated verdict.
Export a week, upload it, and see the free totals in minutes. The finance firm's Monday afternoon can be yours.
Run the free audit