Which Cisco Umbrella export do I need for a shadow AI audit?

The DNS activity export as CSV over your chosen window, keeping the Identities and Domain columns. Including both allowed and blocked rows gives the fullest picture.

Are Umbrella DNS logs enough to detect shadow AI without proxy logs?

Yes. Every AI tool use starts with a DNS resolution, and hostname evidence is what the audit matches against its register of classified AI domains.

Does the audit use Umbrella's built-in AI categories?

No. Raw domains are matched against an independently maintained register, adding per-tool risk levels, dated training verdicts and a sanctioned versus unsanctioned split.

How large can an Umbrella export be for the audit?

The free preview accepts 5,000 lines or 2 MB. The full report accepts 2,000,000 lines or 25 MB, with larger exports handled on request.

Does roaming client traffic show up in the audit?

Yes. Umbrella roaming identities log DNS activity wherever the device is, so off-network AI usage appears attributed to the roaming client.

Why do DNS hit counts look low for heavily used AI tools?

Device DNS caching means one logged query can represent a long session. Treat hits as a floor and rely on the per-identity user counts.

Guides / Cisco Umbrella

Detect shadow AI in Cisco Umbrella logs

Umbrella sits at the DNS layer, which means it already saw every AI tool anyone resolved, on every network it protects. This guide turns its activity export into a per-user shadow AI inventory.

Layer: DNS

Identity: Identities column, users and devices

Format: CSV activity export

Per-user table: yes

Run a free audit on an Umbrella export

shadow-ai-audit.pdf

Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings.

Sample report View all 11 pages Opens in your browser · PDF

Why Umbrella works so well

DNS-layer visibility is the widest net

Umbrella's vantage point catches AI use that URL-level tools miss, and it does so for every device behind it.

Everything resolves first

Browsers, desktop apps, mobile apps and scripts all start with a DNS query. An AI tool cannot be used from your network without appearing in Umbrella's logs at least once.

Identities are first-class

Umbrella attaches the requesting identity to each query: AD users, roaming clients, network devices or internal networks. That single column is what turns totals into accountability.

Roaming devices included

Laptops running the roaming client keep logging DNS wherever they are. Umbrella exports often cover the coffee-shop usage other log sources structurally miss.

The trade-off: DNS sees hostnames, not URLs. You learn that chatgpt.com was reached 412 times, not which conversations happened. For an inventory audit, hostnames are exactly enough, and they are why the upload contains nothing sensitive.

The export

Getting the right file out of Umbrella

You want the DNS activity export as CSV, over your chosen window, with identities included. Conceptually it lives in the reporting area's activity search; the exact menu label varies by Umbrella package and console version.

TimestampWhen the query happened. Keeps your window honest and lets re-runs compare cleanly.

IdentitiesThe user, device or network that made the query. This is the column that unlocks the per-user breakdown, so keep it in the export.

DomainThe hostname that was resolved. The only strictly required field: every match starts here.

ActionAllowed or blocked. Keep both: allowed shows exposure, blocked shows attempts your policy already stops.

CategoriesUmbrella's own labels. Not needed for matching, but interesting to compare against the audit's verdicts afterwards.

Timestamp,Identities,Domain,Action "2026-09-14 09:02:11","FIN\a.brandt","otter.ai","Allowed" "2026-09-14 09:02:38","FIN\a.brandt","teams.microsoft.com","Allowed" "2026-09-14 09:11:04","FIN\k.osei","chatgpt.com","Allowed" "2026-09-14 09:14:47","TRD\m.veld","perplexity.ai","Allowed" "2026-09-14 09:15:02","Roaming-LT-044","claude.ai","Allowed" "2026-09-14 09:17:29","FIN\a.brandt","api.otter.ai","Allowed"

Six realistic lines. Highlighted domains are the ones the audit will match; api.otter.ai walks up to the same tool as otter.ai, so hits aggregate correctly.

Size tip: filter the export to allowed traffic if your file runs long. The free preview takes 5,000 lines or 2 MB; a full report takes 2,000,000 lines or 25 MB.

Worked scenario

A finance firm finds a transcription habit

A 120-person investment advisory, Umbrella on all sites, roaming clients on laptops. Names and numbers are sample data; the pattern is one we designed the audit around.

MONDAY 14:00The export

The operations lead pulls 30 days of DNS activity as CSV: 41,000 lines with identities. Too big for the free tier, so it goes straight into a paid full report.

MONDAY 14:20The headline numbers

19 AI tools across 7 categories. Compliance expected chatbots. What they did not expect: otter.ai as the third most-used AI domain in the firm.

MONDAY 14:40The uncomfortable row

The per-user table shows six identities in the advisory team reaching otter.ai daily, hundreds of hits each. Someone has been transcribing client calls through a personal account for months.

The tool's verdict row explains the stakes: meeting audio, trains unless opted out, and nobody had opted out because nobody knew.

TUESDAYThe resolution

The firm sanctions an enterprise transcription tool with no-training terms, migrates the six users, and blocks the consumer domain at the Umbrella policy level.

The audit PDF goes into the compliance file with a note: found via DNS evidence, dated, resolved in 48 hours.

Report slice, sample data

ToolTrainingRiskUsers

chatgpt.comOpt-out switchmedium34

otter.aiOpt-out switchmedium6

perplexity.aiOpt-out switchmedium11

deepseek.comOpt-out switchhigh2

Why DNS caught it

Otter runs as a bot that joins calls, so its traffic comes from app and API subdomains, not browsing. Umbrella logged every one of those resolutions; nobody's browser history would have shown it.

Why the identity column mattered

Without identities, "otter.ai, 1,900 hits" is a curiosity. With them, it is six specific advisory-team members and a concrete remediation plan.

What comes back

What the report returns for an Umbrella export

Umbrella's identity model maps cleanly onto every report section.

Report section	With an Umbrella CSV
Summary tiles	Full totals: tools found, high-risk, training exposure, abusive-purpose, unsanctioned.
Tool table	Every matched domain with category, risk, sovereignty, dated training verdict and policy verdict.
Per-user breakdown	Populated from the Identities column: users, roaming clients and network identities, each with tools and hit counts.
Sanctioned split	Your approved list against reality, per tool and per identity.
Blocked vs allowed	If you kept the Action column, attempts against already-blocked AI domains stay visible as policy evidence.
CSV + PDF	Machine-readable tool table plus the evidence pack, full report tier.

The Umbrella export is read once and discarded after matching. The report lives 90 days in your account, deletable earlier. No agent, no API keys, no console access needed.

Umbrella-specific edges

Limits worth knowing before you export

Four Umbrella-shaped details that change how you read the results.

Cached lookups undercount hits

Devices cache DNS answers, so one logged query can represent hours of use.
Treat hit counts as a floor, and user counts as the reliable number.

Network identities blur people

Sites without the AD connector log queries against the network identity, not a user.
The audit still counts those as distinct sources; expect coarser attribution there.

Selective decryption changes nothing here

DNS queries are visible whether or not HTTPS inspection is on.
That is what makes an Umbrella export the lowest-friction first audit for most Cisco shops.

Already blocking an AI category?

Keep the export unfiltered. Attempts against blocked domains are evidence your policy works, and embedded AI often lives outside the category.
The sequencing argument is on detect before you block.

Identity shapes

The four identity types, and how each reads in the report

Umbrella attaches one of four identity shapes to every query. Knowing which your deployment emits sets expectations for the per-user table.

AD users

The gold standard: DOMAIN\username per query, via the AD connector or virtual appliances.
The report's per-user table becomes a literal list of people to coach.

Roaming clients

Device-named identities like Roaming-LT-044, logged wherever the laptop goes.
Attribution is per device; map device to owner in your asset system afterwards.

Networks and sites

Sites without a connector log the egress network as the identity.
The audit counts each network as one source, so tool lists stay right while user counts read low.

Mobile and BYOD

Guest and BYOD segments usually appear as network identities too.
A guest network with heavy AI resolution is a policy question of its own: whose devices, whose data?

After the report

Closing the loop inside Umbrella

The audit ends with verdicts. Umbrella is where three of them become configuration, and the next audit proves they held.

1. Block the block-list

Tools the report marks Block, typically abusive-purpose and high-risk domains, go into a destination list attached to your policy. Minutes of work with the report's CSV open.

2. Sanction with terms

Tools worth keeping move to enterprise tiers with no-training terms, then onto your approved list. The next audit's sanctioned split measures adoption.

3. Re-run to verify

Same window length next month. Blocked domains should show only attempts; if allowed hits persist, a device is bypassing DNS policy, which is its own finding.

This loop, audit, configure, re-audit, is what plans with monthly audit allowances are for. Costs are on the pricing page; the cadence logic is on how it works.

Sizing

How big is an Umbrella export, really

DNS volume scales with headcount and chattiness. Planning numbers for the two audit tiers.

Small: under 100 identities

A week of activity often fits the free preview if you filter to allowed web traffic. A month belongs in a full report.

Mid: 100 to 1,000

Expect tens to hundreds of thousands of lines a month. Comfortably inside the 2,000,000-line full-report ceiling.

Large: 1,000+

Trim to two weeks, filter to allowed, or ask us to take the whole quarter as a custom run.

Preflight checklist

Prepare an export that can answer the real questions

Ten minutes of preparation makes the difference between a list of domains and a report the security team can act on. Record these choices with the exported file so the next run can use the same scope.

Confirm the time zone

Umbrella timestamps can reflect the organization setting, the reporting view or UTC depending on the export path. Note the time zone before comparing events with endpoint or incident records. A clear scope line prevents an apparent one-hour gap from becoming a false finding.

Choose a normal window

Use 14 to 30 days without a holiday shutdown, resolver migration or organization-wide outage. If a normal month exceeds the file limit, shorten the period or split it by identity group. Keep the window length stable when measuring change.

Keep identity context

Include the Identities column even when some rows contain only a network or roaming-client name. It is better to preserve honest, coarse attribution than to remove the field because it is incomplete. Record which sites have AD-level identity and which do not.

Retain allowed and blocked rows

Allowed activity describes exposure. Blocked activity shows demand and tests whether the destination policy is firing. When size forces a choice, audit allowed traffic first, then run a smaller blocked-only review as policy evidence.

Do not enrich the CSV

The audit needs hostname, timestamp and identity-related columns. Do not append full URLs, request bodies, HR attributes or prompt content. Add department context after matching, inside your controlled review process, only for identities that need follow-up.

Hash and label the source

Give the export a descriptive filename and preserve its checksum with the report. Record the console filter, export time and analyst. These small steps make the evidence reproducible when internal audit asks where a result came from months later.

A useful scope note can fit on one line: “Umbrella DNS activity, 1–30 September, all corporate networks and roaming clients, identities available for three of four sites, allowed and blocked actions included.”

Troubleshooting

When an Umbrella export does not look right

Most weak results come from scope or formatting, not from an absence of AI use. Check the symptom against the likely cause before repeating the export.

Symptom	Likely explanation	What to check next
Almost every row has the same identity	The export contains a network identity because the site is not sending AD or device attribution.	Check virtual-appliance, connector and roaming-client coverage. The domains remain useful, but describe the result as site-level rather than user-level.
Known AI use is missing	The device may use another resolver, encrypted DNS, mobile data, a VPN outside the Umbrella path or a cached answer.	Test from the same device and identity, then confirm policy assignment and DNS path. Compare endpoint or secure-web-gateway records if available.
Hit counts seem too low	DNS caching lets many requests follow one lookup. Long browser and desktop-app sessions can generate little fresh DNS traffic.	Use distinct identities and repeat days as the primary prevalence signals. Treat raw lookups as a floor, not a measure of prompts or minutes.
One service appears under several hostnames	AI products commonly use API, authentication, content and regional subdomains.	Let the audit normalize related hostnames to the registered tool. Review the matched-domain detail before treating each hostname as a separate product.
The CSV will not parse	Localized delimiters, altered headers, spreadsheet conversions or a partial download can change the file.	Export directly from Umbrella again, keep the original CSV encoding and avoid opening then resaving it in a spreadsheet before upload.
Blocked tools still appear next month	Blocked DNS queries are expected when a user, extension or application keeps attempting access.	Check the Action column. Blocked-only rows prove enforcement; allowed rows may show another policy, resolver path or domain that needs review.

Review workflow

Move from a matched domain to a fair decision

An Umbrella event is a strong discovery signal and a deliberately limited one. It identifies where to look without exposing what a person typed. Use a short validation sequence before labeling a tool or user.

1. Validate the identity

Determine whether the value represents a person, laptop, shared workstation, service account or network. Map a device to its owner only when follow-up requires it. Preserve the original Umbrella value in the evidence.

2. Read the pattern

Look at first and last observation, repeat days, action and related domains. One isolated lookup can come from an email preview. Consistent weekday activity from the same identity is more likely to represent a workflow.

3. Ask about the task

Use neutral questions: what problem does the tool solve, what account is used, what data enters it and why was the approved option insufficient? This uncovers unmet needs and avoids treating access as proof of misuse.

4. Review the exact plan

Consumer, team and enterprise plans can have different training, retention and administrative controls. Record the plan and relevant terms with a date. Do not approve a brand name without defining the approved account type.

5. Choose the disposition

Approve the use, restrict it to public data, migrate it to an enterprise account, coach the user, block it or open an incident when evidence indicates disclosure. Name an owner and target date for every material finding.

6. Verify in Umbrella

Run a comparable export after the target date. Confirm that allowed use moved to the sanctioned service and that restricted domains show only blocked attempts. Persistent allowed traffic deserves technical follow-up.

Control evidence

Build a repeatable Umbrella audit record

The strongest evidence pack connects source, finding, decision and verification. Keep each artifact concise enough that another reviewer can reproduce the logic.

Source record

Preserve the export filename, checksum, reporting filter, time zone, dates, included policies and identity coverage. Note any site, roaming population or subsidiary outside the Umbrella organization used for the run.

Finding register

For each material tool, retain matched domains, active identities, repeat days, action and sanctioned status. Add business context only after validation, clearly separating observed facts from interview notes and analyst inference.

Decision record

Name the owner, permitted purpose, data limits, required account tier and disposition. Link vendor review, exception approval, coaching or incident tickets. Include an expiry date when the decision is temporary.

Verification record

Attach the follow-up report using the same scope. Explain changes in identity coverage or window length. A successful control shows lower unsanctioned prevalence, higher approved-tool adoption or blocked-only attempts after configuration.

For leadership, report coverage, distinct active identities, sanctioned adoption, new unreviewed tools, high-risk identities and median time to disposition. Avoid presenting DNS hit volume as prompt count or employee productivity.

Operating cadence

A practical schedule for Cisco security teams

Shadow AI changes faster than an annual vendor review. A light monthly rhythm keeps the inventory current without turning every domain into an investigation.

Monthly: detect change

Export the same populations and compare newly observed tools, active identities and sanctioned share. Triage new high-risk services first. Close obvious technical traffic quickly and send only material clusters to business owners.

Quarterly: review decisions

Revisit heavily used services, expiring exceptions and vendor terms. Confirm that the approved list names account tiers and use cases. Review gaps in connector, roaming-client and site coverage with the Umbrella administrator.

Annually: test governance

Sample decisions from discovery through remediation. Confirm ownership, retention, employee notice and escalation paths. Use the year of reports to show how observed behavior changed after approved tools and policy controls were introduced.

FAQ

Umbrella export questions

Which Umbrella export does the audit need?

The DNS activity export as CSV, over your chosen window, with the Identities and Domain columns. Allowed and blocked rows both help.

Do I need Umbrella's own AI category reports?

No. The audit matches raw domains against its own register, which adds per-tool risk, dated training verdicts and the sanctioned split that category reporting cannot express.

We only have DNS logs, not proxy logs. Enough?

Yes. Hostname evidence is exactly what the audit consumes; the whole methodology is built on it. See how detection works.

How large can the export be?

Free preview: 5,000 lines or 2 MB. Full report: 2,000,000 lines or 25 MB. A month from a mid-size Umbrella deployment usually fits the full tier easily.

Will roaming-client traffic appear?

Yes, roaming identities log DNS wherever the laptop is, so off-site AI use shows up attributed to the device.

Can I re-run the same window later?

Yes, and verdict changes between runs are findings: a tool that changed its training terms shows a different dated verdict.