Guides / Cisco Umbrella

Detect shadow AI in Cisco Umbrella logs

Umbrella sits at the DNS layer, which means it already saw every AI tool anyone resolved, on every network it protects. This guide turns its activity export into a per-user shadow AI inventory.

Layer: DNS
Identity: Identities column, users and devices
Format: CSV activity export
Per-user table: yes
Run a free audit on an Umbrella export
Why Umbrella works so well

DNS-layer visibility is the widest net

Umbrella's vantage point catches AI use that URL-level tools miss, and it does so for every device behind it.

Everything resolves first

Browsers, desktop apps, mobile apps and scripts all start with a DNS query. An AI tool cannot be used from your network without appearing in Umbrella's logs at least once.

Identities are first-class

Umbrella attaches the requesting identity to each query: AD users, roaming clients, network devices or internal networks. That single column is what turns totals into accountability.

Roaming devices included

Laptops running the roaming client keep logging DNS wherever they are. Umbrella exports often cover the coffee-shop usage other log sources structurally miss.

The trade-off: DNS sees hostnames, not URLs. You learn that chatgpt.com was reached 412 times, not which conversations happened. For an inventory audit, hostnames are exactly enough, and they are why the upload contains nothing sensitive.

The export

Getting the right file out of Umbrella

You want the DNS activity export as CSV, over your chosen window, with identities included. Conceptually it lives in the reporting area's activity search; the exact menu label varies by Umbrella package and console version.

TimestampWhen the query happened. Keeps your window honest and lets re-runs compare cleanly.
IdentitiesThe user, device or network that made the query. This is the column that unlocks the per-user breakdown, so keep it in the export.
DomainThe hostname that was resolved. The only strictly required field: every match starts here.
ActionAllowed or blocked. Keep both: allowed shows exposure, blocked shows attempts your policy already stops.
CategoriesUmbrella's own labels. Not needed for matching, but interesting to compare against the audit's verdicts afterwards.
Timestamp,Identities,Domain,Action "2026-09-14 09:02:11","FIN\a.brandt","otter.ai","Allowed" "2026-09-14 09:02:38","FIN\a.brandt","teams.microsoft.com","Allowed" "2026-09-14 09:11:04","FIN\k.osei","chatgpt.com","Allowed" "2026-09-14 09:14:47","TRD\m.veld","perplexity.ai","Allowed" "2026-09-14 09:15:02","Roaming-LT-044","claude.ai","Allowed" "2026-09-14 09:17:29","FIN\a.brandt","api.otter.ai","Allowed"

Six realistic lines. Highlighted domains are the ones the audit will match; api.otter.ai walks up to the same tool as otter.ai, so hits aggregate correctly.

Size tip: filter the export to allowed traffic if your file runs long. The free preview takes 5,000 lines or 2 MB; a full report takes 2,000,000 lines or 25 MB.

Worked scenario

A finance firm finds a transcription habit

A 120-person investment advisory, Umbrella on all sites, roaming clients on laptops. Names and numbers are sample data; the pattern is one we designed the audit around.

MONDAY 14:00The export

The operations lead pulls 30 days of DNS activity as CSV: 41,000 lines with identities. Too big for the free tier, so it goes straight into a paid full report.

MONDAY 14:20The headline numbers

19 AI tools across 7 categories. Compliance expected chatbots. What they did not expect: otter.ai as the third most-used AI domain in the firm.

MONDAY 14:40The uncomfortable row

The per-user table shows six identities in the advisory team reaching otter.ai daily, hundreds of hits each. Someone has been transcribing client calls through a personal account for months.

The tool's verdict row explains the stakes: meeting audio, trains unless opted out, and nobody had opted out because nobody knew.

TUESDAYThe resolution

The firm sanctions an enterprise transcription tool with no-training terms, migrates the six users, and blocks the consumer domain at the Umbrella policy level.

The audit PDF goes into the compliance file with a note: found via DNS evidence, dated, resolved in 48 hours.

Report slice, sample data
ToolTrainingRiskUsers
chatgpt.comOpt-out switchmedium34
otter.aiOpt-out switchmedium6
perplexity.aiOpt-out switchmedium11
deepseek.comOpt-out switchhigh2

Why DNS caught it

Otter runs as a bot that joins calls, so its traffic comes from app and API subdomains, not browsing. Umbrella logged every one of those resolutions; nobody's browser history would have shown it.

Why the identity column mattered

Without identities, "otter.ai, 1,900 hits" is a curiosity. With them, it is six specific advisory-team members and a concrete remediation plan.

What comes back

What the report returns for an Umbrella export

Umbrella's identity model maps cleanly onto every report section.

Report sectionWith an Umbrella CSV
Summary tilesFull totals: tools found, high-risk, training exposure, abusive-purpose, unsanctioned.
Tool tableEvery matched domain with category, risk, sovereignty, dated training verdict and policy verdict.
Per-user breakdownPopulated from the Identities column: users, roaming clients and network identities, each with tools and hit counts.
Sanctioned splitYour approved list against reality, per tool and per identity.
Blocked vs allowedIf you kept the Action column, attempts against already-blocked AI domains stay visible as policy evidence.
CSV + PDFMachine-readable tool table plus the evidence pack, full report tier.

The Umbrella export is read once and discarded after matching. The report lives 90 days in your account, deletable earlier. No agent, no API keys, no console access needed.

Umbrella-specific edges

Limits worth knowing before you export

Four Umbrella-shaped details that change how you read the results.

Cached lookups undercount hits

  • Devices cache DNS answers, so one logged query can represent hours of use.
  • Treat hit counts as a floor, and user counts as the reliable number.

Network identities blur people

  • Sites without the AD connector log queries against the network identity, not a user.
  • The audit still counts those as distinct sources; expect coarser attribution there.

Selective decryption changes nothing here

  • DNS queries are visible whether or not HTTPS inspection is on.
  • That is what makes an Umbrella export the lowest-friction first audit for most Cisco shops.

Already blocking an AI category?

  • Keep the export unfiltered. Attempts against blocked domains are evidence your policy works, and embedded AI often lives outside the category.
  • The sequencing argument is on detect before you block.

See what a finished audit looks like

The sample evidence pack shows the exact document an Umbrella export produces: tiles, tool table, per-identity breakdown, on sample data.

Open the sample PDF
Identity shapes

The four identity types, and how each reads in the report

Umbrella attaches one of four identity shapes to every query. Knowing which your deployment emits sets expectations for the per-user table.

AD users

  • The gold standard: DOMAIN\username per query, via the AD connector or virtual appliances.
  • The report's per-user table becomes a literal list of people to coach.

Roaming clients

  • Device-named identities like Roaming-LT-044, logged wherever the laptop goes.
  • Attribution is per device; map device to owner in your asset system afterwards.

Networks and sites

  • Sites without a connector log the egress network as the identity.
  • The audit counts each network as one source, so tool lists stay right while user counts read low.

Mobile and BYOD

  • Guest and BYOD segments usually appear as network identities too.
  • A guest network with heavy AI resolution is a policy question of its own: whose devices, whose data?
After the report

Closing the loop inside Umbrella

The audit ends with verdicts. Umbrella is where three of them become configuration, and the next audit proves they held.

1. Block the block-list

Tools the report marks Block, typically abusive-purpose and high-risk domains, go into a destination list attached to your policy. Minutes of work with the report's CSV open.

2. Sanction with terms

Tools worth keeping move to enterprise tiers with no-training terms, then onto your approved list. The next audit's sanctioned split measures adoption.

3. Re-run to verify

Same window length next month. Blocked domains should show only attempts; if allowed hits persist, a device is bypassing DNS policy, which is its own finding.

This loop, audit, configure, re-audit, is what plans with monthly audit allowances are for. Costs are on the pricing page; the cadence logic is on how it works.

Sizing

How big is an Umbrella export, really

DNS volume scales with headcount and chattiness. Planning numbers for the two audit tiers.

Small: under 100 identities

A week of activity often fits the free preview if you filter to allowed web traffic. A month belongs in a full report.

Mid: 100 to 1,000

Expect tens to hundreds of thousands of lines a month. Comfortably inside the 2,000,000-line full-report ceiling.

Large: 1,000+

Trim to two weeks, filter to allowed, or ask us to take the whole quarter as a custom run.

FAQ

Umbrella export questions

Which Umbrella export does the audit need?

The DNS activity export as CSV, over your chosen window, with the Identities and Domain columns. Allowed and blocked rows both help.

Do I need Umbrella's own AI category reports?

No. The audit matches raw domains against its own register, which adds per-tool risk, dated training verdicts and the sanctioned split that category reporting cannot express.

We only have DNS logs, not proxy logs. Enough?

Yes. Hostname evidence is exactly what the audit consumes; the whole methodology is built on it. See how detection works.

How large can the export be?

Free preview: 5,000 lines or 2 MB. Full report: 2,000,000 lines or 25 MB. A month from a mid-size Umbrella deployment usually fits the full tier easily.

Will roaming-client traffic appear?

Yes, roaming identities log DNS wherever the laptop is, so off-site AI use shows up attributed to the device.

Can I re-run the same window later?

Yes, and verdict changes between runs are findings: a tool that changed its training terms shows a different dated verdict.

Your Umbrella console already has the evidence

Export a week, upload it, and see the free totals in minutes. The finance firm's Monday afternoon can be yours.

Run the free audit