> ## Documentation Index > Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Shadow AI discovery > Find the AI services people in your organization use, including unapproved ones, from the network and security logs you already collect **Shadow AI discovery** shows which AI services people in your organization actually use, including the ones nobody approved. It reads a log source you already run, such as Cloudflare One, Netskope, CrowdStrike Falcon, or the Island Enterprise Browser, and matches the activity it finds against a catalog of known AI services. Discovery doesn't need any of your traffic to go through Openlayer. It works from your existing logs, so it also covers people using AI tools directly in a browser. > [!NOTE] > > Shadow AI discovery is turned on per deployment. If you don't see **Shadow AI > → Discovery** in the admin portal, [reach out to > us](mailto:support@openlayer.com) to turn it on. ## How it works **1. Connect a log source** In the admin portal, go to **Shadow AI → Discovery** and click **Connect**. Pick a source from the **Connectors** dialog and enter its details. You can connect more than one. Each [connector](#connectors) has its own setup guide. **2. Match activity to AI services** Openlayer matches the domains and app names in the source's logs against its catalog of AI services. Activity that isn't AI-related is ignored. When a source categorizes an app as AI but the catalog doesn't know it yet, the app still appears, under the source's name for it. **3. Review the findings** Each AI service becomes a **finding**, with its risk, how much it was used, who used it, and when. Mark each one **Sanctioned** or **Unsanctioned**. **4. Export what you want to block** Export the domains of your unsanctioned services in a format your enforcement tool accepts, such as a Cloudflare Gateway policy or a Zscaler URL category. ## Connectors | Source | What Openlayer reads | What you need | Counted in | | - | - | - | - | | [Cloudflare One](https://docs.openlayer.com/integrations/cloudflare-one.md) (Zero Trust) | Gateway DNS analytics, merged with HTTP analytics for user identity | An API token with **Account Analytics: Read** | DNS/HTTP requests | | [Netskope](https://docs.openlayer.com/integrations/netskope.md) | Application events, through the REST API v2 data-export iterator | A REST API v2 token from a service account | App events | | [CrowdStrike Falcon](https://docs.openlayer.com/integrations/crowdstrike-falcon-discovery.md) | Endpoint DNS and process telemetry, searched hourly through NG-SIEM | An API client with **NGSIEM** Read and Write | Active hours | | [Island Enterprise Browser](https://docs.openlayer.com/integrations/island-discovery.md) | Browser audit events, read from Island's SIEM API or pushed by Island | An Island API key, or a receiver secret for push | Browser navigations | The **Connectors** dialog lists the sources available on your deployment. CrowdStrike Falcon and Island are turned on separately from discovery. If you don't see them, [reach out to us](mailto:support@openlayer.com). Connector secrets never go into the admin portal. Each one lives in an environment variable where Openlayer runs, and the portal stores only the variable's name. Whoever runs your deployment sets the variable; if Openlayer hosts it for you, coordinate with us. ## Findings A finding is one AI service, such as ChatGPT or Claude, seen by one or more of your sources. The Discovery page summarizes them over the last hour, 6 hours, or 24 hours. When you connect more than one source, you can view them merged or one source at a time. **Each source is counted in its own unit.** Cloudflare counts DNS and HTTP requests, Netskope counts app events, CrowdStrike counts active hours, and Island counts browser navigations. None of these is a prompt count, and numbers in different units are never added together: * A finding's headline number comes from its **primary source**, the one with the most activity in its own unit, and is labeled with that unit. * **Seen by**, in the finding's details, lists every source's own figure. * Users and last-seen times are merged across sources. * **Devices** and **client tools**, such as Claude Code or a browser, come from CrowdStrike. * **Blocked attempts**, from Netskope and Island, are shown separately and never count as usage. Open a finding to see its activity, the sources that saw it, how the vendor handles data, the destinations observed, and who used it. ## Risk Each finding has a risk level: **Critical**, **High**, **Medium**, **Low**, or **Unknown**. It's derived from facts about the service in the catalog, so equivalent services get the same rating and every rating can be explained: * whether the vendor trains on the data you submit by default * whether it offers an enterprise data-processing agreement (DPA) * where your data is processed * whether people typically use it with personal accounts, outside your SSO * how sensitive the data people send it usually is Sensitivity only raises the risk when there's a governance gap, such as no DPA, training on your data, or personal accounts. An enterprise tool with those controls in place isn't penalized for seeing sensitive data. **Heavy, recent use raises a rating by one level.** That happens when the finding's primary source counts at least 500 in the range you're viewing (40 for CrowdStrike's active hours), and the service was last seen within 6 hours of the range's end. A rating is never raised past **Critical**, and the finding's risk explanation says when it was raised. An AI app that isn't in the catalog yet is rated **Unknown** until its facts are added. Use never raises an Unknown rating. ## Review and export New findings start as **Needs review**. Mark each one **Sanctioned** or **Unsanctioned**, and filter the list by status or risk to work through what's left. A review decision doesn't block anything by itself. To enforce it, click **Export** on the Discovery page and download your unsanctioned services' domains as one of: | Format | Output | | - | - | | Cloudflare Gateway | A DNS policy expression | | Zscaler URL category | A domain list | | Terraform | A `cloudflare_zero_trust_list` resource | | CSV | One row per service and domain | | JSON | Structured, for your own tooling | The export is read-only. It produces a file and never changes your enforcement tool. ## What's stored * **Cloudflare One** is queried live each time you open Discovery. Openlayer stores only your review decisions for it. * The other sources can't be queried again on each view, so Openlayer keeps counts of their AI activity for 30 days: * **Netskope** and **Island**: per-minute counts, plus the IDs of events already counted. * **CrowdStrike**: active hours, plus a cache of the processes it has looked up. * Raw log events, activity that isn't AI-related, and page, prompt, or response content are never stored. * Disconnecting Netskope, CrowdStrike, or Island deletes the counts Openlayer stored for it. ## FAQ > **Does my traffic need to go through Openlayer?** > > No. Discovery reads the logs your network or security tools already collect. > **Does discovery read prompts or responses?** > > No. The sources report which services were reached, by whom, and how often. > A count is an activity record, such as a DNS request or an app event, never > a prompt. > **Does marking a service Unsanctioned block it?** > > No. It records your decision and adds the service to the export. Blocking > happens in your enforcement tool, once you apply the exported list there. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.