Most SIEMs have zero visibility into 17,410+ AI tool domains employees use daily. Our domain intelligence feed plugs directly into Splunk, QRadar, Microsoft Sentinel, and Elastic SIEM for immediate shadow AI detection.
Your SIEM excels at detecting malware C2 traffic, credential stuffing, and lateral movement. But it completely ignores the AI tools employees use to submit proprietary data, source code, and customer records every day. The root cause is a classification problem: your SIEM can only alert on what it can identify.
| What Your SIEM Sees Today | What Your SIEM Misses |
|---|---|
| Malware C2 callbacks to known-malicious IPs | Employee pasting source code into AI chatbots |
| Data exfiltration to threat-intel flagged domains | POST requests uploading customer data to AI analytics tools |
| Credential stuffing and brute-force attempts | Developers using unauthorized AI code assistants |
| URLs categorized as "Malicious" or "Phishing" | AI tools hidden under generic labels like "Technology" or "Business" |
Standard URL categorization databases group AI tools under generic labels like "Technology." They cannot distinguish ChatGPT from GitHub, or an AI code assistant from a text editor.
The AI Tools Blocklist provides 17,410+ domains, each tagged with one of 18 functional categories, updated daily. Load it into your SIEM as a lookup table, reference set, or threat indicator. With AI domain intelligence, your SOC can:
Standard URL databases label AI tools as "Technology" or "Information Technology." The AI Tools Blocklist provides 18-category granularity that turns noise into signal.
POST requests to AI tools carry the highest risk. Without domain classification, your SIEM cannot differentiate data submissions to AI tools from ordinary API calls, making shadow AI detection impossible.
Splunk's CSV lookup mechanism is the fastest integration path. Import the domain feed, and every search across proxy, DNS, and firewall logs gets real-time AI classification enrichment.
ai_tools_blocklist.csv.
domain field so that any SPL search can use the lookup command for enrichment.
| lookup ai_tools_blocklist domain AS dest_domain in any search to add AI context.
| --- Splunk: AI Tool Detection Searches --- | 1. Enrich proxy logs with AI domain intelligence index=proxy sourcetype="proxy:access" OR sourcetype="swg:webtraffic" | eval dest_domain=lower(coalesce(url_domain, dest_host, uri_host)) | lookup ai_tools_blocklist domain AS dest_domain OUTPUT tool_name, primary_category | where isnotnull(tool_name) | stats count AS access_count, sum(bytes_out) AS total_bytes_sent, dc(src_user) AS unique_users, values(primary_category) AS categories, latest(_time) AS last_seen BY dest_domain, tool_name | sort - total_bytes_sent | table dest_domain, tool_name, categories, access_count, unique_users, total_bytes_sent, last_seen | 2. Alert: High-risk data submission to AI tools | Schedule: every 15 minutes | Alert: when results > 0 index=proxy sourcetype="proxy:access" http_method=POST bytes_out>5120 earliest=-15m | eval dest_domain=lower(url_domain) | lookup ai_tools_blocklist domain AS dest_domain OUTPUT tool_name, primary_category | where isnotnull(tool_name) | Customer-defined mapping: assign your own risk tier | to each blocklist category per your AI usage policy | eval category_risk=case( primary_category IN ("Text & Language"), "high", primary_category IN ("Lifestyle & Entertainment"), "low", 1==1, "medium") | where category_risk!="low" | eval severity=case( bytes_out>102400 AND category_risk="high", "critical", bytes_out>51200 OR category_risk="high", "high", 1==1, "medium") | table _time, src_user, src_ip, dest_domain, tool_name, primary_category, category_risk, bytes_out, severity | 3. Behavioral baseline: detect new AI tool adoption index=proxy sourcetype="proxy:access" earliest=-1d | eval dest_domain=lower(url_domain) | lookup ai_tools_blocklist domain AS dest_domain OUTPUT tool_name, primary_category | where isnotnull(tool_name) | stats earliest(_time) AS first_seen, dc(src_user) AS user_count BY dest_domain, tool_name, primary_category | join type=left dest_domain [| inputlookup ai_tool_baseline.csv] | where isnull(baseline_first_seen) | eval alert_msg="New AI tool detected: ".tool_name ." (".primary_category.") accessed by " .tostring(user_count)." users" | table dest_domain, tool_name, primary_category, first_seen, user_count, alert_msg | 4. Executive dashboard panel: AI tool usage by category index=proxy sourcetype="proxy:access" earliest=-7d | eval dest_domain=lower(url_domain) | lookup ai_tools_blocklist domain AS dest_domain OUTPUT tool_name, primary_category | where isnotnull(tool_name) | stats count AS events, dc(src_user) AS users, dc(dest_domain) AS tools, sum(eval(if(http_method="POST",1,0))) AS data_submissions BY primary_category | sort - events | rename primary_category AS "AI Category", events AS "Total Events", users AS "Unique Users", tools AS "Distinct Tools", data_submissions AS "Data Submissions"
Lists every AI tool accessed, access frequency, unique users, and total data sent. Your baseline visibility report.
Fires every 15 minutes when an employee POSTs >5 KB to an AI tool. Severity tiers by payload size and your own category-to-risk mapping.
Detects AI tools not in your baseline. The earliest indicator of unauthorized AI tool adoption.
Summarizes usage by AI tool category for weekly reporting. Shows event counts, unique users, and data submission volume.
Load the AI Tools Blocklist as a threat intelligence feed using the threatintel framework. AI tool access events automatically contribute to the per-user and per-asset risk scores that ES computes through its risk-based alerting framework.
Configure the feed as a domain indicator type in ES's threat intelligence management. The correlation search Threat Activity Detected automatically flags users whose AI activity exceeds your risk threshold.
Every lookup, reference set, watchlist, and enrich index on this page draws from the same continuously classified map of the AI tool landscape.
QRadar's in-memory reference sets are ideal for high-volume domain matching. They enable real-time evaluation of every event against the AI Tools Blocklist with minimal performance impact.
AI_Tool_Domains (type ALNIC, case-insensitive) and AI_Tool_Metadata with keys for domain, tool name, and category.
AI_Tool_Domains.
Map AI tool offenses to a dedicated playbook that automatically enriches with tool category, queries Active Directory for user department and manager, and creates a ticket for high-risk categories.
Auto-escalate for "Code Generation," "Data Analytics," and "AI Agents" categories. Reduces mean time from detection to investigation from hours to seconds.
Sentinel's native integration with Defender for Endpoint, Entra ID, and Purview makes it ideal for AI tool detection in Microsoft-centric environments. The AI Tools Blocklist imports as a watchlist with sub-second KQL query performance.
AIToolsBlocklist with SearchKey set to the domain column.
_GetWatchlist('AIToolsBlocklist').
// Microsoft Sentinel Analytics Rule: AI Tool Access Detection // Frequency: 15 minutes | Lookback: 20 minutes | Severity: Medium-High let AIToolDomains = _GetWatchlist('AIToolsBlocklist') | project Domain=tolower(domain), ToolName=tool_name, Category=primary_category // Customer-defined mapping: assign your own risk tier // to each blocklist category per your AI usage policy | extend CategoryRisk = case( Category in ("Text & Language"), "high", Category in ("Lifestyle & Entertainment"), "low", "medium"); // Query 1: DNS-based detection (broad coverage) let DNSMatches = DnsEvents | where TimeGenerated > ago(20m) | extend QueryDomain = tolower(Name) | join kind=inner AIToolDomains on $left.QueryDomain == $right.Domain | project TimeGenerated, Computer, ClientIP, QueryDomain, ToolName, Category, CategoryRisk, DetectionSource="DNS"; // Query 2: Proxy/web traffic (richer context) let ProxyMatches = CommonSecurityLog | where TimeGenerated > ago(20m) | where DeviceVendor in ("NGFW", "SWG", "UTM", "WebGateway") | extend DestDomain = tolower( coalesce(DestinationHostName, RequestURL)) | join kind=inner AIToolDomains on $left.DestDomain == $right.Domain | extend DataSubmission = (RequestMethod == "POST" and SentBytes > 5120) | project TimeGenerated, SourceUserName, SourceIP, DestDomain, ToolName, Category, CategoryRisk, RequestMethod, SentBytes, DataSubmission, DetectionSource="Proxy"; // Query 3: Defender for Endpoint device network events let MDEMatches = DeviceNetworkEvents | where Timestamp > ago(20m) | extend DestDomain = tolower(RemoteUrl) | join kind=inner AIToolDomains on $left.DestDomain == $right.Domain | project TimeGenerated=Timestamp, DeviceName, InitiatingProcessAccountName, DestDomain, ToolName, Category, CategoryRisk, DetectionSource="MDE"; // Union all sources and generate alerts DNSMatches | union ProxyMatches, MDEMatches | summarize AccessCount = count(), DataSubmissions = countif(DataSubmission == true), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sources = make_set(DetectionSource) by ToolName, Category, CategoryRisk, DestDomain | where CategoryRisk == "high" or DataSubmissions > 0 or AccessCount >= 10 | extend AlertSeverity = case( DataSubmissions > 0 and CategoryRisk == "high", "High", CategoryRisk == "high", "Medium", AccessCount >= 50, "Medium", "Informational") | sort by AlertSeverity asc, DataSubmissions desc
DataSubmission — the highest-risk interactionsCreate an "AI Tool Monitoring" workbook for shadow AI detection investigations and regulatory reporting.
Daily AI tool access trends with time range selectors and category filters
Which employees access the most AI tools and how frequently
Which types of AI tools are most popular across the organization
Highest-risk interactions with payload details and user attribution
Elastic Security's detection engine evaluates network events against enrichment indices. The recommended approach enriches events at index time for zero query-time overhead and sub-second alerting at scale.
ai-tools-blocklist index. Schedule daily downloads via the blocklist API.
domain field to AI tool metadata (tool name, category, subcategory).
| Aspect | Custom Query Rules | ML Anomaly Detection |
|---|---|---|
| Type | Deterministic alerting on known patterns | Behavioral anomaly detection |
| Use case | POST requests to high-risk AI tools | Users suddenly accessing new AI tool categories |
| High-severity rule | ai_tool.category: ("Text & Language") AND http.request.method: "POST" AND http.request.bytes > 5120 — every 5 min, with the category list scoped to the tool types your organization designates high-risk |
high_count detector on ai_tool.name, partitioned by user.name, 1-hour bucket span |
| Low-severity rule | ai_tool.name: * — every 30 min, severity: low |
Per-user baselines for access frequency |
| Strength | Catches every known-risk event | Surfaces subtle behavioral shifts deterministic rules miss |
Enrich events at index time using an Elasticsearch enrich policy. Every proxy, DNS, and firewall event is tagged with AI metadata before indexing.
Per-user and per-department baselines surface behavioral shifts: new tool adoption, data upload spikes, and off-hours access patterns.
Critical for data exfiltration, high for data submissions, medium for new tool adoption, low for access monitoring. Zero critical events missed.
AI tool detection quality depends on your log sources. Three critical data elements must be captured: the full destination domain or URL, the HTTP method (GET vs POST), and the request payload size.
Web proxy logs are the richest data source — full URL, HTTP methods, payload sizes, and user identity. Ensure these fields are logged:
client_ip, username, http_method, url, bytes_senthostname, url, requestmethod, requestsize, loginDNS logs capture every AI tool access attempt, since every connection starts with a DNS resolution. Limited to domain visibility only — no payload data.
EDR platforms capture AI tool access even when network controls are bypassed — personal hotspots, VPN split tunneling, etc.
DeviceNetworkEvents table captures outbound connections with process-level contextThe combination of proxy, DNS, and endpoint logs creates a three-layer detection mesh — AI tool usage becomes extremely difficult to evade regardless of network path.
Single-event detection generates noise that overwhelms any SOC. Effective monitoring requires multi-event correlation that surfaces data submissions to high-risk tools, sudden adoption changes, and policy-violating usage by privileged accounts — while suppressing low-risk browsing activity.
Triggers when Finance, Legal, HR, or Executive users access AI tools in categories your organization designates high-risk. Medium severity by default, escalates to High on POST >10 KB.
Triggers when a single user submits >100 KB to AI tools within one hour. Detects systematic document or dataset uploads requiring DLP investigation.
Triggers when a user accesses an AI tool category they've never used before. A developer using AI healthcare tools may indicate credential compromise or policy violation.
Triggers on AI access outside normal working hours. Combined with high-risk categories or large data submissions, this is a strong insider threat indicator.
When an AI tool alert fires, analysts should follow a structured workflow for consistent investigation quality and compliance documentation.
Identify the user, department, role, and data access level. Query AD and HR systems. Check if the tool is sanctioned or prohibited.
Evaluate the tool's category and subcategory from blocklist metadata against your own category-to-risk mapping. Assess data volume submitted. Cross-reference with risk assessment scoring.
Informational → log. Medium → notify user. High → escalate to manager. Critical → immediate access revocation and incident response.
Document the playbook in your SOAR platform and link it directly from the SIEM alert. Tier 1 analysts should access it in one click for consistent triage across shifts and skill levels.
Your dashboard should serve three audiences: SOC analysts (real-time triage), security managers (weekly trends), and compliance teams (regulatory reporting evidence).
Daily and weekly AI tool access volume with category breakdown sparklines
POST request tracking with payload size distribution and user attribution
Per-user and per-department AI tool adoption metrics with role-based risk scoring
Blocked vs. allowed ratio, policy hit rates, and exception tracking for audit evidence
Tell us which SIEM platform you use and we will deliver production-ready detection content for AI tool monitoring.
Tell us which SIEM platform you use and we will help you build AI tool detection workflows.