Your SIEM already collects the evidence. Turn 17,410+ classified AI domains into real-time unauthorized usage alerts.
Your detection capabilities cover malware, phishing, lateral movement, and exfiltration to known-bad infrastructure. But they share a critical blind spot.
Research from 2024-2025 consistently shows this figure. Without active AI governance, it climbs above 75%.
Engineers debugging code, marketers drafting content, analysts summarizing reports, legal teams reviewing contracts. Doing their jobs through external AI services.
You are not looking for malicious indicators. You need domain-level intelligence combined with SIEM correlation rules.
A classified feed of 17,410+ AI tool domains that your SIEM can ingest as a lookup table. Updated daily so new tools are flagged within 24 hours of discovery.
Pre-built search queries and correlation rules for Splunk, Microsoft Sentinel, Elastic, and QRadar that surface AI tool usage from your existing proxy and DNS logs.
Tiered alert rules that classify severity based on AI tool category, data volume transferred, user role sensitivity, and time-of-day patterns.
Structured incident response workflows for SOC analysts, including triage criteria, escalation paths, and automated containment actions through SOAR integration.
The integration follows a standard threat intelligence feed pattern. The AI Tools Blocklist CSV contains domain, category, subcategory, risk score, and metadata.
Ingest as a CSV lookup table. Use the lookup command to enrich proxy and DNS events.
Load as a Watchlist. Reference via _GetWatchlist() in KQL queries.
Ingest as an enrichment index. Apply through enrich processors in ingest pipelines.
Configure the blocklist as a lookup table in Splunk. Place the CSV in $SPLUNK_HOME/etc/apps/search/lookups/ and define it in transforms.conf.
# transforms.conf — Define the AI Tools lookup [ai_tools_blocklist] filename = ai_tools_blocklist.csv match_type = WILDCARD(domain) max_matches = 1 # props.conf — Auto-enrich proxy logs at search time [proxy_logs] LOOKUP-ai_tools = ai_tools_blocklist domain AS dest_domain OUTPUTNEW primary_category AS ai_category subcategory AS ai_subcategory risk_score AS ai_risk_score
ai_category, ai_subcategory, and ai_risk_score fieldsProduction-ready queries that SOC teams can deploy immediately as saved searches, scheduled reports, or alert triggers.
Identifies all AI tool access over 7 days, aggregated by domain, category, and user count. Results typically reveal 40-200 distinct AI tools in active use.
`| Search proxy logs for AI tool connections over 7 days` index=proxy sourcetype="proxy:access" OR sourcetype="swg:webtraffic" OR sourcetype="dns_filter:log" earliest=-7d@d latest=now | lookup ai_tools_blocklist domain AS dest_domain OUTPUTNEW primary_category AS ai_category subcategory AS ai_subcategory risk_score AS ai_risk | where isnotnull(ai_category) | stats dc(src_user) AS unique_users count AS total_requests sum(bytes_out) AS total_bytes_sent values(ai_subcategory) AS subcategories BY dest_domain ai_category ai_risk | sort - unique_users | eval data_sent_mb = round(total_bytes_sent / 1048576, 2) | table dest_domain ai_category subcategories ai_risk unique_users total_requests data_sent_mb | rename dest_domain AS "AI Tool Domain" ai_category AS "Category" unique_users AS "Unique Users" total_requests AS "Total Requests" data_sent_mb AS "Data Sent (MB)"
Targets HTTP POST requests to AI tool domains where outbound data exceeds a threshold. This is the most common alert trigger in production deployments.
`| Detect large data submissions to AI tools via POST requests` index=proxy sourcetype="proxy:access" OR sourcetype="swg:webtraffic" http_method=POST bytes_out>10240 earliest=-24h@h latest=now | lookup ai_tools_blocklist domain AS dest_domain OUTPUTNEW primary_category AS ai_category risk_score AS ai_risk | where isnotnull(ai_category) AND ai_category IN("Text & Language", "Code & Development", "Data & Analytics", "Autonomous Agents") | eval data_kb = round(bytes_out / 1024, 1) | eval severity = case( bytes_out > 1048576, "critical", bytes_out > 102400, "high", bytes_out > 10240, "medium", 1==1, "low") | stats count AS submissions sum(bytes_out) AS total_bytes max(severity) AS max_severity latest(_time) AS last_seen BY src_user dest_domain ai_category | where submissions > 1 OR total_bytes > 102400 | sort - total_bytes | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M") | table src_user dest_domain ai_category submissions total_bytes max_severity last_seen
Identifies AI tool domains that appeared for the first time in the past 48 hours. Catches new shadow AI adoption as it happens.
`| Detect newly-adopted AI tools not seen in prior 30 days` index=proxy sourcetype="proxy:access" OR sourcetype="swg:webtraffic" earliest=-48h@h latest=now | lookup ai_tools_blocklist domain AS dest_domain OUTPUTNEW primary_category AS ai_category | where isnotnull(ai_category) | stats dc(src_user) AS user_count min(_time) AS first_seen BY dest_domain ai_category | join type=left dest_domain [search index=proxy earliest=-32d@d latest=-48h@h | stats count AS prior_hits BY dest_domain] | where isnull(prior_hits) OR prior_hits = 0 | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M") | sort - user_count | table dest_domain ai_category user_count first_seen | rename dest_domain AS "New AI Tool" ai_category AS "Category" user_count AS "Users (48h)" first_seen AS "First Seen"
These three queries form the complete detection layer.
Baseline understanding of all AI tool usage in your environment.
Active data submission detection with severity classification.
New tool adoption detection before usage becomes entrenched.
Splunk lookups, Sentinel watchlists, and SOAR enrichment all draw from the same continuously refreshed AI domain intelligence.
Not all unauthorized AI tool usage carries equal risk. Flat alerting leads to fatigue within days. Effective frameworks classify severity across multiple dimensions.
This saved search implements the critical-severity alert. It runs every 15 minutes with a 5-minute overlap window to prevent gaps.
`| Critical alert: large data submission to high-risk AI tools` `| Schedule: every 15 minutes | Window: -20m to now` index=proxy http_method=POST bytes_out>1048576 earliest=-20m@m latest=now | lookup ai_tools_blocklist domain AS dest_domain OUTPUTNEW primary_category AS ai_category risk_score AS ai_risk | where isnotnull(ai_category) AND ai_category IN("Text & Language", "Code & Development", "Autonomous Agents", "Data & Analytics") | eval data_mb = round(bytes_out / 1048576, 2) | lookup user_risk_scores user AS src_user OUTPUTNEW department role access_level | eval severity = if(access_level="privileged" OR department IN("Legal","Finance","Executive"), "critical", "high") | table _time src_user src_ip dest_domain ai_category data_mb department role severity | sendalert notable param.rule_title="AI Tool Data Exfiltration" param.security_domain="endpoint" param.severity="critical"
The AI Tools Blocklist integrates as a Sentinel Watchlist. This KQL analytic rule correlates proxy events against the AI tools watchlist to surface unauthorized usage.
// KQL: Detect data submissions to unauthorized AI tools let ai_domains = _GetWatchlist('AIToolsBlocklist') | project Domain=tolower(domain), Category=primary_category, RiskScore=risk_score; CommonSecurityLog | where TimeGenerated > ago(24h) | where RequestMethod == "POST" and SentBytes > 10240 | extend dest_domain = tolower( parse_url(RequestURL).Host) | join kind=inner ai_domains on $left.dest_domain == $right.Domain | summarize Submissions = count(), TotalBytesSent = sum(SentBytes), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceUserName, dest_domain, Category, RiskScore | where TotalBytesSent > 102400 or Submissions > 5 | sort by TotalBytesSent desc
This is not a traditional security incident — the playbook reflects that.
An employee using a web browser.
Company data already submitted to an external AI service.
Damage assessment, policy enforcement, and future prevention.
Confirm the detection and classify the incident. For critical-severity alerts, complete this phase within 15 minutes.
The script below automates initial triage by pulling enrichment from the AI Tools Blocklist API and your identity provider.
#!/usr/bin/env python3 """Automated triage for unauthorized AI tool usage alerts.""" import requests import json from datetime import datetime def triage_ai_alert(alert: dict) -> dict: """Enrich an AI tool usage alert with context for SOC analyst.""" domain = alert["dest_domain"] user = alert["src_user"] bytes_sent = alert.get("bytes_out", 0) # Classify data exposure severity if bytes_sent > 1_048_576: exposure = "critical" action = "immediate_block" elif bytes_sent > 102_400: exposure = "high" action = "investigate_and_block" else: exposure = "medium" action = "monitor_and_notify" # Look up user context from identity provider user_ctx = lookup_user(user) # Escalate if user has privileged access if user_ctx.get("access_level") == "privileged": exposure = "critical" action = "immediate_block" return { "incident_id": generate_incident_id(), "timestamp": datetime.utcnow().isoformat(), "domain": domain, "user": user, "department": user_ctx.get("department"), "data_exposure_mb": round(bytes_sent / 1_048_576, 2), "severity": exposure, "recommended_action": action, "status": "triaged" }
Determine the full scope of data exposure. Pull the user's full session history, not just the triggering event.
Focus on preventing further data exposure. The data has already left the network — containment means preventing future occurrences.
Every detection program generates false positives. A well-tuned program achieves under 5% for critical alerts and under 15% for medium alerts.
Marketing teams visiting AI tool websites without submitting data.
Employees visiting AI tool landing pages without actual usage.
Approved tools sharing CDN domains with unapproved tools.
Measuring effectiveness requires metrics beyond simple alert counts. These KPIs provide insight into program maturity and risk posture.
Percentage of AI tool domains in your environment classified by your feed. Typically exceeds 95% with the AI Tools Blocklist — monitor for decline indicating new tools outpacing updates.
Time between first unauthorized access and security team awareness. Under 30 minutes for critical events; under 48 hours for previously unseen tools.
Month-over-month unique users accessing unauthorized AI tools. Declining trend validates enforcement; flat or rising trend signals gaps in blocking coverage.
Mature SOC teams should automate the response workflow through SOAR platforms. The blocklist's classification data enables automated decisions without human intervention for low- and medium-severity events.
SIEM rule fires and creates an incident.
SOAR queries the blocklist API for full classification data.
Playbook branches based on severity classification.
Automated actions executed per severity tier.
Get the AI Tools Blocklist feed with pre-built Splunk, Sentinel, and Elastic queries. Our team assists with integration and tuning for your environment.
Tell us your SIEM platform and proxy vendor and we will provide a tailored integration package with detection queries and alert rules.