Identify Shadow SaaS
This query identifies SaaS services supported by Falcon Shield and helps detect which SaaS products are actively used within the environment.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=DnsRequest DomainName=*
| match(file="shadow-saas.csv", field=[DomainName], column=[Domains], strict=true,mode=glob)
| Category=?Category
| Vendor=?Vendor
| Application=?Application
| groupBy(ComputerName, Vendor, Application, Category)identify_shadow_saas.yml
T1526
ByteRay GmbH
Monitoring
Endpoint
Insight
2025-08-26
2026-03-24
