Skip to content

CASB shadow-AI detection

CASB telemetry helps Venturi detect unsanctioned or uninstrumented AI access paths without treating detected activity as request-level attribution.

Release state

This guide documents the read-only casb_shadow_ai connector implemented in the platform connector surface.

Required access

The names below are Venturi source-adapter capabilities, not vendor OAuth scopes:

Venturi capability Purpose
netskope.events.readonly Read Netskope event rows.
zscaler.logs.readonly Read Zscaler log rows.
microsoft_defender_cloud_apps.alerts.readonly Read Defender for Cloud Apps alerts.

Do not grant policy-write, quarantine, block, or remediation permissions.

Configure each selected vendor with that vendor’s literal read-only event or log authorization. Supported source adapters are Netskope, Zscaler, and Microsoft Defender for Cloud Apps. Use the selected vendor’s documentation: the Netskope documentation portal, Zscaler Nanolog Streaming Service, or the Defender for Cloud Apps activities API. The connection records the selected source.

Setup

  1. Choose the CASB sources you want Venturi to read.
  2. Create a read-only API credential for each selected source.
  3. Store credentials in the tenant’s encrypted connector credential store.
  4. Set VENTURI_CASB_SHADOW_AI_LOOKBACK_HOURS if the default 24-hour poll window is not appropriate.
  5. In Venturi, open Integrations and select CASB shadow AI and run Test connection.

Verification

  • The connector reports at least one ready source when a configured source is reachable.
  • Shadow-AI events appear as detected-only discovery entries, not fabricated chargeback rows.
  • Ingested fields are event time, source, user or device identifier when provided, destination domain, action, category, and filename metadata when present. Prompt bodies, response bodies, and file contents are dropped.
  • The Known limitations register remains accurate for detected-only pathways.
  • The read-only inventory test confirms the credential cannot quarantine, block, or change policy.

Rotation and offboarding

Rotate each CASB credential through that vendor’s administration flow. Removing the connector stops new detected-only shadow-AI observations from those sources.