CASB is used as a cloud access security broker (CASB) that provides a comprehensive set of capabilities to help you manage and control the use of cloud apps across your organization, including visibility into inappropriate cloud app usage.
CASB can be accessed from the HEIMDAL Dashboard, under Products -> DNS Security-> Network or Endpoint, and can be leveraged to help you manage AI usage within your organization more effectively. It can ensure that your employees are using AI responsibly and securely while protecting sensitive information from potential risks.
Prerequisites
CASB relies on the telemetry stream provided by DarkLayer Guard Endpoint (DNS-E) to detect and classify cloud and AI applications across your network. For CASB to accurately monitor allowed shadow IT activity (such as ChatGPT, Claude, or Copilot usage), Full Logging must be enabled under Endpoint Settings -> Group Policy -> DNS Security -> DarkLayer Guard. Without Full Logging enabled, DLG-E operates in threat-only mode, and neutral traffic required for CASB discovery will not be transmitted to the dashboard.
Discovering AI usage in your organization
CASB allows you to identify and monitor AI usage across your organization because HEIMDAL looks out for the top 10 leading AI platforms across different domains. You can get valuable insights into how the employees are using these tools, and this can help you optimize their usage and ensure compliance with internal policies.
The CASB engine is an analytic layer that sits on top of the raw DNS-E telemetry stream.
- DLG-E captures the outbound DNS request (api.openai.com) and sends the log event to Heimdal servers.
- The CASB parser ingests that event stream, matches the domain against Heimdal's Cloud Application Database, tags it under Generative AI / AI Tools, and calculates the risk score.
- The entry populates the DNS Security > Endpoint > CASB dashboard view.
Top 10 leading AI tools
| Rank | Tool | Primary Domain | Core Function |
| 1 | ChatGPT | General Assistant | Agentic Actions, Creative Multimodality, Advanced Voice &U Vision, Ecosystem Integration. |
| 2 | Claude | Software Development | Superior Coding & Debugging, Nuanced Writing, Extended Thinking. |
| 3 | Gemini | General Assistant / Google Ecosystem | Multimodal assistant integrated into Google Docs, Gmail, and Search. |
| 4 | Zapier Central | No-Code Automation | Connects to 8,000+ apps to execute tasks across them. |
| 5 | Microsoft Copilot Studio | Enterprise Ecosystem | Agents that operate directly within Teams, Excel, and SharePoint. |
| 6 | Lindy AI | Personal Productivity | A "Digital Employee" that handles emails, meetings, and lead gen. |
| 7 | Relevance AI | Data Operations | Agents built specifically to process huge data tables and research. |
| 8 | 11x.ai (Alice) | Sales & Outreach | An autonomous SDR (Sales Rep) that finds leads and sends emails. |
| 9 | CrewAI | Multi-Agent Teams | Orchestrates a "crew" of different agents to work together on a goal. |
| 10 | n8n | Technical Workflows | A visual builder to create complex, self-hosted AI agents. |
Assessing AI usage risk with CASB
You can track and monitor the usage of AI by clicking the Installed Endpoints hyperlink and seeing the hostnames and the number of DNS queries performed by the users on the displayed endpoint(s).