4.4.1. Cloud Discovery and the App Catalog

💡 First Principle: Discovery turns traffic metadata you already have into an inventory you didn't: parse firewall/proxy logs (or Defender for Endpoint telemetry) for destinations, match them against a catalog of tens of thousands of scored apps, and shadow IT becomes a ranked, actionable list.

Ingestion paths: snapshot reports (upload a log sample manually — the proof-of-concept step), continuous reports via log collectors (Docker-based forwarders parsing supported firewall/proxy formats), and — the lowest-friction path — native Microsoft Defender for Endpoint integration (onboarded devices report cloud app traffic directly; one toggle, no collectors, works off-network). Discovery yields dashboards by app, user, IP; discovered app entries carry a risk score (0–10) computed from 90+ catalog factors — general (HQ, founding), security (MFA support, encryption at rest), compliance (SOC 2, GDPR), legal — and you can weight factors to your org's priorities.

The verbs that follow discovery: sanction (approved) or unsanction (blocked — exportable as a block script for your firewall/proxy, or enforced via Defender for Endpoint network protection which can warn-or-block unsanctioned apps on the endpoint itself). App discovery policies alert on new apps matching conditions (e.g., risk score < 6, traffic > threshold) so triage becomes continuous rather than quarterly. The cloud app catalog is searchable directly — vetting a vendor before purchase, or answering "does this app support SAML?" from its attributes.

⚠️ Exam Trap: "Discover shadow IT with the least deployment effort in a Defender for Endpoint estate" → the MDE integration toggle, not log collectors. Collectors answer the non-MDE or network-appliance-centric stems; snapshot uploads answer "quick one-time assessment."

Reflection Question: Discovery ranks an unknown file-sharing app at risk score 2 with 40 active users. Sequence your response using this section's verbs — and name what governance option turns your decision into endpoint-enforced reality.