> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/filter-shadow-apps.md).

# Filter shadow apps

Use [filtering options](#filtering-options) to isolate and display specific shadow apps. By filtering your third-party apps, you can:

* Detect over-privileged or untrusted connections
* Detect and remediate risky and intrusive GenAI apps
* Discover all used and unused third-party apps
* Classify and assess risk levels of over-permissioned, malicious and dormant apps 
* Remediate suspicious app activity by suspending users or removing unnecessary apps 

{% hint style="success" %}

* DoControl addresses a range of [use cases for filtering shadow apps](#use-cases-for-filtering-shadow-apps) installed in your organization's Google Workspace.
* To download all filtered shadow apps, click the <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F8QxHQppNorCnfsRFOYKU%2Fdownload%20icon.png?alt=media&amp;token=5b846f8f-0661-4a5b-b406-dc96e0816fa4" alt="" data-size="line"> **Export to CSV** icon. You can download up to 50,000 shadow apps at a time.
  {% endhint %}

## Filtering options

<table><thead><tr><th width="180">Filter</th><th width="144">Comparator</th><th>Description</th></tr></thead><tbody><tr><td>App name</td><td>String</td><td><p>Name of shadow app:</p><p>Equals, doesn't equal, starts with, ends with, contains, doesn't contain</p></td></tr><tr><td>App risk</td><td>Numeric</td><td><p>You can filter for an app risk score in the range of 1-10:</p><ul><li>Equals</li><li>Greater than</li><li>Lower than</li></ul></td></tr><tr><td>Category</td><td>Includes or excludes</td><td><p>Type of app according to Google Workspace Marketplace categories:</p><ul><li>Academic resources</li><li>Accounting &#x26; finance</li><li>Administration &#x26; management</li><li>Artificial intelligence</li><li>Business tools</li><li>Communication</li><li>Creative tools</li><li>Other</li><li>ERP &#x26; logisitcs</li><li>HR &#x26; legal</li><li>Marketing &#x26; analytics</li><li>Office applications</li><li>Productivity</li><li>Sales &#x26; CRM</li><li>Task management</li><li>Teacher &#x26; admin tools</li><li>Utilities</li><li>Web development</li><li>Unknown</li></ul></td></tr><tr><td>Classification</td><td>Includes or excludes</td><td><p>Manual classification for each app:</p><ul><li>Banned</li><li>Sanctioned</li><li>Unclassified</li><li>Unsanctioned</li></ul></td></tr><tr><td>Compliance</td><td>Includes or excludes</td><td><p>DoControl extracts the compliance or regulatory certificate from each app: </p><ul><li>CCPA</li><li>CSA STAR LEVEL 1</li><li>CSA STAR LEVEL 2</li><li>FEDRAMP</li><li>GDPR</li><li>HIPAA</li><li>ISO27001</li><li>ISO27017</li><li>ISO27018</li><li>ISO27701</li><li>PCI DSS</li><li>PRIVACY SHIELD</li><li>SOC1</li><li>SOC2</li><li>SOC3</li></ul></td></tr><tr><td>Installed currently by user</td><td>Includes or excludes</td><td><ul><li>App is currently installed by user</li><li>You can filter for multiple users according to email</li><li>This filter is case-sensitive</li></ul></td></tr><tr><td>Installed sometime by user</td><td>Includes or excludes</td><td><ul><li>App was previously or currently installed by user</li><li>You can filter for multiple users according to email</li><li>This filter is case-sensitive</li></ul></td></tr><tr><td>Last used</td><td>Date</td><td><p>Date when the shadow app was last used in your organization:</p><ul><li>Equals</li><li>Before</li><li>After</li><li>Is between</li></ul></td></tr><tr><td>Origin</td><td>Includes or excludes</td><td><p>The app publisher origin:</p><ul><li>Internal</li><li>1st party </li><li>3rd party </li><li>Unknown </li></ul></td></tr><tr><td>Publisher email</td><td>String</td><td><p>Name of publisher email:</p><p>Equals, doesn't equal, starts with, ends with, contains, doesn't contain</p></td></tr><tr><td>Review status</td><td>Includes or excludes</td><td><p>DoControl's review stage of each app:</p><ul><li>In review - This app is being evaluated</li><li>New - A new shadow app was detected</li></ul></td></tr><tr><td>Sign-in only app</td><td>Equals</td><td><p>Login-only or authenticated app that requires users to create an account before logging in:</p><ul><li>True</li><li>False</li></ul></td></tr><tr><td>Type</td><td>Includes or excludes</td><td><p>Application client type for which the app was developed:</p><ul><li>Android</li><li>Chrome extension</li><li>Connected device</li><li>iOS</li><li>Native</li><li>Native desktop</li><li>Native device</li><li>Native universal Windows platform</li><li>Sony</li><li>Unknown</li><li>Web</li></ul></td></tr><tr><td>Usage</td><td>Includes or excludes</td><td><p>How much the app is in use relative to the global use of all applications in your organization's SaaS platform over the last 30 days:</p><ul><li>Unknown</li><li>None</li><li>Low</li><li>Medium</li><li>High</li></ul><p>For more details, see <a href="#shadow-app-usage">Shadow app usage</a>.</p></td></tr></tbody></table>

## Use cases for filtering shadow apps

DoControl addresses a range of use cases for filtering shadow apps in your Google Workspace:

* [Detect shadow apps installed by a specific user](#detect-shadow-apps-installed-by-a-specific-user)
* [Detect risky GenAI shadow apps](#detect-risky-genai-shadow-apps)
* [Detect shadow apps published from a private domain](#detect-shadow-apps-published-from-a-private-domain)
* [Detect non-compliant risky apps](#detect-non-compliant-risky-apps)
* [Classify sanctioned apps in bulk](#classify-sanctioned-apps-in-bulk)
* [Remove user tokens from abandoned apps](#remove-user-tokens-from-abandoned-apps)
* [Detect and remediate risky 3rd party apps](#detect-and-remediate-risky-3rd-party-apps)
* [Detect reinstalled apps](#detect-reinstalled-apps)

### Detect shadow apps installed by a specific user

If you wish to detect all shadow apps installed by one or more risky users, you can isolate all their shadow apps using one of these filters:

* **Installed currently by user** includes <Greg@company.com> \
  All shadow apps that are currently installed by <Greg@company.com> are displayed.<br>

  <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FnATY387d4dMUYlvmcamS%2FInstalled%20currently%20by.png?alt=media&amp;token=f29d6784-3772-4f9f-934c-1d662b9d96a2" alt=""><figcaption></figcaption></figure>
* **Installed sometime by user** includes <Nancy@company.com> and <John@company.com>\
  All shadow apps that were previously or currently installed by Nancy and John are displayed.<br>

  <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FGerLKzNAAZNp1Ee7rX4t%2FInstalled%20sometime%20by.png?alt=media&amp;token=45b77f36-11d8-462c-bbb8-043aeffee61c" alt=""><figcaption></figcaption></figure>

### Detect risky GenAI shadow apps

You can closely monitor which GenAI shadow apps are installed in your organization, who installed them, what scopes they use, and their activity levels.&#x20;

GenAI apps that do **not** require sign-in are particularly risky shadow apps because they bypass all organizational controls, making it impossible to monitor, secure, or govern their use. GenAI apps that don't require sign-in usually have extensive permissions and scopes, making them intrusive as they ingest or store company confidential information.

You can isolate all risky GenAI shadow apps using these filters:

* Category includes `Artificial intelligence`
* Sign-in only app equals `False`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FhFVX9pXlQZxMZWMbEiOV%2FAI%20category.png?alt=media&amp;token=9ed6e0e2-5f80-4506-a6e3-125ddcc4f511" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
After you've isolated GenAI shadow apps, you can classify, remove, or set up workflows to prevent these shadow apps from being installed or used in the future.
{% endhint %}

### Detect shadow apps published from a private domain

Apps published by a private domain are considered to be more risky than apps published by a corporate domain. You can search for any apps that were published by a private domain, such as gmail.com.&#x20;

Apply this filter:

**Publisher email** contains `@gmail.com`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FJUR5hVOLxguaLCI83cgx%2Fpublisher%20email.png?alt=media&amp;token=453039ef-df3e-48e1-9a6e-80170914e411" alt=""><figcaption></figcaption></figure>

### Detect non-compliant risky apps

Compliant apps are usually certified and valid. If an app does not meet any compliance standards, such as ISO27001 or SOC2, it's considered to be potentially risky. If the app risk score is high, the probability that the app is risky increases.

Apply these filters:

**Compliance** excludes `ISO27001, SOC2`

**App risk** is greater than `6`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FizRAFggYODEHaHCXXSwk%2Fnon-compliant%20apps.png?alt=media&amp;token=44e9c1cd-6d39-4d30-839c-cf4484571739" alt=""><figcaption></figcaption></figure>

### Classify sanctioned apps in bulk

If you want to classify sanctioned apps in bulk, it's easy to search for non-risky apps with filters.

Sign-in only apps require users to create an account before logging in. Since these are authenticated apps, their scopes aren’t intrusive and they're not considered to be risky apps.

1. Apply this filter:\
   **Sign-in only app** equals `True`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FA5ECeN3opRNfE02MndCx%2Fsign-in%20only.png?alt=media&amp;token=f041b1d3-7a7f-439c-b862-cf01f21e3f55" alt=""><figcaption></figcaption></figure>

2. Apply **Sanctioned** as the bulk classification.

### Remove user tokens from abandoned apps

Abandoned apps are considered to be risky, since they are inactive or dormant and weren’t used for at least 30 days.

Clicking **Abandoned app**s in the Shadow Apps mini-dashboard automatically applies these filters:&#x20;

**Usage** includes `None`

**App status** includes `Installed`

**Sign-in only app** equals `False`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fgbo1YQjXBUlscdFDJDD1%2Fsign-in%20app%20filter.png?alt=media&amp;token=3569bb7d-23db-4788-8bfc-c8435f3af258" alt=""><figcaption></figcaption></figure>

You can then easily **remediate** by removing user tokens from all abandoned apps.<br>

### Detect and remediate risky 3rd party apps

Third-party apps that have a high app risk score are considered to be potentially dangerous. You can easily detect risky 3rd party apps using these filters:

**Origin** includes `3rd party`

**App risk** is greater than `6`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FCLsYaRdh2oGaB79SLivC%2Frisky%20filter.png?alt=media&amp;token=e12bf467-3ee4-4e27-aca0-b89a68bea495" alt=""><figcaption></figcaption></figure>

After you detect all risky 3rd party apps, click **Remediate** to remove user tokens.

### Detect reinstalled apps

Unsanctioned apps that are removed by DoControl are sometimes reinstalled by users. You can easily detect any removed apps that were reinstalled using these filters:

**App status** includes `Installed`

**Removed by DoControl** equals `True`

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fl5gcetzhE97pon7P1Bp7%2Fremoved%20and%20reinstalled.png?alt=media&amp;token=5c610548-53ca-4fac-99e6-0b0c5ff5d98b" alt=""><figcaption></figcaption></figure>

To mitigate the risk from users reinstalling apps that were previously removed, you can define [workflows](/docontrol-user-guide/workflows/create-a-workflow.md) to automatically remove user tokens from reinstalled apps.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/filter-shadow-apps.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.