Know which app every hostname belongs to
Your firewall sees edge.chatgpt.com or a.slack-edge.com, but your customer writes rules for "ChatGPT" and "Slack". This catalogue maps 435,353 SaaS and web apps to the hostnames their traffic really uses, so your product can name the app, apply the policy and report on it.
Traffic in, app out
Built for products that have to recognise apps
App identification is usually built in-house by the largest network vendors. Everyone else either maintains a short hand-made list or guesses from the domain. This catalogue gives smaller vendors and service providers the same starting point.
Firewalls and secure gateways
Turn DNS queries and TLS server names into app names for allow, block and rate rules per app rather than per domain.
CASB and SASE
Discover unsanctioned SaaS in logs, and separate an app's sign-in, upload and API traffic from its marketing site.
Network monitoring
Group bandwidth and sessions by app, and keep telemetry, update and CDN traffic from inflating "unknown".
Shadow IT and AI governance
Find which of 58,601 AI tools and 117,437 web apps people actually use, then decide which ones to approve.
Is your app covered?
Enter an app's domain or any of its hostnames. You get what the catalogue holds for it: how many hostnames we observed, how many are listed by name and which service roles they cover.
What each record contains
One CSV row per domain, hostname or wildcard pattern, plus a JSON file with one record per app. The CSV loads straight into an external block list, an RPZ zone or your own lookup table.
| Column | Meaning |
|---|---|
| app_domain | The app's main domain, used as its identifier (for example slack.com). |
| app_categories | Up to three categories from our 58-category web filtering taxonomy, such as AI / LLM Tools or Cloud Storage / File Hosting. |
| match | domain_and_subdomains, related_domain (another domain the app owns), exact or wildcard. |
| pattern | The domain, hostname or wildcard, for example *.zoom.us. |
| role | What the hostname does for the app (see the roles below). |
| infra_provider | The infrastructure provider when the hostname runs on a shared platform. |
| hostnames_seen | For wildcards, how many different hostnames we observed under the pattern. |
Service roles
Roles let a policy treat parts of an app differently, for example allow sign-in and updates while blocking uploads to an unapproved storage app.
Programmatic endpoints, used by apps, plugins and integrations.
Sign-in and identity hosts.
Static files, images and scripts served for the app.
Real-time messaging, sockets and notifications.
Installers, downloads and update channels.
Usage reporting and diagnostics.
Mail servers and mail-related hosts of the app.
VPN gateways and remote desktop endpoints.
Advertising and tracking hosts the app runs.
The app's pages and customer workspaces.
Questions vendors ask first
Will customer workspaces flood our tables?
No. Where one parent name has many different children (workspaces, tenants, numbered servers), you get one wildcard with a count instead of millions of rows. API and sign-in hosts stay listed by name, even under a wildcard.
Will shared CDN hosts cause wrong matches?
Shared infrastructure is marked with its provider and is not given to an app unless the app owns it. Home internet lines and access-provider hostnames were removed, so they never show up as an "app".
Where do the hostnames come from?
From a census of 2.9 billion observed hostnames, matched to our database of categorized domains. Every hostname in the catalogue was seen in real data, not generated from a guess.
How does it fit our product?
The files run inside your own systems, with no calls out to us at match time. The same app domains carry our web filtering categories, so app rules and category rules come from one source.
Apps by category
An app can carry up to three categories, so the counts add up to more than the number of apps.
FAQ
What is a SaaS app hostname catalogue?
It is a list that maps each web or SaaS app to the hostnames its traffic uses: the main domain, API endpoints, sign-in hosts, content delivery hosts, telemetry, update servers and the wildcard pattern for customer workspaces. Network products use it to recognise an app from a DNS query or the server name in a TLS connection.
How do you handle customer workspaces such as company.slack.com?
When one parent name has many different children, the catalogue gives one wildcard pattern with the number of hostnames we saw under it. Service hosts such as API and sign-in endpoints always stay listed by name.
Will shared CDN hostnames make us block the wrong app?
Hostnames on shared infrastructure are marked with the provider and are not attributed to an app unless the app owns them. A CDN edge that serves thousands of sites is never listed as belonging to one of them.
Which formats are available?
A CSV file with one row per domain, hostname or wildcard pattern, and a JSON file with one record per app. Both carry the app's categories from our 58 web filtering categories.
Can we combine it with the full category database?
Yes. The catalogue covers apps; the web filtering database covers 120 million domains of every kind. Vendors that embed both can see our OEM licence options.
License the SaaS app catalogue
Tell us what your product does and how it matches traffic. We will scope a licence and delivery format that fits it.