Before
An analyst would repeatedly submit searches using the appropriate keyword and time range, review returned records, and open each dump individually. They would then determine the file format, download and inspect the content, identify matching lines, and copy the findings together with the source dump and date for further action.
How it works
- Start a scheduled search using the configured keyword, bucket, and lookback period, then retrieve the resulting leak records.
- Check whether results exist and process each returned dump according to its text or CSV format, downloading the content and extracting lines that match the target keyword.
- Aggregate the matches with each dump’s identifying details and pass the structured findings to the next investigation or response action.
Workflow details
- Trigger and search setup: A scheduled run initializes the target keyword, search bucket, and lookback period, then submits an intelligent search for relevant leak records. The flow can also be configured, according to its documentation, to run from an alert email trigger.
- Result validation: After retrieving the search results, the workflow checks whether any records were returned. If there are no results, it ends with a clear “No results” outcome instead of continuing through the analysis stages.
- Format-aware processing: When records are available, the flow processes each result individually, checks whether the associated dump is a CSV or text file, downloads the content, and searches it for lines matching the defined keyword. Text processing supports credential-style or comma-separated lines, while CSV processing scans the file content for keyword matches.
- Finding structuring: For every processed dump, the workflow records the dump name and date alongside the matching lines or a no-match message. This turns raw downloaded content into a consistent set of findings tied back to their source records.
- Operational handoff: The collected findings are combined into structured output that can be used by subsequent notification, investigation, quarantine, or remediation workflows, without requiring an analyst to manually compile the results.
What changed
Search execution, result validation, format routing, dump retrieval, keyword filtering, and finding aggregation now happen in one scheduled workflow. Analysts receive structured, source-linked findings for follow-up instead of manually moving between search results and downloaded dumps.
Work removed
Manually submitting recurring leak searches, checking whether results were returned, reviewing records one by one, identifying dump formats, downloading files, scanning text or CSV content for keyword matches, and copying matches with dump names and dates into a consolidated result.
Expected outcome
Each scheduled run automatically covers all returned leak records and produces consistently structured keyword matches, removing the need for a recurring one-by-one search and dump-review cycle.
