Before
Security personnel likely had to run public searches repeatedly, review result pages for company-related bucket references, and inspect candidate buckets individually. They then had to compare findings, assemble a report, create a Jira incident, and notify the responsible team manually.
How it works
- Run the scheduled public search across the configured result pages and retain results whose metadata contains the target keyword.
- Extract candidate bucket names, check whether each is listed as exposed, and directly request unlisted buckets to identify publicly accessible content or file listings.
- Summarize the relevant findings, create a Jira Incident, and distribute the report link through the internal communication channel.
Workflow details
- Scheduled reconnaissance: A scheduled trigger launches a configurable public search query across multiple result pages to locate pages that may reference S3 buckets associated with the company.
- Relevance filtering: Each search result is checked for the configured keyword in its snippet, title, and HTML title before the workflow extracts a candidate bucket name from the result link.
- Exposure validation: Candidate buckets are checked against Grayhatwarfare to determine whether they are listed and whether file information is available. Buckets that are not listed are also accessed directly to inspect the response and determine whether publicly accessible content is present.
- Finding compilation: The workflow gathers bucket names, URLs, response codes, public file counts, and exposed file lists where available, then uses an AI agent to create a concise summary of the relevant findings.
- Operational handoff: A Jira Incident is created with the reconnaissance report, and a message containing the Jira link is posted to the designated internal communication channel so the responsible team can review the results.
What changed
Each scheduled run now performs the search, exposure checks, evidence collection, and report preparation automatically. Findings are delivered as a Jira Incident with a channel notification, while people retain responsibility for reviewing the evidence and deciding on remediation.
Work removed
Running recurring public searches, reviewing result metadata, extracting bucket names, checking exposure listings, making direct bucket requests, counting or collecting exposed files, formatting findings, creating the Jira incident, and manually posting the report link to the team.
Expected outcome
Expected to remove at least four recurring review stages per scheduled run—searching results, validating exposure, collecting evidence, and preparing the handoff—while providing a consistent security review queue.
