Before
An analyst would manually define target-specific keywords, construct many search-operator queries, and submit them one at a time. They would then paginate through results, review large volumes of pages for relevance, and consolidate the higher-signal findings into a report or handoff.
How it works
- On schedule, generate high-signal keywords and 200 target-aware search queries using predefined defensive search methods.
- Execute each query, collect the available result pages, and accumulate the returned search items.
- Use AI to remove irrelevant results and return a cleaned, query-linked list of likely sensitive or confidential findings.
Workflow details
- Scheduled targeting: The flow runs on a predetermined schedule for a defined target, currently configured as "caisse d'epargne". It first generates high-signal keywords covering potential confidential data categories, target-specific terms, file types, contextual references, and noise-reduction filters.
- Query generation: Using the generated keywords and a library of search operators and defensive dorking methods, the workflow creates a list of 200 ready-to-use, non-redundant queries designed to identify sensitive or confidential information indexed by search engines.
- Large-scale search execution: Each query is submitted to Google Search, with the workflow iterating through result pages and accumulating returned search items. The process is designed to collect the first 100 results for each query according to the workflow note.
- AI-based triage: The collected results are evaluated against the target and the objective of identifying likely confidential or sensitive data. Low-value or irrelevant results are filtered out, while higher-confidence findings are retained.
- Curated delivery: The remaining findings are cleaned and assembled into a consolidated result containing the originating query and its relevant search results, providing a structured list for security or investigative follow-up.
What changed
The workflow now performs query design, search execution, result collection, and first-pass relevance filtering on a recurring schedule. Analysts receive a consolidated set of higher-signal findings for follow-up instead of starting with raw search output; no human approval or remediation action is automated in the defined flow.
Work removed
Manually defining sensitive-data keywords, writing hundreds of search queries, submitting searches individually, paginating through results, reviewing results one by one for relevance, and consolidating findings by query.
Expected outcome
Each scheduled run can generate and execute up to 200 targeted queries, reducing the recurring search-and-triage workload while producing a focused list of potential exposure findings for analyst review.
