User Guide
Scanning Notion Pages
A Notion page URL has the following format:
https://www.notion.so/logpresso/some-text-7cfa4184c5da416695135f7755ff5c2a.
The final segment (7cfa4184c5da416695135f7755ff5c2a) is the Page ID.
In Notion, all data is composed of blocks, and each block belongs to a specific page. You can scan for sensitive information, such as AWS credentials, by querying recently edited blocks in a specific page, as shown in the example below:
notion-pages page-id="7cfa4184c5da416695135f7755ff5c2a"
| search updated >= ago("1d")
| rename id as page_id
| fields page_id, title
| notion-blocks-batch
| rex field=line "(?<aws_key>AKIA[A-Z0-9]{16})"
| search len(aws_key) > 0
| order profile, title, aws_key, line, created, updated
