icon, or
* Click **Ctrl + K** (Windows) or **⌘ + K** (Mac) from anywhere in the DoControl platform\
\
## Global search
You can search for risky use cases across your organization, as well as specific users, assets, workflows and shadow apps.
For fast and efficient results, global search also offers you these shortcuts:
* [Exposure shortcuts](#exposure-shortcuts)
* [Feature shortcuts](#feature-shortcuts)
* [User exposure shortcuts](#user-exposure-shortcuts)
{% hint style="warning" %}
**LLM disclaimer**
AI-based global search leverages large language models (LLM) by reading your natural language question and translating it to the most relevant area in the DoControl product. This helps you to find exactly what you're looking for faster and more accurately. \
**For example** if you ask, Who are the riskiest users in the Marketing department?\
DoControl displays Marketing department users with critical risk.
**We do not share or store customer data with any LLM engine**. DoControl only translates and maps your question to a relevant area in the product. When you search for specific data items in global search, DoControl leverages internal search capabilities, and not LLM.
{% endhint %}
### Global search for users, assets, workflows and shadow apps
{% hint style="info" %}
To use global search, make sure you're integrated with Google Workspace.
{% endhint %}
1. Click **Ctrl + K** (Windows) or **⌘ + K** (Mac) to access global search from anywhere in the DoControl platform.
2. Start typing. All identities, internal and external users, Google assets, workflows, and shadow apps containing that string are displayed:
| Exposure shortcut | Filtered results |
|---|---|
| Risky about-to-leave and terminated users | Display departing and terminated employees with the highest risk score in your organization |
| Exposed private email accounts | Display email addresses of non-corporate accounts with access to your assets in these apps:
|
| Highly sensitive exposed assets | Display all sensitive exposed files in these integrated apps:
|
| Uploaded encryption keys and certificates | Display all Google assets with encryption key file suffixes |
| Inactive exposed assets | Display all unviewed files that were exposed in these integrated apps over the last 6 months:
|
| Potentially risky events (Google and Slack) | Display all risky events involving Google and Slack files that were triggered in the last 30 days:
|
| Feature shortcut | Filtered results |
|---|---|
| High severity alerts | Display all active high severity alerts |
| Risky identities | Display the internal users with the highest risk score in your organization |
| Risky shadow apps | Display all risky shadow apps in these integrated apps:
|
| Recently detected misconfigurations | Display the status of all recent SPM security checks per the CIS compliance standard |
| Workflow-triggering events | Display all events (from the last 30 days) that triggered a workflow |
| Recommended playbooks | Displays DoControl readymade playbooks per app |
| Exposure shortcut | Filtered results |
|---|---|
| Active alerts | Display all active alerts where the user is the actor who triggered the alert |
| User exposed assets | Display all files that the user exposed in these integrated apps:
|
| Highly sensitive exposed assets | Display all files that the user exposed in these integrated apps:
|
| Uploaded encryption keys and certificates | Display all Google assets with encryption key file suffixes that the user shared from My Drive |
| Shared assets with labels | Display all Google assets with labels that the user publicly or externally shared from My Drive |
| Inactive exposed assets | Display all unviewed files that the user exposed in these integrated apps over the last 6 months:
|
| Workflow-triggering events | Display all events (from the last 30 days) involving the user as actor where a workflow was triggered |
| Potentially risky events | Display all risky events involving Google and Slack files that were triggered by the user in the last 30 days:
|
