topic Re: Anonymizing (Masking) Data Using SEDCMD in Splunk Enterprise

Anonymizing (Masking) Data Using SEDCMD

computermathguy — Wed, 18 Sep 2024 19:07:46 GMT

As a test, I first created some credit card numbers using a python script.

I placed the script, along with inputs and props, on the search head. I only placed props on the indexers.

The following SEDCMD will mask the 1st and 3rd set of 4-digits. The two groups (2nd and 4th set of 4-digits) will not be masked.

props: [cc_generator] SEDCMD-maskcc = s/\d{4}-(\d{4})-\d{4}-(\d{4})/xxxx-\1-xxxx-\2/g inputs: [script://./bin/my_cc_generator.py] interval = */30 * * * * sourcetype = cc_generator disabled = 0 index = mypython output: xxxx-9874-xxxx-9484

Re: Anonymizing (Masking) Data Using SEDCMD

ITWhisperer — Wed, 18 Sep 2024 18:02:26 GMT

Is there a question here?

Re: Anonymizing (Masking) Data Using SEDCMD

computermathguy — Thu, 19 Sep 2024 17:58:17 GMT

Yes..... Is there a way to implement masking globally? If not, I assume we to add each sourcetype in props.

Re: Anonymizing (Masking) Data Using SEDCMD

PickleRick — Thu, 19 Sep 2024 18:26:41 GMT

You could attach your props to some wildcarded host or source stanza but that's something I'd be very careful about. It's a very non-obvious configuration and can be a huge pain to debug issues.