topic Re: anonymizing credit card numbers using props.conf and transforms .conf in Getting Data In

How to anonymize credit card numbers using props.conf and transforms .conf?

gotenzw — Tue, 09 Aug 2022 13:54:35 GMT

hi im trying to replace credit card number (16 digits) in a csv file with xxxx

when i input below text, full event will be masked i will only see xxxx in the search

test1,test2, 0123456789123456

when i input any credit card number which is less than 16 digits , i can see full event in the search

test3,test4,1234

please find the following configuration files

props.conf

[ccdata]
TRANSFORMS-anonymize = masking

transforms.conf

[masking]
REGEX = \d{16}
FORMAT = xxxx
DEST_KEY = _raw

Re: anonymizing credit card numbers using props.conf and transforms .conf

richgalloway — Sun, 07 Aug 2022 13:30:59 GMT

What is the problem you are trying to solve? The way I read this description everything appears to be working as desired.

Re: anonymizing credit card numbers using props.conf and transforms .conf

gotenzw — Sun, 07 Aug 2022 13:38:38 GMT

i need to see other fields like test1, test2, what is required is to mask only credit card number which is the 16 digit, but the issue here i can't see full event after masking as stated before only xxxx i can see in the search

Re: anonymizing credit card numbers using props.conf and transforms .conf

gcusello — Sun, 07 Aug 2022 14:54:56 GMT

Hi @gotenzw,

as @richgalloway, the behavior you described is correct: you transform a credit card number (16 digits) if you have a number with 16 digits in that field, if you have anything different, the transformation doesn't run but it's correct.

If you want to mask every number in the third field (also less than 16 digits), you have to use a different approach as described at https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Anonymizedata:

in props.conf use this command:

[<your_sourcetype>] TRANSFORMS-anonymize = anonymizer

in transforms.conf:

[anonymizer] REGEX = ^(\w+,\w+,)\d+ FORMAT = $1xxxxxxxxxxxxxxxx DEST_KEY = _raw

Ciao.

Giuseppe

Re: anonymizing credit card numbers using props.conf and transforms .conf

gotenzw — Sun, 07 Aug 2022 15:39:40 GMT

i need to use same approach which is 16 digits but i want to see other fields.

im expecting the event like below

event1,event2,xxxx

Re: anonymizing credit card numbers using props.conf and transforms .conf

gcusello — Sun, 07 Aug 2022 15:53:36 GMT

Hi @gotenzw,

with my approach, you should see the other fields and anonymize only the Credit Card Number, otherwise, as described in the above url (https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Anonymizedata), you can also try SEDCMD command in props.conf:

[<your_sourcetype>] SEDCMD-Anonymize = s/^\w+,\w+,\d+/^\w+,\w+,xxxxxxxxxxxxxxxx/g

Ciao.

Giuseppe

Re: anonymizing credit card numbers using props.conf and transforms .conf

gotenzw — Sun, 07 Aug 2022 15:59:05 GMT

i used the SEDCMD and it worked fine but i need to do it using transforms.conf

below is the props.conf which i used.

[ccdata]
SEDCMD-ccdatamask = s/\d{16}/xxxx/g

is it possible to do the same using trasnforms.conf ?

Re: anonymizing credit card numbers using props.conf and transforms .conf

gcusello — Mon, 08 Aug 2022 05:31:31 GMT

Hi @gotenzw,

yes, it's possible.

Your transforms.conf is correct, and the configuration you shared is correct but only for 16 digits numbers, if you have less numbers it doesn't work.

if you don't have other numerical fields you could try to use a little different regex to recognize your CC number:

[masking] REGEX = \d+ FORMAT = xxxx DEST_KEY = _raw

Ciao.

Giuseppe