topic Re: How to mask SSN at index-time using SEDCMD in props.conf? in Getting Data In

How to mask SSN at index-time using SEDCMD in props.conf?

locose — Mon, 02 Nov 2015 19:12:30 GMT

I'm trying to mask SSN using the SEDCMD command, but it isn't working.

My search:

sourcetype = my_source_type   *SSN

returns

'Call_SSN'   '123456789'
'Ssn_bla'    '987654321'
'bla_SSN'   '123456789'

I updated the system/local/props.conf

[my_source_type]
SEDCMD-ssncall = s/=\d{5}(\d{4})/*SSN   xxxxx\1/g

But it's not masking it.

Re: How to mask SSN at index-time using SEDCMD in props.conf?

MuS — Mon, 02 Nov 2015 19:32:17 GMT

Hi locose,

looks like the regex does not match your example events; this regex will match:

 [SsNn_]+.+?['\s]+\d+'

tested and working on https://regex101.com . So your props.conf should look like this:

[my_source_type]
SEDCMD-ssncall = s/[SsNn_]+.+?['\s]+\d+'/*SSN    xxxxx/g

Place this on the Splunk instance where the parsing happens http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings and restart Splunk; it will also only be applied to new events.

Hope this helps ...

cheers, MuS

Re: How to mask SSN at index-time using SEDCMD in props.conf?

locose — Mon, 02 Nov 2015 20:13:44 GMT

Hello MuS

unfortunately that didn't work

Re: How to mask SSN at index-time using SEDCMD in props.conf?

MuS — Mon, 02 Nov 2015 20:43:23 GMT

Can you tell what you did?

Re: How to mask SSN at index-time using SEDCMD in props.conf?

locose — Tue, 29 Sep 2020 07:47:57 GMT

So my serach query is still

sourcetype = my_source_type SSN

I'm still getting

SsN_ENA
Call_SSN
BLA_sSN

in the search results

In the system/local/props.conf

 [my_source_type]
 SEDCMD-ssncall = s/[SsNn_]+.+?['\s]+\d+'/*SSN    xxxxx\1/g

Re: How to mask SSN at index-time using SEDCMD in props.conf?

MuS — Mon, 02 Nov 2015 21:10:19 GMT

take this run everywhere search which works:

| gentimes start=-1 | eval foo="'Call_SSN'   '123456789'
 'Ssn_bla'    '987654321'
 'bla_SSN'    '123456789'" | rex mode=sed max_match=0 field=foo "s/[SsNn_]+.+?['\s]+\d+'/*SSN    xxxxx/g"

my provided SEDCMD will only replace the values NOT the fields.

Re: How to mask SSN at index-time using SEDCMD in props.conf?

woodcock — Tue, 03 Nov 2015 00:04:29 GMT

If you are using INDEXED_EXTRACTIONS to create those fields, then they are created at Index-Time in the time parsing portion of the pipeline that executes before the SEDCMD is executed. If you get SEDCMD working what should happen is that field _raw will be modified, but the INDEXED_EXTRACTIONS fields will still contain the pre-mod text.

Re: How to mask SSN at index-time using SEDCMD in props.conf?

MuS — Tue, 03 Nov 2015 00:16:57 GMT

This is way I told this before 😉 ->

Place this on the Splunk instance where the parsing happens
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings