topic Re: How do you mask sensitive data from Splunk? in Dashboards & Visualizations

How do you mask sensitive data from Splunk?

Shashank_87 — Wed, 05 Dec 2018 11:33:29 GMT

Hi, I am trying to mask some data while indexing. Below is one single event where the tag "SecurityQuestion" is occuring multiple times and I want to mask all of its values.

Can someone please advice?

(SecurityQuestion)Favorite song(SecurityQuestion)(SecurityAnswer)TEST(SecurityAnswer)
(SecurityQuestion)Favorite band(SecurityQuestion)(SecurityAnswer)TEST123(SecurityAnswer)

Re: How do you mask sensitive data from Splunk?

whrg — Wed, 05 Dec 2018 11:47:33 GMT

Hi!

Check out the Splunk documentation on Anonymize data.

EDIT: Here is the sed command:

s/\(SecurityQuestion\).+?\(SecurityQuestion\)\(SecurityAnswer\).+?\(SecurityAnswer\)/(SecurityQuestion)########(SecurityQuestion)(SecurityAnswer)########(SecurityAnswer)/g

Re: How do you mask sensitive data from Splunk?

Shashank_87 — Wed, 05 Dec 2018 12:20:54 GMT

I did already and I was trying using SED command but not able to get to anything. Could you give me a start on this?

Re: How do you mask sensitive data from Splunk?

whrg — Wed, 05 Dec 2018 12:41:57 GMT

I edited my first reply and added the sed command because apparently comments cannot display backslashes.

Re: How do you mask sensitive data from Splunk?

burwell — Wed, 05 Dec 2018 19:08:44 GMT

What we did was to hide the data at the indexing layer when there was data we didn't want.

In our case there was secret_data= as a URL parameter that we wanted to removed.

So I updated the props.conf on the indexers.

[my_sourctype]
[source::/path/to/my/logs]
SEDCMD-remove_secret_data = s/(&)?secret_data=[^&\s.]+//g