Searching Email for sensitive data ie..SSN

rclifford — Wed, 27 Jan 2021 14:42:52 GMT

Hello,

I would like to search our email data for sensitive info ..ie Social Security #'s etc. I have an email dashboard created to ingest our exchange info.

Thank You

Re: Searching Email for sensitive data ie..SSN

tscroggins — Sun, 21 Feb 2021 07:09:58 GMT

@rclifford

Assuming you've indexed message bodies (I wouldn't consider this a normal use case for Splunk), you can use the regex command to search for patterns. E.g.:

index=all_the_emails
| regex "\\d{3}-?\\d{2}-?\\d{4}"

In a more typical scenario, a separate DLP solution would scan email in transit or at rest for indicators of data loss or exfiltration and send alerts to Splunk.

topic Searching Email for sensitive data ie..SSN in Splunk Search

Searching Email for sensitive data ie..SSN

Re: Searching Email for sensitive data ie..SSN