topic Regex to find out 13 or more continuous numbers in a Splunk search? in Splunk Search

Regex to find out 13 or more continuous numbers in a Splunk search?

pavanae — Thu, 10 Sep 2015 14:31:25 GMT

With the following search, I am able to get the following results which is good. I want to create an alert when any credit card number comes into the search without encryption. Please suggest me the regex to find the credit card number which comes in without an encrypted format so that we can take care of those results to be encrypted.

Search:

index="XYZ" "<cardNumber>*</cardNumber>"

Result contain:

<creditCard><cardNumber>8NLLzf02On7Oo09/5+A7ICBR6Tiu30S6</cardNumber>

Re: Regex to find out 13 or more continuous numbers in a Splunk search?

somesoni2 — Thu, 10 Sep 2015 15:01:26 GMT

Try something like this

index="XYZ" "<cardNumber>*</cardNumber>" | rex "\<cardNumber\>(?<cardNumber>.+)\<\/cardNumber\>" | where len(cardNumber)=16

Re: Regex to find out 13 or more continuous numbers in a Splunk search?

woodcock — Thu, 10 Sep 2015 15:55:34 GMT

Like this:

index="XYZ" "<cardNumber>*</cardNumber>" | regex _raw = "\d{13,}"

Re: Regex to find out 13 or more continuous numbers in a Splunk search?

twinspop — Thu, 10 Sep 2015 16:05:11 GMT

I would change the regex to match only numbers. As it stands it would match where a hashed card number happens to be 16 chars long.

Re: Regex to find out 13 or more continuous numbers in a Splunk search?

somesoni2 — Thu, 10 Sep 2015 16:21:42 GMT

It can give a false match if the hashed/encrypted cardnumber also has 16 digits. Once encrypted, it can contain any character so checking the same.