Splunk PCI App - modify "Personally Identifiable Information Detected' findings?

[kyless]

Most of our Incidents identified by the Splunk PCI App for 'Personally Identifiable Information Detected' turn out to be entries with current date in them.

For example this is flagged -- "44050713 20140225" on 02/25/2014

What can be modified in the PCI App that while it is doing the LUN check on the entry, if successful on the LUN check, check if the entry also contains the pattern for the current date?

[jcoates_splunk]

Hi,

the best thing to do here is to target that rule to only look at data that can posisbly have PII in it... otherwise the Luhn algorithm will false positive on innocuous matches like dates or GUIDs.

http://docs.splunk.com/Documentation/ES/3.0.1/User/FAQ#How_does_Enterprise_Security_detect_PII.3F