Getting Data In

PII In Splunk

IRHM73
Motivator

Hi, I wonder whether someone could help me please.

Firstly forgive me for what may a stupid question.

But could someone tell me, is it possible to remove all PII from Splunk Enterprise even if you don't know all the field names containing it. I suspect this would have to be done at indexing?

Many thanks and kind regards

Chris

0 Karma
1 Solution

FrankVl
Ultra Champion

In general of course it is impossible to remove things you don't know about. And yes, to remove it properly it would have to be done at indextime, for instance using SEDCMD in props.conf.

If you don't know the exact fields or position in the logs, but you do know the kind of patters you want to mask/remove (e.g. social security numbers / credit card numbers / ip addresses / email addresses), you can use SEDCMD to mask anything matching those patterns.

This page in the docs describes it in more detail: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

View solution in original post

0 Karma

FrankVl
Ultra Champion

In general of course it is impossible to remove things you don't know about. And yes, to remove it properly it would have to be done at indextime, for instance using SEDCMD in props.conf.

If you don't know the exact fields or position in the logs, but you do know the kind of patters you want to mask/remove (e.g. social security numbers / credit card numbers / ip addresses / email addresses), you can use SEDCMD to mask anything matching those patterns.

This page in the docs describes it in more detail: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata

0 Karma

IRHM73
Motivator

Hi @FrankVl.

Thank you for taking the time to reply to my message and for the confirmation.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...