Getting Data In
Highlighted

data masking not working at index time

Explorer

Hi Guys,
I have the below sample data , i want to mask the string after Basic and tried below transforms.conf and sed but both didnt work.Can somepne help me with masking the string

*/*\r\nAuthorization: Basic **YxBshshhggdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TkfjksfjksjggkdjkgjkshfjhfjhHhdjahj**==\r\n
*/*\r\nAuthorization: Basic **rxBshshhdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TdsdsskfjksfjksjgkshfjhfjhHhdjahj**==\r\n

[f5:test]
SEDCMD-anonymizeip = s/Authorization: Basic(?:\s([a-zA-Z]{0,50}==))/XXX.XXX.XXX.XXX/g

[session-anonymizer]
REGEX = (nAuthorization:\s*Basic\s*(?\w+)==)
FORMAT = $1test1xxxxxx$2
WRITE_META = true
DEST_KEY = _raw

[ticket-anonymizer]
REGEX = (Proxy-Authorization:\s*Basic\s*(?\w+)==)
FORMAT = $1test2xxxxxxx$2
WRITE_META = true
DEST_KEY = _raw
0 Karma
Highlighted

Re: data masking not working at index time

Ultra Champion

Regarding the SED command:
Do your events actually contain those plain \r\n strings and also the ** bits?

If so, your SED regex does not match. If not, please clarify your sample events.

Also: keep in mind that the SED command replaces the entire string that matches with the XXX pattern. So it not only masks what is in the capture group, but also the "Authorization: Basic" before it.

Regarding the transforms:
The regex is invalid, (?\w+) is not valid REGEX syntax.
Not sure what exactly you are trying to do here, but overwriting the whole _raw in this way probably destroys most of your event content. (if it wasn't for the broken regex syntax, that prevents this bit from being applied altogether).

0 Karma
Highlighted

Re: data masking not working at index time

Communicator

As FrankVI already mentioned your SED regex doesnt match your sample events.

I played a little around with SED and came to this solution:

echo "*/*\r\nAuthorization: Basic **YxBshshhggdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TkfjksfjksjggkdjkgjkshfjhfjhHhdjahj**==\r\n" |  sed 's/\(Basic\s\*\*\)\([a-zA-Z]*\)/\1XXX/g'

This outputs to

*/*\r\nAuthorization: Basic **XXX**==\r\Proxy-Authorization: Basic **XXX**==\r\n

I hope it helps

0 Karma