How to mask passwords from suricata json.eve

[thund_ssi]

Hi all,

I would like to hide password at payload_printable field in event log from suricata json.eve.

{"timestamp":"2019-08-06T15:27:49.017308+0700","flow_id":1987237243921272,"in_iface":"em3","event_type":"alert","vlan":214,"src_ip":"192.168.214.53","src_port":62848,"dest_ip":"192.168.217.135","dest_port":5501,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2012886,"rev":3,"signature":"ET POLICY Http Client Body contains passwd= in cleartext","category":"Potential Corporate Privacy Violation","severity":1},"app_proto":"http","payload_printable":"POST \/ttlbankgw HTTP\/1.1\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)\r\nContent-Type: text\/xml; charset=utf-8\r\nSOAPAction: \"\"\r\nHost: xxxxxxxxxxxxxxx\r\nContent-Length: 870\r\nExpect: 100-continue\r\nConnection: Keep-Alive\r\n\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http:\/\/schemas.xmlsoap.org\/soap\/envelope\/\" xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"><soap:Body><messageTransfer xmlns=\"xxxxxxxxxxxxxxx\"><arg0 xmlns=\"\"><msg type=\"deposit\" time=\"1565105192181\" resvr=\"510020190806000539\" appId=\"xxxxxxxxxxxxxxx\" userId=\"xxxxxxxxxxxxxxx\" passwd=\"123456\"......","stream":1}

payload_printable:

POST /ttlbankgw HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Host: xxxxxxxxxxxxxxx
Content-Length: 870
Expect: 100-continue
Connection: Keep-Alive

<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><messageTransfer xmlns="xxxxxxxxx"><arg0 xmlns=""><msg type="deposit" time="1565105192181" resvr="510020190806000539" appId="XXXXXX" userId="XXXXXX" passwd="123456"..........

This is my props.conf:

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0
SEDCMD-pass=s/pass=[^& \t\n]*/pass=\[FILTERED\]/gi
SEDCMD-pwd=s/pwd=[^& \t\n]*/pwd=\[FILTERED\]/gi
SEDCMD-passwd=s/passwd=[^& \t\n]*/passwd=\[FILTERED\]/gi
SEDCMD-password=s/password=[^& \t\n]*/password=\[FILTERED\]/gi

I tested my regex with regex10, it worked. But I don't know why it not work in splunk.

[richgalloway · Accepted solution]

The third SEDCMD matches, but doesn't preserve a valid json format. Try this one: SEDCMD-passwd=s/passwd=\\[^& \t\n}]*/\\"[FILTERED]\\"/gi.

[thund_ssi]

Have to remove character "i" at end of this line.