PCI and PAN

[tjbacchus]

Team

I just was able to create a search in Splunk to detect Credit Card numbers. PCI was also onboarded into our new Splunk Cloud instance. How can we obscure these numbers once found and verified to be in fact an exposed user credit card number?

[ITWhisperer]

You can obfuscate fields with the SEDCMD directive if you know which fields hold the PCI and PAN. Ideally, PCI and PAN should not be in logs which are stored in logs - you should go back to your application developers to remove these before they even reach Splunk.

[PickleRick]

Additionally, you cannot modify already indexed events. So there is no way to "mask the PCI and PAN once they're found".