Security

Scanning Splunk data for secret leaking?

DG
Explorer

Dear Community,

We know that there are several options to mask sensitive data before/during ingestion. But generally, how do you scan your data to check if there is any already existing leakage of secrets/tokens/password? I've googled and searched community, but I did not find anything. I thought there is a Splunk app or Splunk ES has a built-in feature to do this, like a professional, fast, effective alert or an AI/ML assisted one.

What I've done so far for a few indexes:

 

index={INDEXNAME}  | stats  values(*) AS *   | transpose  | table  column   | rename  column AS Fieldnames  | search Fieldnames=*secret* OR Fieldnames=*password*

 

(with last 15 minutes search interval)

Is there any better solution out? Or do you have better idea to handle this? How are others doing this? 

We have a Splunk Cloud Platform, but I think it would be the same for Enterprise as well.

Thank you very much!

Regards,

DG

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...