Security

Scanning Splunk data for secret leaking?

DG
Explorer

Dear Community,

We know that there are several options to mask sensitive data before/during ingestion. But generally, how do you scan your data to check if there is any already existing leakage of secrets/tokens/password? I've googled and searched community, but I did not find anything. I thought there is a Splunk app or Splunk ES has a built-in feature to do this, like a professional, fast, effective alert or an AI/ML assisted one.

What I've done so far for a few indexes:

 

index={INDEXNAME}  | stats  values(*) AS *   | transpose  | table  column   | rename  column AS Fieldnames  | search Fieldnames=*secret* OR Fieldnames=*password*

 

(with last 15 minutes search interval)

Is there any better solution out? Or do you have better idea to handle this? How are others doing this? 

We have a Splunk Cloud Platform, but I think it would be the same for Enterprise as well.

Thank you very much!

Regards,

DG

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...