Anonymizing (Masking) Data Using SEDCMD

[computermathguy]

As a test, I first created some credit card numbers using a python script.

I placed the script, along with inputs and props, on the search head. I only placed props on the indexers.

The following SEDCMD will  mask the 1st and 3rd set of 4-digits. The two groups (2nd and 4th set of 4-digits) will not be masked.

props:
[cc_generator]
SEDCMD-maskcc = s/\d{4}-(\d{4})-\d{4}-(\d{4})/xxxx-\1-xxxx-\2/g 

inputs:
[script://./bin/my_cc_generator.py]
interval = */30 * * * *
sourcetype = cc_generator
disabled = 0
index = mypython

output:
xxxx-9874-xxxx-9484

[ITWhisperer]

Is there a question here?

[computermathguy]

Yes..... Is there a way to implement masking globally?  If not, I assume we to add each sourcetype in props.

[PickleRick]

You could attach your props to some wildcarded host or source stanza but that's something I'd be very careful about. It's a very non-obvious configuration and can be a huge pain to debug issues.