Mask credit card numbers but keep originals for investigation

[salohiddin]

Hi all,

I want to mask credit card numbers in Splunk (e.g. show them as XXXX) so users on the console can’t see the full values. But for investigations we still need a way to access the originals.

What’s the best practice for handling this in Splunk?

Thanks!

[livehybrid]

Hi @salohiddin 

As @PickleRick mentioned, the most bulletproof way to achieve this is to duplicate the data, with this you can then store a redacted version in one index whilst keeping the original in an index with reduced access. This does mean that the data will go through the ingest meta twice, and you would end up using more storage. To mitigate this a little you migt be able to rewrite your un-redacted data to just include the required fields needed to match back to the original event (e.g. a unique ID and un-redacted card number). There are various ways to achieve this e.g. using props/transforms or Ingest/Edge Processor depending on your environment.

Another option would be role based field filtering - check out https://www.splunk.com/en_us/blog/security/field-hashing-masking-capabilities-for-compliance.html?lo...for more information on this.

Let us know your thoughts and if you have any questions just shout!

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick · Accepted solution]

The only 100% sure method I can think of would be to duplicate the event and keep two copies - one accessible for users with the sensitive data masked and another one in another index with restrictred access.

There is a Field Filter function in modern Splunk versions but:

1) It is a "preview functionality" at this point so it is on a "as is" basis.

2) It is rather complicated to implement right, especially considering the original data in the _raw event.

3) As it's a relatively hew functionality there's not much info about it around except for the original docs https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/use-field-fil...