Mask sensitive info with SEDCMD

[geoffmoraes]

I am attempting to mask sensitive information using SEDCMD. However, it does not seem to take effect.

I've run btool, but am not sure what to make of the output. It does not seem like an issue with splunk conf file precedence.

%SPLUNK_HOME%\bin> .\splunk.exe btool props --app=my_app list --debug 
%SPLUNK_HOME%\etc\apps\my_app\local\props.conf SEDCMD-cred_mask1 = s/-varPass\s(.+?)\;/xxxxxxxx/g
%SPLUNK_HOME%\etc\apps\my_app\local\props.conf SEDCMD-cred_mask2 = s/-sensitivePass=(.+)/xxxxxxxx/g

Running a search with rex in sed mode with the same regex works as expected.

<base search>
| rex field=Process_Command_Line mode=sed "s/-varPass\s(.+?)\;/xxxxxxxx/g" 
| rex field=Process_Command_Line mode=sed "s/--sensitivePass=(.+)/xxxxxxxx/g" 
| table _time host source Process_Command_Line

[gcusello]

Hi @geoffmoraes,

where did you configured props.conf with SEDCMD?

it should be on Indexers or (when present) on heavy Forwarders.

In addition, put a backslash before "=" because it's a special char (but it shouldn't be the problem!).

Ciao.

Giuseppe

[geoffmoraes]

@gcusello This is configured on a Heavy Forwarder.

Thanks! I've added the \ for =. I overlooked it as it worked with rex in the search query. 

But like you said, that isn't the problem. Still no effect on masking newly indexed data.

[gcusello]

Hi @geoffmoraes,

some stupid questions:

• SEDCMD is for the correct sourcetype?
• did you tried to put both on HF and Ind?
• did you restarted HF?

Ciao.

Giuseppe

[geoffmoraes]

@gcusello 

Perfectly valid questions 🙂

• SEDCMD is for the correct sourcetype? - I think this may be relevant. There was an upgrade on some of the TA's recently. The previous winevent sourcetypes are now the "source". So I think I may need to change the stanza to [source::my_winevent_source] in props.conf

• did you tried to put both on HF and Ind? - No, this is just on the HF where it also indexes the data

• did you restarted HF? - Yes