Regex to find out 13 or more continuous numbers in a Splunk search?

[pavanae]

With the following search, I am able to get the following results which is good. I want to create an alert when any credit card number comes into the search without encryption. Please suggest me the regex to find the credit card number which comes in without an encrypted format so that we can take care of those results to be encrypted.

Search:

index="XYZ" "<cardNumber>*</cardNumber>"

Result contain:

<creditCard><cardNumber>8NLLzf02On7Oo09/5+A7ICBR6Tiu30S6</cardNumber>

[woodcock]

Like this:

index="XYZ" "<cardNumber>*</cardNumber>" | regex _raw = "\d{13,}"

[somesoni2 · Accepted solution]

Try something like this

index="XYZ" "<cardNumber>*</cardNumber>" | rex "\<cardNumber\>(?<cardNumber>.+)\<\/cardNumber\>" | where len(cardNumber)=16

[twinspop]

I would change the regex to match only numbers. As it stands it would match where a hashed card number happens to be 16 chars long.

[somesoni2]

It can give a false match if the hashed/encrypted cardnumber also has 16 digits. Once encrypted, it can contain any character so checking the same.