Splunk Search

Regex to find out 13 or more continuous numbers in a Splunk search?

Builder

With the following search, I am able to get the following results which is good. I want to create an alert when any credit card number comes into the search without encryption. Please suggest me the regex to find the credit card number which comes in without an encrypted format so that we can take care of those results to be encrypted.

Search:

index="XYZ" "<cardNumber>*</cardNumber>"

Result contain:

<creditCard><cardNumber>8NLLzf02On7Oo09/5+A7ICBR6Tiu30S6</cardNumber>
Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try something like this

index="XYZ" "<cardNumber>*</cardNumber>" | rex "\<cardNumber\>(?<cardNumber>.+)\<\/cardNumber\>" | where len(cardNumber)=16

View solution in original post

0 Karma

Esteemed Legend

Like this:

index="XYZ" "<cardNumber>*</cardNumber>" | regex _raw = "\d{13,}"

SplunkTrust
SplunkTrust

Try something like this

index="XYZ" "<cardNumber>*</cardNumber>" | rex "\<cardNumber\>(?<cardNumber>.+)\<\/cardNumber\>" | where len(cardNumber)=16

View solution in original post

0 Karma

Influencer

I would change the regex to match only numbers. As it stands it would match where a hashed card number happens to be 16 chars long.

0 Karma

SplunkTrust
SplunkTrust

It can give a false match if the hashed/encrypted cardnumber also has 16 digits. Once encrypted, it can contain any character so checking the same.

0 Karma