Splunk Search

Searching Email for sensitive data ie..SSN

rclifford
New Member

Hello,

    I would like to search our email data for sensitive info ..ie Social Security #'s etc. I have an email dashboard created to ingest our exchange info.

                                                                         Thank You

Labels (1)
0 Karma

tscroggins
Influencer

@rclifford 

Assuming you've indexed message bodies (I wouldn't consider this a normal use case for Splunk), you can use the regex command to search for patterns. E.g.:

index=all_the_emails
| regex "\\d{3}-?\\d{2}-?\\d{4}"

In a more typical scenario, a separate DLP solution would scan email in transit or at rest for indicators of data loss or exfiltration and send alerts to Splunk.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...