Splunk Search

Searching Email for sensitive data ie..SSN

rclifford
New Member

Hello,

    I would like to search our email data for sensitive info ..ie Social Security #'s etc. I have an email dashboard created to ingest our exchange info.

                                                                         Thank You

Labels (1)
0 Karma

tscroggins
Builder

@rclifford 

Assuming you've indexed message bodies (I wouldn't consider this a normal use case for Splunk), you can use the regex command to search for patterns. E.g.:

index=all_the_emails
| regex "\\d{3}-?\\d{2}-?\\d{4}"

In a more typical scenario, a separate DLP solution would scan email in transit or at rest for indicators of data loss or exfiltration and send alerts to Splunk.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!