Splunk Search

Searching Email for sensitive data ie..SSN

New Member


    I would like to search our email data for sensitive info ..ie Social Security #'s etc. I have an email dashboard created to ingest our exchange info.

                                                                         Thank You

Labels (1)
0 Karma



Assuming you've indexed message bodies (I wouldn't consider this a normal use case for Splunk), you can use the regex command to search for patterns. E.g.:

| regex "\\d{3}-?\\d{2}-?\\d{4}"

In a more typical scenario, a separate DLP solution would scan email in transit or at rest for indicators of data loss or exfiltration and send alerts to Splunk.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!