Searching Email for sensitive data ie..SSN

[rclifford]

Hello,

    I would like to search our email data for sensitive info ..ie Social Security #'s etc. I have an email dashboard created to ingest our exchange info.

                                                                         Thank You

[tscroggins]

@rclifford 

Assuming you've indexed message bodies (I wouldn't consider this a normal use case for Splunk), you can use the regex command to search for patterns. E.g.:

index=all_the_emails
| regex "\\d{3}-?\\d{2}-?\\d{4}"

In a more typical scenario, a separate DLP solution would scan email in transit or at rest for indicators of data loss or exfiltration and send alerts to Splunk.