encrypt fields stored in index

[mauroscreti]

Hi all,
i need to ecrypt some sensitive fields ( example number credit card, passord, username ecc ecc )

in 4.1 is not possible (only via script i think ), but in 4.2 or 4.3 is it possibile ?

thanks
ma

[dwaddle]

Splunk does not support any field-level encryption out-of-the-box even in 4.3. It does support anonymization / filtering of sensitive data by use of the SEDCMD functionality.

As an example, to anonymize social security numbers, an applicable SEDCMD rule might be:

[mysourcetype]
SEDCMD-filterSSNO = s/\d{3}(-?)\d{2}(-?)(\d{4})/XXX\1XX\2\3/

In terms of best practice (I know this isn't easy), this type of data should never have made it into logfiles for Splunk to index. Data protection standards like PCI outright forbid cleartext storage of this type of data. I don't know how you are getting this data into Splunk, but if it is from flat files, then the data is already exposed on disk in one place.