Configure automatic redaction of log message fields or patterns before indexing and storage  Announcing the release of Sensitive Data Masking capability for logs as a part of Data Security on Cloud Native Application Observability, powered by the Cisco FSO Platform. Why Sensitive Data Masking for logs? | How does the Cisco FSO Platform power Sensitive Data Masking for logs? | What's coming in the Security Insights FSO, Q1 FY24? | Additional resources   Why Sensitive Data Masking for logs? Masking sensitive data in logs is crucial for ensuring the protection and privacy of sensitive information. If exposed, personally identifiable information (PII), financial details, and healthcare records pose significant risks. By masking this data in logs, organizations can prevent unauthorized access, comply with data protection regulations, mitigate insider threats, reduce the attack surface for potential breaches, and enable effective auditing and investigation without compromising sensitive information.   Back to top How does the Cisco FSO Platform power Sensitive Data Masking for logs? Sensitive data masking capability for logs serves as the first proof point of the Cisco FSO Platform’s tenant-specific configuration, establishing a solid foundation for rapid development and expansion. This capability leverages the robustness of the Platform by using the Logs and Events Processing service to obfuscate the logs data and store the tenant-specific masking configurations in the Orion configuration store. By harnessing the Dashbase store, the Platform ensures that masked log records are securely stored, eliminating the need for raw message storage and ensuring adherence to the security standards within organizations.  Masking Rules, list view Masking Expressions, list view Log Explorer View displaying masked Social Security Number (SSN) Back to top What's coming in the Security Insights FSO? The Cisco FSO platform will offer the essential capability for manually configuring masking expressions and rules, and upcoming phases will introduce the Security Insights module providing automated sensitive data masking.   First unveiled at Cisco Live 2023, the Security Insights FSO platform module will launch in Q1 FY 24, delivering data security (sensitive data leakage) insights prioritized with Business Risk Observability (BRO).   The data security capability within this module will also expand beyond logs to encompass events and traces. This evolution will significantly bolster the functionality and effectiveness of sensitive data masking, empowering organizations with more comprehensive and automated protection for their sensitive information.  Back to top Additional resources Mask Sensitive Data in the Documentation  A Demonstration of Sensitive Data Masking on Logs  in the Knowledge Base Cisco introduces full-stack observability enhancement: Business Risk Observability in the Blog ... View more

A demonstration of Sensitive Data Masking on Logs  Available as of v23.6, Cisco AppDynamics’ Sensitive Data Masking capability for logs is a crucial element in ensuring the protection and privacy of sensitive information. By masking the personally identifiable information (PII), financial details, healthcare records, and more in logs, organizations can prevent unauthorized access, comply with data protection regulations, mitigate insider threats, reduce the attack surface for potential breaches, enable effective auditing and investigation without compromising sensitive information  Sensitive Data Masking for Logs is part of Data Security on Cloud Native Application Observability, powered by the Cisco FSO Platform.    IN THIS ARTICLE: Demo video | Demo Chapters + Notes | Additional resources  Demo | Sensitive Data Masking on Logs  Demo Chapters and Notes  Demo Chapter + Timestamp Steps and Notes  Getting to the Masking Expressions tab 00:00:30 Click the Configure option on the left-hand side panel. Look for the new tab called Security.  Under Security, click on Data Security.  You will land on a page with a Masking Rules tab, and next to it, the Masking Expressions tab.   Back to top Understanding the Masking Expressions list 00:00:58  Under the Masking Expressions tab, you will see a list of previously created masking expressions.    To determine which are provided out-of-the-box, and which have been created by a user, refer to the Type column. “Default” indicates out-of-the-box masking expressions, and “Custom” refers to those created by a user. Back to top Overview of the Masking Expression fields  00:01:30  The first field here is the expression named “Custom SSN”.  The second field is for the Regex for matching data. The third field is Data Sensitivity, referring to the sensitivity of the data, which can vary from organization to organization, ranging from low, medium, high, to critical. Back to top Using masking expressions once they’ve been created  00:02:47 To use these masking expressions, go to the Masking Rules tab. You’ll see a list of the masking rules that have already been created.  To determine whether the rules have been enabled, look at the Monitoring Status column. Here, you can see the mask_social_security_number is enabled while the Mask_Credit_Card_Rule is currently disabled. Back to top Rule field overview  00:03:10  With the Mask SSN rule as example: The first field in a rule is its name—here Mask Social Security Number.    The second field shows the scope of the rule, referring to the set of Logs to which the masking expressions should be applied. In this scenario, you will need to provide this value in the log format field within your log collector’s YAML file — here k8s:ad_ecommerce_appdcloud_demo4_logs.    The third field is where you can select the masking expression that should be applied to this set of logs— here custom_ssn, which we had previously created in the Masking Expressions list. You can also go ahead and create a new masking expression right here, which would have the same fields we saw earlier when going through the Masking Expressions tab.    As you select the Masking Expressions, you will start seeing them pop up as labels right below the Masking Expressions tab.    The 4th field is how you want to mask your data. Here, you have the option to select either X character or a custom string.    We will go ahead and select the X character in this scenario. Which means that any masked data will be replaced with the character “x”. Back to top Saving and Enabling the rule 00:05:02   Let's go ahead and save this rule. Once a rule has been saved, it is disabled by default.   In this scenario, we had edited a rule which had already been enabled, so the monitoring status for this rule is already enabled.   Once a masking rule has been enabled, any data being ingested from the scope specified in the masking rule will be scanned for that particular pattern, and that data will be masked.  Back to top View the masked data in the Log Explorer  00:05:41 Let's go ahead and look at how the masked data will look.   Looking at the log's explorer, search for SSN on the search bar. Once I search for that, I can see log records that had an SSN entry which have now been masked with character “x”. Within the log store, the data is saved in this masked format. We do not save any raw messages to comply with security standards.  Back to top Additional resources  Mask Sensitive Data in the Documentation  Announcing Sensitive Data Masking for logs in News & Announcements    ... View more

Announcing Trace-Log Correlation capability for Modern Application Troubleshooting on Cloud Native Application Observability We are excited to announce the release of Trace-Log Correlation capability for Modern Application Troubleshooting on Cloud Native Application Observability.     Why Trace-Log Correlation?   Without switching between tools or losing valuable context, trace-log correlation allows you to:  pinpoint performance issues within business transactions  identify bottlenecks within traces get to root cause analysis with one-click access to associated logs  Trace-log correlation goes from 20 clicks to just 6 clicks—greatly reducing your MTTx.   Trace Flowmap View   Log Explorer View   Additional resources  To view the demonstration video, see Trace Log Correlation with Cloud Native Application Observability in the Share a Tip series. See Traces and Correlation in the documentation ... View more