Splunk Search

Regular Expression to match credit cards

oscargarcia
Path Finder

Hi,

I am trying to write a search to look for credit card numbers in logs (for the PCI requirement 3.1, of course 🙂

I came across this:

^((67\d{2})|(4\d{3})|(5[1-5]\d{2})|(6011))(-\s\d{4}){3}|(3[4,7])\d{2}-\s\d{6}-\s\d{5}$

Which is said to match most credit card data, but I am struggling to find a way to translate this into an splunk search.

Can anybody help?

Many thanks

Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You can define this as a search-time extracted field and do searches for events where that field has a value.

http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsatsearchtime

Taking your regex above, and plugging it into transforms.conf like so:

[possible_credit_card_no]
REGEX=^((67\d{2})|(4\d{3})|(5[1-5]\d{2})|(6011))(-\s\d{4}){3}|(3[4,7])\d{2}-\s\d{6}-\s\d{5}$
FORMAT=possible_cardno::$1

Then referencing it in props.conf:

[mysourcetype]
REPORT-cardno=possible_credit_card_no

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You can define this as a search-time extracted field and do searches for events where that field has a value.

http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsatsearchtime

Taking your regex above, and plugging it into transforms.conf like so:

[possible_credit_card_no]
REGEX=^((67\d{2})|(4\d{3})|(5[1-5]\d{2})|(6011))(-\s\d{4}){3}|(3[4,7])\d{2}-\s\d{6}-\s\d{5}$
FORMAT=possible_cardno::$1

Then referencing it in props.conf:

[mysourcetype]
REPORT-cardno=possible_credit_card_no
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...