With the following search, I am able to get the following results which is good. I want to create an alert when any credit card number comes into the search without encryption. Please suggest me the regex to find the credit card number which comes in without an encrypted format so that we can take care of those results to be encrypted.
Search:
index="XYZ" "<cardNumber>*</cardNumber>"
Result contain:
<creditCard><cardNumber>8NLLzf02On7Oo09/5+A7ICBR6Tiu30S6</cardNumber>
Try something like this
index="XYZ" "<cardNumber>*</cardNumber>" | rex "\<cardNumber\>(?<cardNumber>.+)\<\/cardNumber\>" | where len(cardNumber)=16
Like this:
index="XYZ" "<cardNumber>*</cardNumber>" | regex _raw = "\d{13,}"
Try something like this
index="XYZ" "<cardNumber>*</cardNumber>" | rex "\<cardNumber\>(?<cardNumber>.+)\<\/cardNumber\>" | where len(cardNumber)=16
I would change the regex to match only numbers. As it stands it would match where a hashed card number happens to be 16 chars long.
It can give a false match if the hashed/encrypted cardnumber also has 16 digits. Once encrypted, it can contain any character so checking the same.