Splunk Search

PAN data in indexes. How to tackle them to avoid non-compliance?

koshyk
Super Champion

We have Splunk system collecting data from various sources (network, OS, application logs etc).
Unfortunately, some of these systems send PAN related data with unmasked credit card details, but we dont know where.
Is there a way to tackle these? We need to track they are sending PAN related data, but don't want to store that data (or store in hashed format).

My only thought is
- create an index pci_secure_index with permission only to restricted users
- Index all data normally. But run scheduled search to detect PAN information. Collect these data and summary index to "pci_secure_index"
- Delete (delete) from the original index

Is there a better approach?

(PS: We tried the anonymise data approach to search for cc pattern in first 5000 characters, but the system almost went down to knees)

0 Karma

gcusello
SplunkTrust
SplunkTrust

If you don't need real time, you could pre parse data with a script, and after index them in Splunk.
We did this for a customer that wanted to encrypt one field without lost it.
Bye.
Giuseppe

0 Karma

woodcock
Esteemed Legend

If that's the case, deploy more indexers. I don't see any other ways.

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

koshyk
Super Champion

We tried the anonymise data approach to search for cc pattern in first 5000 characters, but the system almost went down to knees. The above link is good, if we are 100% sure or field where the PAN is coming. But incoming terrabytes of data with whole event scan is performance killer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...