Getting Data In

How to mask sensitive data at index time?

MWAKburns
Engager

I am trying to mask PII data at index time. Here is an example of PII data I am trying to mask:

RecipientSSNxxx-xx-4321RecipientSSN

I am able to mask it at search time using this

        source= mysource 
        | rex "(?RecipientSSN\d{3}\-\d{2}\-\d{4})" 
        | rex field=RecipientSSN mode=sed "s/\d{3}-\d{2}/XXX-XX/g"

However, I need it to masked at index time. I have tried the following in props.conf and transforms.conf (system\local for both):

props.conf

[nsb_message]
TRANSFORMS-anonymize = ssn-anonymizer

transforms.conf

[ssn-anonymizer]
regex = (\d{3}\-\d{2}\-)(\d{4})
FORMAT= $1XXX-XX-$2
DEST_KEY = _raw

I have restarted Splunk, input new test files via index file monitors one-time, and the SSN is still not masked. Any help would be appreciated. I verified that the sourcetype does exist in the inputs.conf (system\local) as well.

Any help or pointers would be greatly appreciated!

1 Solution

rjthibod
Champion

How about following the simple SED example here: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_through_a_sed_...

in props.conf

[nsb_message]
SEDCMD-ssn_anon = s/RecipientSSN(\d{3}-\d{2}-)(\d{4})/RecipientSSNXXX-XX-\2/g  

View solution in original post

rjthibod
Champion

How about following the simple SED example here: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_through_a_sed_...

in props.conf

[nsb_message]
SEDCMD-ssn_anon = s/RecipientSSN(\d{3}-\d{2}-)(\d{4})/RecipientSSNXXX-XX-\2/g  

bestSplunker
Contributor

SEDCMD- , Is this class name user-defined?

0 Karma

ss026381
Communicator

From doc: Any text after SEDCMD- can be any string that helps you identify what the transformation script does. The clause must exist because it and the SEDCMD stem form the class name for the script

0 Karma

MWAKburns
Engager

That worked! Thanks rjthibod!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...