Need a query to find credit card numbers in events. Please help. I have run queries but they don't seem to be right.
This one is for Master Card, but I need one for OVERALL credit card numbers. this one doesnt even work btw
index=<index> | rex field=_raw "^4[0-9]{12}(?:[0-9]{3})?$(?<credit_card>)" | stats count by credit_card
Hi Jewatson17,
you can use this regex to match all possible credit cards:
| rex "(?<possible_credit_card_number>\d{12,19})"
According to https://en.wikipedia.org/wiki/Payment_card_number#Issuer_identification_number_(IIN) the IIN ranges have a possible length of 12 - 19 digits.
Hope this helps ...
cheers, MuS