This message originated from Cribl Community Slack.
Click here to view the original link.
How do you handle masking/redacting in Cribl Search?
Solved
Cribl Search Masking Redaction Handling Inquiry
Best answer by Jon Rust
You could use Data -> Datatypes rules to mask data as it's parsed. You'll want to use the "Add Fields to Events" space and the C.Mask() method
... | extend field=replace_regex(field,@'\b\d{14,16}\b','xxx')I was looking for more like hide sensitive info from users. so when they search, it's already redacted.
You could use Data -> Datatypes rules to mask data as it's parsed. You'll want to use the "Add Fields to Events" space and the C.Mask() method
can do further up in Stream as well, including encryption https://docs.cribl.io/search/release-notes/release-v4150/#cryptographic-functions
@user can you give me an example of what do I add here?
say if I want to mask credit card number. how do I use C.Mask function?
Links for this message:
image.png
Links for this message:
image.png
@user I'd recommend using the Mask function. Here is a list of C.Mask options
Links for this message:
image.png
Links for this message:
image.png
You can start with something simple like: C.Mask.REDACTED
@user i can't tell what your requirements are, but you might be able to use a simple replace
Links for this message:
image.png
Links for this message:
image.png
as @user showed, the Mask functions give some extra capabilities not possible with plain ol Replace* tho
you may use grouping when identifying patterns and specifying which portion to mask.
For example:
Links for this message:
image.png
Links for this message:
image.png
``
Regex: (cardNumber=)([-0-9]+)
Replace Express: ${g1}${C.Mask.REDACTED}````The expression for md5 might look more like:
${g1}${C.Mask.md5(g2,g2.length)}Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.