Merge pull request #17 from bentleymi/v2.1.1

V2.1.1 - Adding Redaction Macros
bentleymi · May 10, 2023 · f1d33ff · f1d33ff
2 parents 927e626 + 541ac9c
commit f1d33ff
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 4 deletions.
diff --git a/TA-openai-api-2-1-1.tar.gz b/TA-openai-api-2-1-1.tar.gz
diff --git a/TA-openai-api/app.manifest b/TA-openai-api/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null,
       "name": "TA-openai-api",
-      "version": "2.1.0"
+      "version": "2.1.1"
     },
     "author": [
       {
@@ -15,7 +15,7 @@
       }
     ],
     "releaseDate": null,
-    "description": "Send prompts to OpenAI ChatGPT API and enrich your Splunk searches with the results.",
+    "description": "Send prompts to OpenAI ChatGPT API and enrich your Splunk searches with the results while safeguarding Security and Privacy.",
     "classification": {
       "intendedAudience": null,
       "categories": [],

diff --git a/TA-openai-api/default/app.conf b/TA-openai-api/default/app.conf
@@ -8,8 +8,8 @@ install_source_checksum = 49d36b4c5fee1647cc92f2f2203ed33fcb38cd11
 
 [launcher]
 author = Splunkable LLC
-version = 2.1.0
-description = Send queries to OpenAI ChatGPT API and enrich your Splunk searches with the results.
+version = 2.1.1
+description = Send queries to OpenAI ChatGPT API and enrich your Splunk searches with the results while safeguarding Security and Privacy.
 
 [ui]
 is_visible = 1

diff --git a/TA-openai-api/default/macros.conf b/TA-openai-api/default/macros.conf
@@ -0,0 +1,27 @@
+[ccRedaction]
+definition = rex mode=sed "s/[3-6](\s*\d){14,15}/redacted cc/"
+
+[ccRedaction(1)]
+args = redactionMsg
+definition = rex mode=sed "s/[3-6](\s*\d){14,15}/$redactionMsg$/"
+
+[ccRedaction(2)]
+args = field,redactionMsg
+definition = rex field=$field$ mode=sed "s/[3-6](\s*\d){14,15}/$redactionMsg$/"
+
+[ssnRedaction]
+definition = rex mode=sed "s/((?!666|000|9\d{2})\d{3}\D?(?!00)\d{2}\D?(?!0{4})\d{4})/redacted ssn/"
+
+[ssnRedaction(1)]
+args = redactionMsg
+definition = rex mode=sed "s/((?!666|000|9\d{2})\d{3}\D?(?!00)\d{2}\D?(?!0{4})\d{4})/$redactionMsg$/"
+
+[ssnRedaction(2)]
+args = field,redactionMsg
+definition = rex field=$field$ mode=sed "s/((?!666|000|9\d{2})\d{3}\D?(?!00)\d{2}\D?(?!0{4})\d{4})/$redactionMsg$/"
+
+[customRedaction]
+definition = fields - host* source user* *ip*
+
+[allRedaction]
+definition = `ssnRedaction` | `ccRedaction`| `customRedaction`