diff --git a/TA-openai-api-2-1-1.tar.gz b/TA-openai-api-2-1-1.tar.gz new file mode 100644 index 0000000..23ec4b0 Binary files /dev/null and b/TA-openai-api-2-1-1.tar.gz differ diff --git a/TA-openai-api/app.manifest b/TA-openai-api/app.manifest index 508756d..4a365bc 100644 --- a/TA-openai-api/app.manifest +++ b/TA-openai-api/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "TA-openai-api", - "version": "2.1.0" + "version": "2.1.1" }, "author": [ { @@ -15,7 +15,7 @@ } ], "releaseDate": null, - "description": "Send prompts to OpenAI ChatGPT API and enrich your Splunk searches with the results.", + "description": "Send prompts to OpenAI ChatGPT API and enrich your Splunk searches with the results while safeguarding Security and Privacy.", "classification": { "intendedAudience": null, "categories": [], diff --git a/TA-openai-api/default/app.conf b/TA-openai-api/default/app.conf index f4f4af6..2aa46c0 100644 --- a/TA-openai-api/default/app.conf +++ b/TA-openai-api/default/app.conf @@ -8,8 +8,8 @@ install_source_checksum = 49d36b4c5fee1647cc92f2f2203ed33fcb38cd11 [launcher] author = Splunkable LLC -version = 2.1.0 -description = Send queries to OpenAI ChatGPT API and enrich your Splunk searches with the results. +version = 2.1.1 +description = Send queries to OpenAI ChatGPT API and enrich your Splunk searches with the results while safeguarding Security and Privacy. [ui] is_visible = 1 diff --git a/TA-openai-api/default/macros.conf b/TA-openai-api/default/macros.conf new file mode 100644 index 0000000..a483295 --- /dev/null +++ b/TA-openai-api/default/macros.conf @@ -0,0 +1,27 @@ +[ccRedaction] +definition = rex mode=sed "s/[3-6](\s*\d){14,15}/redacted cc/" + +[ccRedaction(1)] +args = redactionMsg +definition = rex mode=sed "s/[3-6](\s*\d){14,15}/$redactionMsg$/" + +[ccRedaction(2)] +args = field,redactionMsg +definition = rex field=$field$ mode=sed "s/[3-6](\s*\d){14,15}/$redactionMsg$/" + +[ssnRedaction] +definition = rex mode=sed "s/((?!666|000|9\d{2})\d{3}\D?(?!00)\d{2}\D?(?!0{4})\d{4})/redacted ssn/" + +[ssnRedaction(1)] +args = redactionMsg +definition = rex mode=sed "s/((?!666|000|9\d{2})\d{3}\D?(?!00)\d{2}\D?(?!0{4})\d{4})/$redactionMsg$/" + +[ssnRedaction(2)] +args = field,redactionMsg +definition = rex field=$field$ mode=sed "s/((?!666|000|9\d{2})\d{3}\D?(?!00)\d{2}\D?(?!0{4})\d{4})/$redactionMsg$/" + +[customRedaction] +definition = fields - host* source user* *ip* + +[allRedaction] +definition = `ssnRedaction` | `ccRedaction`| `customRedaction`