Redacted password in process command line

[phaubertin]

Hi, I would like to know if Chronicle has capability to redact password while ingest data. We log Crowdstrike Falcon and notice that password are redacted in process command line. We would like to know if it's something the CrowdStrike done or It's Chronicle feature? 

If Chronicle are not doing it, can it be something that we could do at the ingestion level?

Best regards, 

[Rene_Figueroa]

Hi, 

Chronicle does not modify the raw logs. What is ingested into Chronicle is what you observe in the UI. 

Regarding redacting at the source, it is something you might need to check with the log source documentation.

[phaubertin]

I already look at parser config... Nothing has catch my attention. Anyway, It's something that chronicle forwarder could do or chronicle parser, based on log source?

[Rene_Figueroa · Accepted solution]

Unfortunately, neither the forwarder or parsers can modify the actual raw logs. The parsers only control what is mapped to the UDM events, but do not modify the actual raw log source.

[Abdul_Harb1]

You might want to look at something like Cribl, BindPlane (free for Chronicle, but it needs hardware, so it's not free), or LogStash that can do this type of ETL (Extract, transform, and load).

Also, you seem to be treating the symptoms and not the root cause. I would find out why people put things in the command line in the first place. I assume it is something like API keys or something like that? TELL THEM TO STOP and use environment variables. 

Also, what you are asking to do (in my opinion) is non-trivial. For me personally, if someone puts something in the logs, it's fair game... I need to be able to see everything, with no exceptions.

[phaubertin]

Hi Abdul, thank you for answering. We already use Logstash for log ingestion. I wanted to know if Chronicle would do that by default because I've seen it done in other log source. it seems that log are sanitize at the source. 

About the environment variable, I totally agree with you. But, there politic involve and we need to provide security control/mitigation. It's not Rachel at accounting who put password in command line... Mostly IT people unfortunately. 

Best regards,