Solved: Redacted password in process command line - Page 2

phaubertin · 07-23-2024 07:06 AM

Hi, I would like to know if Chronicle has capability to redact password while ingest data. We log Crowdstrike Falcon and notice that password are redacted in process command line. We would like to know if it's something the CrowdStrike done or It's Chronicle feature?

If Chronicle are not doing it, can it be something that we could do at the ingestion level?

Best regards,

Rene_Figueroa

Unfortunately, neither the forwarder or parsers can modify the actual raw logs. The parsers only control what is mapped to the UDM events, but do not modify the actual raw log source.

View solution in original post

New SecOps Webinar May 14th! Learn about Gemini's generative AI within Google SecOps

Redacted password in process command line