1 Reply Latest reply on Apr 5, 2015 9:51 PM by btlyric

    StringRight (or similar) in log email rules?

    cjoshdoll

      Se I have enabled one of the canned DLP rules for PCI, which includes sending me an alert via email.  However, the alert includes the CC number, which I absolutely DO NOT want in my email, that is a huge no-no.  So esentially what I would like to do is replace everything in the CC# string except for the last 4 digits of the number with x's, so that 4444555577771234 becomes xxxxxxxxxxxx1234.  Below is my rule, any help would be greatly appreciated.


      Capture.PNG

        • 1. Re: StringRight (or similar) in log email rules?
          btlyric

          You should be able to do something with a regex to match against your already defined User-Defined.DLP.MatchedTerms field like this:

           

          Set User-Defined.DLP.MatchedTerms = String.ReplaceAllMatches(User-Defined.DLP.MatchedTerms, regex(([\d]{12})([\d]{4}), "\2")

           

          The idea in previous example is that if the MatchedTerms text contains a regex that is a string of 16 numbers, drop the first 12 and substitute the last 4 numbers.

           

          There are a lot of different regex methodologies for identifying CC numbers so you will need to fiddle with the actual regex(es) that used for this purpose.