Masking of Data

If you can send it through Bindplane yes.   

If you want to ensure that sensitive fields like phone_number or account_number are completely masked, hashed, or tokenized before they are committed to your SecOps Unified Data Model (UDM) storage, you handle this during the Ingestion and Parsing phase.

You can inject data manipulation functions directly into your custom parsers to strip or mutate sensitive data fields.

Common Parser Functions for Masking:

- replace: Overwrites a targeted match with a generic string (e.g., XXXX-XXXX).

- hash (SHA-256): Converts an account number into a consistent, unreadable cryptographic hash. This protects the true value while still letting security rules correlate activities tied to that specific (hashed) identity.

-drop: Completely removes the field from the parsed output.

filter {

  # Locate the raw account number and mask everything except the last 4 digits

  mutate {

    gsub => [ "raw_account_number", "\d(?=\d{4})", "X" ]

  }

  

  # Map the now-masked field to your UDM structure

  mutate {

    replace => { "target.user.userid" => "%{raw_account_number}" }

  }

}