Skip to main content

Concealment Charm Part Deux

In this section, we get to flex our regex powers a little more by using wildcard characters to match the field name and then mask it.

important

  1. Still in the same Beginner_Mask_PII Pipeline, click Add Function near the top of the left pane, and either find Mask in the Standard submenu, or type Mask into the search box to locate it. Then click Mask to add this Function to the Pipeline

  2. Leave the Filter default at its default true value.

  3. Enter a simple Description for the Function.

  4. In the Masking Rules table, click the pencil (Edit) icon to the right of the Replace Expression column to open the Masking Rules modal.

  5. Paste the following into Match Regex pane, between the two / delimiters:

    (.+)

  6. In the Replace Expression pane, paste the following:

    C.Mask.md5(g1)

  7. Click OK to close the modal.

  8. Under Apply to Fields, paste:

    _raw.*.crypto_group_*

  9. Click Save to save the Mask Function to your Pipeline.

  10. Click the OUT button near the top of the right Preview pane to observe the masked data.

In Regex-speak (or Parseltongue for those in the know), (.+)

  • . matches any character (except for line terminators), and
  • + matches the previous token between one and unlimited times. Because + will match anything and everything forever, we used it to make sure we captured variable lengths.

In our scenario, we limit the regex matches to the extracted field: _raw.*.crypto_group_*.

Now let's flex our magic skills by conjuring up some new fields out of thin air, shall we?