Cloud-delivered Advanced AnalyticsExabeam Advanced Analytics Administration Guide

You can configure Advanced Analytics to mask specific fields when sending notable sessions and/or anomalous rules via email, Splunk, and QRadar. This prevents exposure of sensitive data when viewing alerts sent to external destinations.

Before proceeding through the steps below, ensure your deployment has:

By default, all fields in a notification are unmasked. To enable data masking for notifications, the Enabled field needs to be set to true. This is located in the application.conf file in the path /opt/exabeam/config/tequila/custom.

NotificationRouter {
    ...
    Masking {
        Enabled = true
        Types = []
        NotableSessionFields = []
        AnomaliesRulesFields = []
    }
}

Use the Types field to add the notification destinations (Syslog, Email, QRadar, and/or Splunk). Then, use the NotableSessionFields and AnomaliesRulesFields to mask specific fields included in a notification.

For example, if you want to mask the user, source host and IP, and destination host and IP for notifications sent via syslog and Splunk, then you would configure the lists as shown below:

NotificationRouter {
    ...
    Masking {
        Enabled  = true
        Types = [Syslog, Splunk]
        NotableSessionFields = ["user", "src_host", "src_ip", "dest_host", "dest_ip"]

    }
}