Nov 03 2023 09:58 AM
We thought this might be something that Microsoft Sentinel could have some built in functionality for but seems we cannot find it. We are looking to be able to query all of our log sources for any credit card numbers but I cannot seem to think of a great way to do this and I don't believe union is possible in an analytics rule. Has anyone else created logic in KQL to potentially solve this gap in the solution?
Happy to post our regex here as well:
(.*)((?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12}))(.*)
Common Goal:
1. Query the log source(s) for the specific regex
2. Parse the field identified as matching the regex so we can capture where it matches and go from there, not just that a "match exists"
This seems rather easy but also....struggling to think of a good way to make this happen especially across all log sources rather than querying one table at a time.
Nov 05 2023 02:51 PM
Nov 10 2023 12:25 PM
Jan 24 2024 04:19 AM
Could you share the full code you used for this search? @analyst1900