LogTotal Sanitizer Pack Pseudonymizes Sensitive Data Before It Reaches Cribl Detect

Article Details

Defense Focus

Pseudonymize sensitive values in log data before it reaches Cribl Detect, analysts, AI-assisted triage, notifications, and retained datasets, while preserving deterministic correlation between events.

Detection Methods

• Apply the Pack’s built-in detectors to the _raw field before parsing; for JSON, also replace values under recognized sensitive key names.
• Use the bundled preview sample to verify sanitized output and confirm relevant detections still fire.
• Run detections and enrichment that require original values before the sanitization step.

Data Sources

• Cribl Stream event data, with _raw as the default field processed
• JSON log values under recognized sensitive key names

Rule Types

• Custom-function JSON rules using a rule ID, regular expression, mode, and token prefix
• Correlation detections operating on deterministic typed tokens

Platforms

• Cribl Detect
• Cribl Stream Pipelines and Routes

Defensive Actions

• Place the Pack upstream of parsing and before the Route delivers data to Detect; re-extract fields from sanitized _raw if needed.
• Store a random HMAC key as a Worker Group Secret and use the same key, Pack version, and rule configuration on Workers that must generate matching tokens.
• Start with a high-risk source, validate output and detection behavior, then extend deployment to other Routes.
• Run IOC-dependent detections and enrichment before sanitization; where needed, disable the ips and hosts rules on the affected Route or send a full-fidelity copy to a restricted store.
• Plan key rotation around dataset retention because rotation changes token values.
• Account for regular-expression processing costs when sizing Workers, especially when using aggressive mode.
• Confirm custom-function support before relying on Cribl-managed Workers; the article says support should be confirmed.