From e8294a2533ca1cdd03b0d7ae1fff7d401c0c3fbf Mon Sep 17 00:00:00 2001 From: pradomycadmin2 Date: Fri, 26 Nov 2021 10:55:24 +0100 Subject: [PATCH 1/3] New rule file atlassian.rules for anonymizing atlassian products (eg. Jira, Confluence, Bitbucket, Bamboo) --- rules/atlassian.rules | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 rules/atlassian.rules diff --git a/rules/atlassian.rules b/rules/atlassian.rules new file mode 100644 index 0000000..aadb244 --- /dev/null +++ b/rules/atlassian.rules @@ -0,0 +1,36 @@ +# copyright sys4 AG 2015 +# copyright IAV GmbH 2021 + + +# This file is part of loganon. +# +# loganon is free software: you can redistribute it and/or modify it under the +# terms of the GNU Lesser General Public License as published by the Free +# Software Foundation, either version 3 of the License, or (at your option) any +# later version. +# +# loganon is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with loganon. If not, see . + + +atlassian: + + UserID: + - search: "[uU]ser[iI][dD][:=]([^,]+)" + - replace: "UserID:_MAP_ " + UserFullName: + - search: "[uU]ser[fF]ull[nN]ame[:=]([^,]+)" + - replace: "userFullName=_MAP_ " + UserName: + - search: "[uU]ser[nN]ame[:=]([^,]+)" + - replace: "UserName:_MAP_ " + AccountName: + - search: "[aA]ccount[nN]ame[:=]([^,]+)" + - replace: "AccountName:_MAP_ " + +# vim: syn=yaml ts=2 sw=2 expandtab From bba2d920db62e7e3a8c1aa67fd7b44ab6a3e01b8 Mon Sep 17 00:00:00 2001 From: pradomycadmin2 Date: Fri, 26 Nov 2021 11:03:48 +0100 Subject: [PATCH 2/3] Deactivated automatic dommain search Added -d Option to activate dommain search --- loganon | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/loganon b/loganon index 7a5bef2..32daa96 100755 --- a/loganon +++ b/loganon @@ -1,6 +1,7 @@ #!/usr/bin/env python3 # copyright sys4 AG 2015 +# copyright IAV GmbH 2021 # This file is part of loganon. # @@ -63,6 +64,7 @@ Optional: -4, --mask4=number number of bits to mask an IPv4 address -6, --mask6=number number of bits to mask an IPv6 address +-d --dm_check check also for dommain names -t, --test test pattern and print output to stdout """ % os.path.basename(__file__)) @@ -101,6 +103,9 @@ def main(): domain = re.compile("([^\s=\"\(\):]*\.)?[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}") syslog_prio = re.compile("(auth|cron|daemon|kern|local[0-7]|lpr|mail|news|user|uucp)\.(info|notice|warning|err|alert|warn|debug|emerg|crit)", re.IGNORECASE) + # Dommain_Check + dommain_check = False + def get_encoding(file): blob = open(file, "rb").read() m = magic.Magic(mime_encoding=True) @@ -109,13 +114,14 @@ def main(): # Read command line options try: opts = getopt(sys.argv[1:], - "hi:o:r:4:6:t", + "hi:o:r:4:6:dt", ["help", "input=", "output=", "rules=", "mask4=", "mask6=", + "dm_check", "test"])[0] for opt, optarg in opts: @@ -132,6 +138,8 @@ def main(): bitmask4 = IPNetwork("0.0.0.0/%i" % int(optarg)).netmask elif opt in ("-6", "--mask6"): bitmask6 = IPNetwork("::/%i" % int(optarg)).netmask + elif opt in ("-d", "--dm_check"): + dommain_check = True elif opt in ("-t", "--test"): test = True else: @@ -344,9 +352,11 @@ def main(): line = re.sub(ipv4, map_ip, line) line = re.sub(ipv6, reduce_ip, line) - # Phase 3 - search and replace domains - line = re.sub(domain, map_domain, line) - + # Phase 3 - search and replace domains if "-z" switch is set + if dommain_check: + line = re.sub(domain, map_domain, line) + else: + print(line) if test: print(line.strip()) else: From 7f2abd96a850ab53b0061ae282166ab39824c6cc Mon Sep 17 00:00:00 2001 From: pradomycadmin2 Date: Fri, 26 Nov 2021 11:09:32 +0100 Subject: [PATCH 3/3] Added -d Switch to search for dommain names Deactivated automatic dommain search --- loganon | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/loganon b/loganon index 32daa96..b68b8de 100755 --- a/loganon +++ b/loganon @@ -64,7 +64,7 @@ Optional: -4, --mask4=number number of bits to mask an IPv4 address -6, --mask6=number number of bits to mask an IPv6 address --d --dm_check check also for dommain names +-d --dm_check check also for dommain names -t, --test test pattern and print output to stdout """ % os.path.basename(__file__)) @@ -352,7 +352,7 @@ def main(): line = re.sub(ipv4, map_ip, line) line = re.sub(ipv6, reduce_ip, line) - # Phase 3 - search and replace domains if "-z" switch is set + # Phase 3 - search and replace domains if "-d" switch is set if dommain_check: line = re.sub(domain, map_domain, line) else: