1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. WAAS
    6. WAAS Log Scrubbing

    WAAS Log Scrubbing

    There may be sensitive data captured when WAAS events take place, such as access tokens, session cookies, PII or other information considered to be personal by various laws and regulations.
    By using WAAS log scrubbing rules, users can mark data as sensitive based on regex patterns or its location in the HTTP request. This data is removed from the logs before events are recorded, and is replaced with placeholders entered by the user.

    Add/Edit WAAS Scrubbing Rule

    To create or edit log scrubbing rules, follow the steps below:
    1. Open the Console, and go to
      Defend > WAAS > Log Scrubbing
    2. Click on
      Add rule
       or select an existing rule.
    3. Enter Rule Name.
    4. Select rule type: pattern-based or location-based.
    5. For pattern-based rules:
      1. Provide match pattern in the form of a regular expression (re2), e.g. ^sessionID$, key-[a-zA-Z]{8,16}.
      2. Provide a placeholder string e.g. [scrubbed sessionID].
        Placeholder strings indicating the nature of the scrubbed data should be used as users will not be able to see the underlying scrubbed data.
    6. For location-based rules
      1. Select the location of the data to be scrubbed.
      2. Provide location details:
        1. For query / cookie / header / form/multipart - provide match pattern in the form of a regular expression (re2), e.g. ^SCookie.*$, item-[a-zA-Z]{8,16}.
        2. For XML (body) / JSON (body) - provide the path using Prisma Cloud’s custom format e.g. /root/nested/id.
      3. Provide a placeholder string e.g. [Scrubbed Session Cookie].
        Placeholder strings indicating the nature of the scrubbed data should be used as users will not be able to see the underlying scrubbed data.
    7. Click
      Save
      .
      Data will now be scrubbed from any WAAS event before it is written (either to the Defender log or syslog) and sent to the console:
      If sensitive data triggers events, both the forensic message and the recorded HTTP request are scrubbed. Hence, placeholder strings indicating the nature of the scrubbed data should be used as users will not be able to see the underlying scrubbed data.