Add/Edit WAAS Scrubbing Rule

Open the Console, and go to

Defend > WAAS > Sensitive data

.



Click on

Add rule

or select an existing rule.

Enter a rule

Name

.

Select the rule

Type

as

Pattern-based

or

Location-based

.

The pattern-based rule will match the given regex pattern by either "Request Parameter keys", "Request Parameter Values", or "Response (Keys + Values)".



Provide the pattern name to be matched in the form of a regular expression (re2), e.g. ^sessionID$, key-[a-zA-Z]{8,16}.
Provide a placeholder string, e.g. [scrubbed sessionID].
Placeholder strings indicating the nature of the scrubbed data should be used as users will not be able to see the underlying scrubbed data.

For Location-based rules



Select the location of the data to be scrubbed.
Provide location details:
For query / cookie / header / form/multipart - provide a match pattern in the form of a regular expression (re2), e.g. ^SCookie.*$, item-[a-zA-Z]{8,16}.
For XML (body) / JSON (body) - provide the path using Prisma Cloud’s custom format e.g. /root/nested/id.
Provide a placeholder string to indicate the nature of the scrubbed data, for example: [Scrubbed Session Cookie].

Click

Save

.

Sensitive Data & Log Scrubbing

The location-based rule for sensitive data works by searching for the key value in the location, for example, query, cookie, header, form/multipart, XML, and JSON body. For log scrubbing, WAAS replaces the value with the placeholder that you enter. Data will now be scrubbed from any WAAS event before it is written (either to the Defender log or syslog) and sent to the console.

For example, the email ID is redacted in the below WAAS event audit.





If sensitive data triggers events, both the forensic message and the recorded HTTP request are scrubbed.