Configuring a Data Masking Rule

Prerequisites

A protected website has been added. For details, see Adding a Website to EdgeSec.

Constraints

It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.

Impact on the System

Sensitive data in the events will be masked to protect your website visitor's privacy.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Content Delivery & Edge Computing > CDN and Security.
3. In the navigation pane on the left, choose Edge Security > Website Settings. The Website Settings page is displayed.
4. In the Policy column of the row containing the domain name, click the number to go to the Policies page.
   Figure 1 Website list
   

5. In the Data Masking configuration area, change Status if needed and click Customize Rule.
   Figure 2 Data Masking configuration area
   

6. In the upper left corner of the Data Masking page, click Add Rule.
7. In the displayed dialog box, specify the parameters by referring to Table 1.
   Figure 3 Adding a data masking rule
   

   Table 1 Rule parameters

   Parameter	Description	Example Value
   Path	Part of the URL that does not include the domain name. Prefix match: The path ending with * indicates that the path is used as a prefix. For example, if the path to be protected is /admin/test.php or /adminabc, set Path to /admin*. Exact match: The path to be entered must match the path to be protected. If the path to be protected is /admin, set Path to /admin. NOTE: The path supports prefix and exact matches only and does not support regular expressions. The path cannot contain two or more consecutive slashes. For example, ///admin. If you enter ///admin, EdgeSec converts /// to /.	/admin/login.php For example, if the URL to be protected is http://www.example.com/admin/login.php, set Path to /admin/login.php.
   Masked Field	A field set to be masked Params: A request parameter Cookie: A small piece of data to identify web visitors Header: A user-defined HTTP header Form: A form parameter	If Masked Field is Params and Field Name is id, content that matches id is masked. If Masked Field is Cookie and Field Name is name, content that matches name is masked.
   Field Name	Set the parameter based on Masked Field. The masked field will not be displayed in logs. NOTICE: The length of a subfield cannot exceed 2,048 bytes. Only digits, letters, underscores (_), and hyphens (-) are allowed.
   Rule Description	A brief description of the rule. This parameter is optional.	None

8. Click OK. The added data masking rule is displayed in the list of data masking rules.

Other Operations

• To modify a rule, click Modify in the row containing the rule.
• To delete a rule, click Delete in the row containing the rule.

Configuration Example - Masking the Cookie Field

To verify that EdgeSec is protecting your domain name www.example.com against a data masking rule (with Cookie selected for Masked Field and jsessionid entered in Field Name):

1. Add a data masking rule.
   Figure 4 Select Cookie for Masked Field and enter jsessionid in Field Name.
   

2. Enable data masking.
   Figure 5 Data Masking configuration area
   

3. In the navigation pane on the left, choose Events.
4. In the row containing the event hit the rule, click Details in the Operation column and view the event details.

   Data in the jsessionid cookie field is masked.

   Figure 6 Viewing events - privacy data masking