Anonymizing O&M Logs

Scenarios

During routine operations, the bastion records all operations and generates audit logs to ensure operation traceability. However, if an operation instruction contains sensitive information such as a mobile number and an ID card number, directly recording the information may cause data leakage and bring security risks to enterprises.

It is crucial to effectively protect sensitive information while ensuring the integrity and traceability of audit logs. A bastion host instance can desensitize sensitive data in operation logs globally. If you enable operation log desensitization, the generated operation logs will be anonymized based on the configured desensitization rules after host operation, fast operation, and operation tasks are performed. This function has no impact on the log audit function.

Notes and Constraints

• Only V3.3.70.0 and later version instances support operation log desensitization.
• The desensitization operation is irreversible. After operation log desensitization is disabled, the desensitized audit information will not be restored. After it is enabled, historical data will not be desensitized.
• The following operations support desensitization: host operations for SSH, Telnet, and Rlogin protocol hosts, container operations for Kubernetes, faster operations, and operation tasks.
• After operation log desensitization is enabled, keyboard audit and copied and pasted content will not be desensitized because the content cannot be viewed in audit session videos.
• After operation log desensitization is enabled, the corresponding content in the imported logs is also desensitized.
• Only basic regular expressions are supported. The desensitization operation replaces a character that matches the regular expression with *.
• A maximum of 10 regular expressions can be configured. When multiple regular expressions are configured, the system matches the regular expressions from top to bottom. The matched characters are desensitized as * and then the subsequent regular expression rules are matched.

Prerequisites

You have the operation permissions for the System module.

Procedure

1. Log in to your bastion host.
2. In the navigation pane on the left, choose System > System Config > Audit.
3. Click Edit on the right of Operation Log Desensitization Config. In the dialog box displayed, toggle the status on.
4. Configure a desensitization rule. This type of rule is a regular expression.

   The default regular expression (?<=\d{3})\d{4}(?=\d{4}) is used to anonymize mobile numbers. You can add, delete, or modify the regular expression as required.

5. Perform a regular expression test.
   1. Click Regular Test to expand the regular expression test box.
   2. Enter sensitive information in the text box, for example, a mobile number, and click Desensitization.
   3. Check the result in the Desensitization Result field.
   Figure 1 Regular expression test
   

6. Click OK.

Follow-up Operations

After the O&M log desensitization configuration is enabled, you can check whether sensitive information is successfully desensitized in the generated audit session. For more details, see Viewing Live Sessions and Viewing Historical Sessions.