Redacting sensitive content from Windows event logs using LogParser
Consider the scenario: opening a ticket within Azure for an issue with an infrastructure component or security event. IP addresses, domain names and Machine names are classed as sensitive and should not be revealed to MS support staff.
You have a folder filled with event logs from the problem machine(s). You need to redact the above mentioned properties.
By using LogParser with the following sql statement, a CSV file is exported which strips out the sensitive properties, replacing parts of the properties with X’s.
- ‘OHOLICS‘ is replaced by ‘XXXXXXX‘ where it is found in an event log, in the Strings, ComputerName, Message or Data fields
- The first two octets of an IP address are stripped, where these are ‘192.168.’ in the Strings, Message or Data fields
- ‘blog.oholics.net‘ is replaced by ‘blog.XXXXXXX.net‘ where it is found in an event log, in the Strings, ComputerName, Message or Data fields
Note that after the output file is created, the header row will need to be updated to remove the replace statements. Where normally just the item name would be added as a header, the full replace query is added as the header for those items.
Usage: logparser -i:EVT file:LogParserRedaction.sql -o:CSV -resolveSIDs:ONÂ
Where:
- The above SQL query is saved as LogParserRedaction.sql in the same location as the LogParser binary.
- The collection of logs to be redacted are in C:\TEMP\Logs\
- The output file will be written to C:\TEMP\Output\OUTPUT.CSV