Use controls for sensitive data in Splunk RUM

How to add additional controls in instrumentation libraries to protect sensitive data such as personally identifiable information, customer-identifiable information, or cardholder data in Splunk Real User Monitoring (RUM).

Note: For more information on managing sensitive data in Splunk Observability Cloud, see Manage sensitive data in Splunk Observability Cloud.
By default, Splunk RUM doesn’t capture any sensitive information such as data filled in a text box, the string or label of a button, or the POST request or response body. However, you might have the possibility of a sensitive data leak in the following situations:

  • Names of page or screen elements

  • Query parameters in URLs that might contain sensitive information

Splunk RUM provides additional controls in its instrumentation libraries that allow for additional sanitization of your data.

What is sensitive data?

Sensitive data may fall within the categories of personally identifiable information (PII), customer-identifiable information (CII), cardholder data (CHD), or protected health information (PHI). It is necessary to protect these types of data to ensure compliance with industry requirements such as the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the General Data Protection Regulation (GDPR).

Splunk RUM for Browser instrumentation

This instrumentation uses the splunk-otel-js-web library.

Scenario

Command

Drop or redact parts of an attribute value. Specify the name, or parse one or more attributes specified by their name and use regular expressions to match the value.

onAttributesSerializing

Drop specific attributes across all spans or events.

onAttributesSerializing

Drop entire spans or events.

  • ignoreURLs

  • suppressTracing

Examples

This code snippet with onAttributesSerializing uses regular expressions to modify URLs.

JS 
onAttributesSerializing: (attributes) => ({
        ...attributes,
        'http.url': typeof attributes['http.url'] === 'string'
          ? attributes['http.url'].replace(/([?&]token=)[^&]+(&|$)/g, '$1<token>$2')
          : attributes['http.url'],

This code snippet shows how to drop all spans that have a failed status.

JS 
context.with(suppressTracing(context.active()), () => {
      this._exporter.export([span], result => {
        if (result.code !== ExportResultCode.SUCCESS) {
          globalErrorHandler(
            result.error ??
              new Error(
                `SimpleSpanProcessor: span export failed (status ${result})`
              )
          );
        }

Use the format (string\|regex)[] with ignoreUrls to drop all URLs that contain /payment/:

JS 
ignoreUrls: [/\/payment\//]

Splunk RUM for Mobile Android instrumentation

This instrumentation uses the splunk-otel-android library.

You can modify or drop spans using the type (SpanData) -> SpanData . It allows you to provide a lambda or function that can inspect, modify, or filter SpanData objects before they are exported. For example, you can drop or redact spans that contain personally identifiable information (PII).

The following example shows how to remove a span:

Kotlin
JAVA 
// Remove all spans with name "SensitiveOperation"
val spanInterceptor: ((SpanData) -> SpanData?) = { spanData ->
    if (spanData.name == "SensitiveOperation") {
        null // Returning null signals that this span should be dropped
    } else {
        spanData
    }
}
val agent = SplunkRum.install(
    this,
    AgentConfiguration(
        ...,
        spanInterceptor = spanInterceptor
    )
)
Java
CODE 
// Remove all spans with name "SensitiveOperation"
Function<SpanData, SpanData> spanInterceptor = spanData -> {
    if ("SensitiveOperation".equals(spanData.getName())) {
        return null; // Returning null signals that this span should be dropped
    } else {
        return spanData;
    }
};
SplunkRum agent = SplunkRum.install(
    this,
    new AgentConfiguration(
            ...,
            spanInterceptor
    )
);

The following example shows how to redact the value of an attribute to remove sensitive data:

Kotlin
JAVA 
// Redact "user.email" attribute to protect sensitive data
val spanInterceptor: ((SpanData) -> SpanData?) = { spanData ->
    val mutableSpan = spanData.toMutableSpanData()
    val mutableAttributes = mutableSpan.attributes.toMutableAttributes()
    // Check if user.email is present, then redact it
    if ("user.email" in mutableAttributes) {
        mutableAttributes["user.email"] = "[REDACTED]"
        mutableSpan.attributes = mutableAttributes
    }
    mutableSpan
  }
val agent = SplunkRum.install(
    this,
    AgentConfiguration(
        ...,
        spanInterceptor = spanInterceptor
    )
)
Java
JAVA 
// Redact "user.email" attribute to protect sensitive data
Function<SpanData, SpanData> spanInterceptor = spanData -> {
    MutableSpanData mutableSpan = spanData.toMutableSpanData();
    MutableAttributes mutableAttributes = mutableSpan.getAttributes().toMutableAttributes();
    // Check if user.email is present, then redact it
    if (mutableAttributes.containsKey("user.email")) {
        mutableAttributes.put("user.email", "[REDACTED]");
        mutableSpan.setAttributes(mutableAttributes);
    }
    return mutableSpan;
};
SplunkRum agent = SplunkRum.install(
    this,
    new AgentConfiguration(
            ...,
            spanInterceptor
    )
);

Splunk RUM for mobile iOS instrumentation

This instrumentation uses the splunk-otel-ios library.

You can modify or drop spans using the spanInterceptor function. For example, you can drop or redact spans that contain personally identifiable information (PII).

The following example shows how to remove a span:

SWIFT 
let interceptor: (SpanData) -> SpanData? = { spanData in
    // Discard spans
    if spanData.name == "Drop this" {
        return nil
    }
    // Redact attribute values for all spans
    var atts = spanData.attributes
    atts["http.url"] = .string("redacted")
    return spanData.settingAttributes(atts)
}

// Usage in AgentConfiguration:
let config = AgentConfiguration(
    endpoint: myEndpoint,
    appName: "MyApp",
    deploymentEnvironment: "dev"
).spanInterceptor(interceptor)

See also

The following sample applications with examples of how to use these commands to obscure PII are available on Splunk OpenTelemetry GitHub: