{"action":"opened","issue":{"url":"https://api.github.com/repos/IBM/node-qradar-audit-logs-middleware/issues/2","repository_url":"https://api.github.com/repos/IBM/node-qradar-audit-logs-middleware","labels_url":"https://api.github.com/repos/IBM/node-qradar-audit-logs-middleware/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/IBM/node-qradar-audit-logs-middleware/issues/2/comments","events_url":"https://api.github.com/repos/IBM/node-qradar-audit-logs-middleware/issues/2/events","html_url":"https://github.com/IBM/node-qradar-audit-logs-middleware/issues/2","id":190086254,"number":2,"title":"Some logs are passed through with passwords","user":{"login":"paulweb515","id":663966,"avatar_url":"https://avatars.githubusercontent.com/u/663966?v=3","gravatar_id":"","url":"https://api.github.com/users/paulweb515","html_url":"https://github.com/paulweb515","followers_url":"https://api.github.com/users/paulweb515/followers","following_url":"https://api.github.com/users/paulweb515/following{/other_user}","gists_url":"https://api.github.com/users/paulweb515/gists{/gist_id}","starred_url":"https://api.github.com/users/paulweb515/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulweb515/subscriptions","organizations_url":"https://api.github.com/users/paulweb515/orgs","repos_url":"https://api.github.com/users/paulweb515/repos","events_url":"https://api.github.com/users/paulweb515/events{/privacy}","received_events_url":"https://api.github.com/users/paulweb515/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-17T15:56:18Z","updated_at":"2016-11-17T15:56:18Z","closed_at":null,"body":"Sometimes the req.body sent to QRadar can have passwords in it. There are probably 2 ways to deal with this.\r\n\r\n1) for JSON with straight forward properties, pass in an env var with a list of properties to redact, like: log4js_syslog_appender_redact=token,tiam_token_id,password,passwd \r\n\r\nIf we walk the properties and find any of those properties and they're strings, we would redact them.\r\n\r\n2) for JSON with schema based properties. Walk the properties and use a more complex condition:\r\nif (current_property['type'] == 'password') { \r\n    delete current_property['value'];\r\n}\r\n\r\nThe risk is for large req.body, this could take some time. But matching is on the property name and the content of the property would never be scanned.\r\n"}}
{"actor":{"display_login":"paulweb515"}}