How do I mark a non-standard parameter/field in ASM as sensitive or obfuscate it?
Just deployed an ASM in line with a bunch of virtual servers, but I am seeing a bunch of traffic flows that look like XML, but don't really conform to the open and closing tag format.
I need to figure out a way to get the ASM to target those HTML fields so I can mark them as sensitive so they will be obfuscated in the event logs.
So as an example:
POST /ofxserver/ofxsrvr.dll HTTP/1.1
Content-Type: application/x-ofx
User-Agent: MFM-Android/4.4.46 Nexus 5X OS 7.1.2
Content-Language: en-US
Content-Length: 738
Host: www.host.com
Connection: Keep-Alive
Accept-Encoding: gzip
X-Forwarded-For: xxxxxxxxxxxx
OFXHEADER:100
DATA:OFXSGML
VERSION:103
SECURITY:NONE
ENCODING:USASCII
CHARSET:1252
COMPRESSION:NONE
OLDFILEUID:NONE
NEWFILEUID:NONE
...
username
password
...
The USERPASS item shows in cleartext during the HTTPS stream, and as a consequence shows in the event logs. We want to hide the content of the USERPASS section, but I have yet to find a decent way to mark that field as a sensitive parameter or the like.
I have attempted to import the XSD files for OFX, to see if the templates can teach the ASM how to parse the XML (but again it doesn't look like any XML I have ever seen).
If anyone could provide some insight into how I can target these fields so I can make sure they are obfuscated in the event logs would be very helpful!