New rule file atlassian.rules for anonymizing atlassian products (eg.

loganon

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 # copyright sys4 AG 2015
+# copyright IAV GmbH 2021
 
 # This file is part of loganon.
 #
@@ -63,6 +64,7 @@ Optional:
 
 -4, --mask4=number          number of bits to mask an IPv4 address
 -6, --mask6=number          number of bits to mask an IPv6 address
+-d  --dm_check              check also for dommain names
 
 -t, --test                  test pattern and print output to stdout
     """ % os.path.basename(__file__))
@@ -101,6 +103,9 @@ def main():
     domain = re.compile("([^\s=\"\(\):]*\.)?[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}")
     syslog_prio = re.compile("(auth|cron|daemon|kern|local[0-7]|lpr|mail|news|user|uucp)\.(info|notice|warning|err|alert|warn|debug|emerg|crit)", re.IGNORECASE)
 
+    # Dommain_Check
+    dommain_check = False
+
     def get_encoding(file):
         blob = open(file, "rb").read()
         m = magic.Magic(mime_encoding=True)
@@ -109,13 +114,14 @@ def main():
     # Read command line options
     try:
         opts = getopt(sys.argv[1:],
-                      "hi:o:r:4:6:t",
+                      "hi:o:r:4:6:dt",
                       ["help",
                       "input=",
                       "output=",
                       "rules=",
                       "mask4=",
                       "mask6=",
+                      "dm_check",
                       "test"])[0]
 
         for opt, optarg in opts:
@@ -132,6 +138,8 @@ def main():
                 bitmask4 = IPNetwork("0.0.0.0/%i" % int(optarg)).netmask
             elif opt in ("-6", "--mask6"):
                 bitmask6 = IPNetwork("::/%i" % int(optarg)).netmask
+            elif opt in ("-d", "--dm_check"):
+                dommain_check = True
             elif opt in ("-t", "--test"):
                 test = True
             else:
@@ -344,9 +352,11 @@ def main():
         line = re.sub(ipv4, map_ip, line)
         line = re.sub(ipv6, reduce_ip, line)
 
-        # Phase 3 - search and replace domains
-        line = re.sub(domain, map_domain, line)
-
+        # Phase 3 - search and replace domains if "-d" switch is set 
+        if dommain_check:
+            line = re.sub(domain, map_domain, line)
+        else:
+            print(line)
         if test:
             print(line.strip())
         else:

rules/atlassian.rules

@@ -0,0 +1,36 @@
+# copyright sys4 AG 2015
+# copyright IAV GmbH 2021
+
+
+# This file is part of loganon.
+#
+# loganon is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Lesser General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# loganon is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with loganon. If not, see <http://www.gnu.org/licenses/>.
+
+
+atlassian:
+
+  UserID:
+    - search: "[uU]ser[iI][dD][:=]([^,]+)"
+    - replace: "UserID:_MAP_ "
+  UserFullName:
+    - search: "[uU]ser[fF]ull[nN]ame[:=]([^,]+)"
+    - replace: "userFullName=_MAP_ "
+  UserName:
+    - search: "[uU]ser[nN]ame[:=]([^,]+)"
+    - replace: "UserName:_MAP_ "
+  AccountName:
+    - search: "[aA]ccount[nN]ame[:=]([^,]+)"
+    - replace: "AccountName:_MAP_ "
+
+# vim: syn=yaml ts=2 sw=2 expandtab