SSN detection script

Zeek
1

I finally sat down and updated a script I had been promising someone for a long time. It will detect US Social Security Numbers on the network.

  https://github.com/sethhall/ssn-exposure

Right now it only runs on 2.1+ (beta release or git master branch) because I integrated the input framework into it. Make sure you follow the installation and configuration directions closely:
  https://github.com/sethhall/ssn-exposure#readme

Any feedback would be great!

Thanks,
  .Seth

2

I just added a small configuration option for this script to enable redaction on the ssn_exposure.log since users were having PII logs created for them by positive detections.

It can be enabled with:
  redef SsnExposure::redact_logs = T;

I did another little fix to remove SSNs from notices too (they weren't supposed to be there in the first place!).

  .Seth