[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-anonymize-logs":3,"mdc-22s7ed-key":35,"related-repo-elastic-anonymize-logs":1584,"related-org-elastic-anonymize-logs":1682},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":33,"mdContent":34},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Logs","logs",{"name":20,"slug":21,"type":15},"Data Cleaning","data-cleaning",{"name":23,"slug":24,"type":15},"Privacy","privacy",11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-18T05:13:04.420121",null,2,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":28},[],"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fanonymize-logs","---\nname: anonymize-logs\ndescription: >-\n  Anonymize and sanitize customer-provided log files before they are committed\n  as pipeline test fixtures or sample events. Performs a line-by-line review\n  and replaces all sensitive values inline, preserving log structure and format\n  exactly — never reformats, re-indents, or restructures content. Invoke\n  manually with \u002Fanonymize-logs.\n---\n\n# Anonymize Logs\n\nSanitize customer-provided log files so they are safe to commit to source control.\n\n## What you provide\n\n| Input | How to provide |\n|-------|----------------|\n| Log file(s) to sanitize | `@`-mention files or paste inline |\n| Output location (optional) | free text path, defaults to same directory with `.sanitized` suffix |\n| In-place override (optional) | say \"in place\" to overwrite the original |\n\n## Golden rule — never reformat the content\n\n**Only replace sensitive values. Do not touch anything else.**\n\nThe ingest pipeline parser depends on exact whitespace, delimiters, quoting, and line structure.\n\n- **NDJSON** (one JSON object per line): do not pretty-print, re-indent, or restructure. Each line must remain a single compact JSON object on one line.\n- **Syslog \u002F CEF \u002F key-value logs**: do not add or remove spaces, change quoting, or normalize field order.\n- **Multiline logs**: preserve line grouping exactly.\n- Replace only the *values* that identify real people, systems, or organizations — preserve field names, delimiters, structural tokens, and everything else character-for-character.\n\n## Workflow\n\n### Step 1 — Line-by-line replacement\n\nRead every line and replace all sensitive values inline. Cover at minimum:\n\n- **Authentication artifacts**: API keys, bearer tokens, passwords, OAuth tokens, base64-encoded credentials, private keys and certs (PEM blocks, SSH private keys), TLS\u002FSSH fingerprints (JA3\u002FJA4 hashes, SSH host key fingerprints, certificate fingerprints), DHCP fingerprints, partial secrets (`token_prefix`, `password_hash_prefix`, `hashed_token`) — partial exposure still identifies the credential\n- **Personal identifiers**: email addresses (including CC\u002FBCC lists, delegate\u002Fowner\u002Fcreator email variants), usernames, display names, employee IDs, phone numbers, principal names (e.g. `user@tenant.onmicrosoft.com`), email subjects and body text\n- **Organizational identifiers**: company names, tenant IDs (including `home_tenant_id`, `resource_tenant_id`, `aad_tenant_id` variants), account IDs, subscription IDs, billing account IDs, org slugs embedded in paths or JSON fields, org unit paths (e.g. `orgunit_path`, `org_unit_path`), department names and IDs, cost center IDs, Windows SIDs (Security Identifiers) in pipe names, task names, or registry paths\n- **Infrastructure identifiers**: internal hostnames, FQDNs, private IP addresses, MAC addresses, internal URLs (staging\u002Fprod hostnames, internal tool domains), cloud resource IDs (ARNs, S3 bucket names, GCP project IDs, Azure subscription\u002Fresource names), Kubernetes cluster names, node names, pod names, and namespace names, container names and IDs, database hostnames and names (including `database.host`, `database.name`, `database_principal_name`), Windows domain topology fields (domain controller hostnames, NT domain names, `domain_controller_object_guid`, `domain_controller_object_sid`)\n- **Device and hardware identifiers**: serial numbers, hardware UUIDs, machine IDs, device UUIDs, BIOS\u002Ffirmware version strings that are unique to a specific device\n- **File system paths**: process command lines, file paths, registry key paths, and log file paths that embed usernames, org names, or internal system structure (e.g. `C:\\Users\\alice\\`, `\u002Fhome\u002Fbob\u002F`, `HKLM\\...\\S-1-5-21-...`)\n- **Connection strings**: database URIs, Redis URLs, any connection string that includes credentials or internal hostnames\n- **Resource ownership**: owner email, creator email, last-modified-by identity, delegate user email, assignee email, impersonator fields — any field that names a specific person as the actor on a resource\n- **Tracking identifiers**: session IDs, request\u002Fcorrelation IDs, transaction IDs, or any long opaque string tied to a real entity\n- **Hash values**: replace when they could be derived from sensitive input (password hashes, HMAC secrets) — preserve file hashes (MD5, SHA1, SHA256 of file content) and other content-addressable references (git SHAs, TLS cert hashes used as identifiers)\n- **Geographic specifics**: precise GPS coordinates, real street addresses — city and country names are generally safe to keep\n\nApply placeholder conventions and shape rules (see below) as you go.\n\n### Step 2 — Verify structure is intact\n\nConfirm after sanitization:\n- Line count is unchanged\n- JSON lines are still valid JSON (for NDJSON files):\n  ```bash\n  python3 -c \"\n  import json, sys\n  with open('FILE') as f:\n      for i, line in enumerate(f, 1):\n          line = line.strip()\n          if line:\n              try: json.loads(line)\n              except Exception as e: print(f'Line {i}: {e}')\n  \"\n  ```\n- Timestamps still match the format the pipeline uses for date parsing\n- Enum \u002F status \u002F action values that pipeline conditions branch on are untouched\n\n## Placeholder conventions\n\nUse consistent, realistic-looking replacements — not `REDACTED` strings, which break format-sensitive parsers.\n\n| Type | Replacement |\n|------|-------------|\n| Email | `user@example.com`, `admin@example.org` |\n| IPv4 | RFC 5737 ranges: `198.51.100.10`, `203.0.113.20`, `192.0.2.30` |\n| IPv6 | `2001:db8::10` |\n| Hostname \u002F FQDN | `host-1.example.local`, `srv-web-01.example.internal` |\n| Domain | `example.com`, `example.org`, `example.net` |\n| UUID | `89a1d5c1-2b3e-4f67-8a9b-0c1d2e3f4a5b` |\n| API key \u002F token | `sk_test_example_key_1234567890`, `dGVzdC10b2tlbi0xMjM0NTY3ODk=` |\n| Username | `alice.johnson`, `bob.smith` |\n| Display name | `Alice Johnson`, `Bob Smith` |\n| Org \u002F company name | `Example Corp`, `Acme Inc` |\n| Account \u002F tenant ID | `000000000000`, `example-tenant-id` |\n| Cloud resource ID | `arn:aws:iam::000000000000:user\u002Fexample-user` |\n| S3 bucket name | `example-bucket` |\n| MAC address | `00-00-5E-00-53-23` (RFC 7042 documentation range) |\n| Serial number | `SN000000000001` |\n| Device \u002F machine ID | use a synthetic UUID or `device-id-example-000001` |\n| Windows SID | `S-1-5-21-000000000-000000000-000000000-1000` |\n| File path (Windows) | `C:\\Users\\example-user\\AppData\\...` |\n| File path (Unix) | `\u002Fhome\u002Fexample-user\u002F...` or use `~` |\n| Kubernetes cluster | `example-cluster`, `example-node-1` |\n| Phone number | `734-555-0100` (555 range is reserved for fiction) |\n| Database host \u002F name | `db-host.example.local`, `example_database` |\n| Department \u002F org unit | `example-department`, `\u002Fexample-org\u002Fexample-unit` |\n| Hashed \u002F partial token | replace with full synthetic token of same format |\n| DHCP fingerprint | `example-dhcp-fingerprint-000001` |\n| JA4 fingerprint | replace with same-length hex string |\n| Transaction \u002F sequence \u002F event-instance ID (numeric) | synthetic integer matching the original digit count — e.g. `48273915` → `10000002` |\n| Session \u002F request \u002F correlation ID | same-length synthetic string (preserve length and charset), not a descriptive name |\n\n**Consistency rule**: map identical original values to identical placeholders throughout the file. If the same IP appears 10 times, it must become the same replacement IP all 10 times — so cross-event correlations remain testable.\n\n## Shape rule — replacements must match the original format\n\nEvery replacement must have the same shape as the original value. The parser and pipeline conditions depend on value format, not just field presence.\n\n- **Numeric ID → numeric ID**: `\u002Fd\u002F123\u002Fedit` → `\u002Fd\u002F456\u002Fedit`, not `\u002Fd\u002Fexample-document-id\u002Fedit`\n- **Transaction \u002F sequence \u002F event-instance ID → same-shape number**: when the value is a per-event tracking identifier, mask it, preserving digit count. e.g. CEF `cn1=48273915 cn2=3061847` → `cn1=10000002 cn2=1000002`\n- **UUID → UUID**: a real UUID must become a synthetic UUID of the same version, not a descriptive string\n- **URL → URL**: replace only the sensitive segment (hostname, path ID) — preserve the scheme, path structure, and query string shape\n  - `https:\u002F\u002Fdocs.google.com\u002Fdrawings\u002Fd\u002F123\u002Fedit` → `https:\u002F\u002Fdocs.google.com\u002Fdrawings\u002Fd\u002F000000000000\u002Fedit` (replace the ID, not the host — `docs.google.com` is a public service name, not an org identifier)\n  - `https:\u002F\u002Finternal.corp.com\u002Fapi\u002Fv1\u002Fresource` → `https:\u002F\u002Fhost-redacted.example.local\u002Fapi\u002Fv1\u002Fresource` (replace the internal hostname, keep the path)\n- **String ID → same-length or same-format string**: opaque alphanumeric IDs should become opaque alphanumeric placeholders of similar length, not descriptive names\n- **Hostname in a URL vs. standalone hostname**: only replace hostnames that identify real internal infrastructure — public well-known hostnames (`docs.google.com`, `api.github.com`, `s3.amazonaws.com`) identify a service, not an organization, and do not need to be replaced\n\n**Malformed or garbage values must not be replaced.** If a value looks broken, synthetic, or contains no real identifying information (e.g. `http:\u002F\u002F1=Y +z\\\\`, `00\u002F00\u002F0000`, `N\u002FA`, empty strings, placeholder-looking values), leave it exactly as-is. Replacing a malformed value with a well-formed placeholder changes the shape and can alter pipeline behaviour — a grok that fails on the original will now succeed on the sanitized version, masking the real error.\n\nIf you are unsure what shape to use, look at neighbouring values of the same field type in the same file and match their format.\n\n## What to preserve\n\nDo not replace:\n- Protocol names, action verbs, event types, severity levels (`ALLOW`, `DENY`, `INFO`, `ERROR`)\n- Product-defined event codes\u002Ftype IDs, such as Windows event IDs — these describe event semantics, not customer-specific event instances\n- HTTP status codes, port numbers, numeric metric values (counts, sizes, durations)\n- Field names and keys\n- Timestamps (format and timezone must stay intact)\n- Structural tokens (brackets, braces, pipes, commas, tabs)\n- Public well-known service hostnames in URLs (`docs.google.com`, `api.github.com`, etc.) — replace the path ID if it is sensitive, not the host\n- File hashes (MD5, SHA1, SHA256 of file content) — these are content-addressable and safe; do not replace them\n- User agent strings (`Mozilla\u002F5.0 ...`) — these reveal browser\u002FOS type but not identity; safe to keep\n- City and country names in geo enrichment fields — replace only precise coordinates and street addresses\n",{"data":36,"body":37},{"name":4,"description":6},{"type":38,"children":39},"root",[40,48,54,61,143,149,158,163,211,217,224,229,468,473,479,484,613,619,632,1242,1252,1258,1263,1428,1460,1465,1471,1476,1578],{"type":41,"tag":42,"props":43,"children":44},"element","h1",{"id":4},[45],{"type":46,"value":47},"text","Anonymize Logs",{"type":41,"tag":49,"props":50,"children":51},"p",{},[52],{"type":46,"value":53},"Sanitize customer-provided log files so they are safe to commit to source control.",{"type":41,"tag":55,"props":56,"children":58},"h2",{"id":57},"what-you-provide",[59],{"type":46,"value":60},"What you provide",{"type":41,"tag":62,"props":63,"children":64},"table",{},[65,84],{"type":41,"tag":66,"props":67,"children":68},"thead",{},[69],{"type":41,"tag":70,"props":71,"children":72},"tr",{},[73,79],{"type":41,"tag":74,"props":75,"children":76},"th",{},[77],{"type":46,"value":78},"Input",{"type":41,"tag":74,"props":80,"children":81},{},[82],{"type":46,"value":83},"How to provide",{"type":41,"tag":85,"props":86,"children":87},"tbody",{},[88,109,130],{"type":41,"tag":70,"props":89,"children":90},{},[91,97],{"type":41,"tag":92,"props":93,"children":94},"td",{},[95],{"type":46,"value":96},"Log file(s) to sanitize",{"type":41,"tag":92,"props":98,"children":99},{},[100,107],{"type":41,"tag":101,"props":102,"children":104},"code",{"className":103},[],[105],{"type":46,"value":106},"@",{"type":46,"value":108},"-mention files or paste inline",{"type":41,"tag":70,"props":110,"children":111},{},[112,117],{"type":41,"tag":92,"props":113,"children":114},{},[115],{"type":46,"value":116},"Output location (optional)",{"type":41,"tag":92,"props":118,"children":119},{},[120,122,128],{"type":46,"value":121},"free text path, defaults to same directory with ",{"type":41,"tag":101,"props":123,"children":125},{"className":124},[],[126],{"type":46,"value":127},".sanitized",{"type":46,"value":129}," suffix",{"type":41,"tag":70,"props":131,"children":132},{},[133,138],{"type":41,"tag":92,"props":134,"children":135},{},[136],{"type":46,"value":137},"In-place override (optional)",{"type":41,"tag":92,"props":139,"children":140},{},[141],{"type":46,"value":142},"say \"in place\" to overwrite the original",{"type":41,"tag":55,"props":144,"children":146},{"id":145},"golden-rule-never-reformat-the-content",[147],{"type":46,"value":148},"Golden rule — never reformat the content",{"type":41,"tag":49,"props":150,"children":151},{},[152],{"type":41,"tag":153,"props":154,"children":155},"strong",{},[156],{"type":46,"value":157},"Only replace sensitive values. Do not touch anything else.",{"type":41,"tag":49,"props":159,"children":160},{},[161],{"type":46,"value":162},"The ingest pipeline parser depends on exact whitespace, delimiters, quoting, and line structure.",{"type":41,"tag":164,"props":165,"children":166},"ul",{},[167,178,188,198],{"type":41,"tag":168,"props":169,"children":170},"li",{},[171,176],{"type":41,"tag":153,"props":172,"children":173},{},[174],{"type":46,"value":175},"NDJSON",{"type":46,"value":177}," (one JSON object per line): do not pretty-print, re-indent, or restructure. Each line must remain a single compact JSON object on one line.",{"type":41,"tag":168,"props":179,"children":180},{},[181,186],{"type":41,"tag":153,"props":182,"children":183},{},[184],{"type":46,"value":185},"Syslog \u002F CEF \u002F key-value logs",{"type":46,"value":187},": do not add or remove spaces, change quoting, or normalize field order.",{"type":41,"tag":168,"props":189,"children":190},{},[191,196],{"type":41,"tag":153,"props":192,"children":193},{},[194],{"type":46,"value":195},"Multiline logs",{"type":46,"value":197},": preserve line grouping exactly.",{"type":41,"tag":168,"props":199,"children":200},{},[201,203,209],{"type":46,"value":202},"Replace only the ",{"type":41,"tag":204,"props":205,"children":206},"em",{},[207],{"type":46,"value":208},"values",{"type":46,"value":210}," that identify real people, systems, or organizations — preserve field names, delimiters, structural tokens, and everything else character-for-character.",{"type":41,"tag":55,"props":212,"children":214},{"id":213},"workflow",[215],{"type":46,"value":216},"Workflow",{"type":41,"tag":218,"props":219,"children":221},"h3",{"id":220},"step-1-line-by-line-replacement",[222],{"type":46,"value":223},"Step 1 — Line-by-line replacement",{"type":41,"tag":49,"props":225,"children":226},{},[227],{"type":46,"value":228},"Read every line and replace all sensitive values inline. Cover at minimum:",{"type":41,"tag":164,"props":230,"children":231},{},[232,265,283,330,377,387,418,428,438,448,458],{"type":41,"tag":168,"props":233,"children":234},{},[235,240,242,248,250,256,257,263],{"type":41,"tag":153,"props":236,"children":237},{},[238],{"type":46,"value":239},"Authentication artifacts",{"type":46,"value":241},": API keys, bearer tokens, passwords, OAuth tokens, base64-encoded credentials, private keys and certs (PEM blocks, SSH private keys), TLS\u002FSSH fingerprints (JA3\u002FJA4 hashes, SSH host key fingerprints, certificate fingerprints), DHCP fingerprints, partial secrets (",{"type":41,"tag":101,"props":243,"children":245},{"className":244},[],[246],{"type":46,"value":247},"token_prefix",{"type":46,"value":249},", ",{"type":41,"tag":101,"props":251,"children":253},{"className":252},[],[254],{"type":46,"value":255},"password_hash_prefix",{"type":46,"value":249},{"type":41,"tag":101,"props":258,"children":260},{"className":259},[],[261],{"type":46,"value":262},"hashed_token",{"type":46,"value":264},") — partial exposure still identifies the credential",{"type":41,"tag":168,"props":266,"children":267},{},[268,273,275,281],{"type":41,"tag":153,"props":269,"children":270},{},[271],{"type":46,"value":272},"Personal identifiers",{"type":46,"value":274},": email addresses (including CC\u002FBCC lists, delegate\u002Fowner\u002Fcreator email variants), usernames, display names, employee IDs, phone numbers, principal names (e.g. ",{"type":41,"tag":101,"props":276,"children":278},{"className":277},[],[279],{"type":46,"value":280},"user@tenant.onmicrosoft.com",{"type":46,"value":282},"), email subjects and body text",{"type":41,"tag":168,"props":284,"children":285},{},[286,291,293,299,300,306,307,313,315,321,322,328],{"type":41,"tag":153,"props":287,"children":288},{},[289],{"type":46,"value":290},"Organizational identifiers",{"type":46,"value":292},": company names, tenant IDs (including ",{"type":41,"tag":101,"props":294,"children":296},{"className":295},[],[297],{"type":46,"value":298},"home_tenant_id",{"type":46,"value":249},{"type":41,"tag":101,"props":301,"children":303},{"className":302},[],[304],{"type":46,"value":305},"resource_tenant_id",{"type":46,"value":249},{"type":41,"tag":101,"props":308,"children":310},{"className":309},[],[311],{"type":46,"value":312},"aad_tenant_id",{"type":46,"value":314}," variants), account IDs, subscription IDs, billing account IDs, org slugs embedded in paths or JSON fields, org unit paths (e.g. ",{"type":41,"tag":101,"props":316,"children":318},{"className":317},[],[319],{"type":46,"value":320},"orgunit_path",{"type":46,"value":249},{"type":41,"tag":101,"props":323,"children":325},{"className":324},[],[326],{"type":46,"value":327},"org_unit_path",{"type":46,"value":329},"), department names and IDs, cost center IDs, Windows SIDs (Security Identifiers) in pipe names, task names, or registry paths",{"type":41,"tag":168,"props":331,"children":332},{},[333,338,340,346,347,353,354,360,362,368,369,375],{"type":41,"tag":153,"props":334,"children":335},{},[336],{"type":46,"value":337},"Infrastructure identifiers",{"type":46,"value":339},": internal hostnames, FQDNs, private IP addresses, MAC addresses, internal URLs (staging\u002Fprod hostnames, internal tool domains), cloud resource IDs (ARNs, S3 bucket names, GCP project IDs, Azure subscription\u002Fresource names), Kubernetes cluster names, node names, pod names, and namespace names, container names and IDs, database hostnames and names (including ",{"type":41,"tag":101,"props":341,"children":343},{"className":342},[],[344],{"type":46,"value":345},"database.host",{"type":46,"value":249},{"type":41,"tag":101,"props":348,"children":350},{"className":349},[],[351],{"type":46,"value":352},"database.name",{"type":46,"value":249},{"type":41,"tag":101,"props":355,"children":357},{"className":356},[],[358],{"type":46,"value":359},"database_principal_name",{"type":46,"value":361},"), Windows domain topology fields (domain controller hostnames, NT domain names, ",{"type":41,"tag":101,"props":363,"children":365},{"className":364},[],[366],{"type":46,"value":367},"domain_controller_object_guid",{"type":46,"value":249},{"type":41,"tag":101,"props":370,"children":372},{"className":371},[],[373],{"type":46,"value":374},"domain_controller_object_sid",{"type":46,"value":376},")",{"type":41,"tag":168,"props":378,"children":379},{},[380,385],{"type":41,"tag":153,"props":381,"children":382},{},[383],{"type":46,"value":384},"Device and hardware identifiers",{"type":46,"value":386},": serial numbers, hardware UUIDs, machine IDs, device UUIDs, BIOS\u002Ffirmware version strings that are unique to a specific device",{"type":41,"tag":168,"props":388,"children":389},{},[390,395,397,403,404,410,411,417],{"type":41,"tag":153,"props":391,"children":392},{},[393],{"type":46,"value":394},"File system paths",{"type":46,"value":396},": process command lines, file paths, registry key paths, and log file paths that embed usernames, org names, or internal system structure (e.g. ",{"type":41,"tag":101,"props":398,"children":400},{"className":399},[],[401],{"type":46,"value":402},"C:\\Users\\alice\\",{"type":46,"value":249},{"type":41,"tag":101,"props":405,"children":407},{"className":406},[],[408],{"type":46,"value":409},"\u002Fhome\u002Fbob\u002F",{"type":46,"value":249},{"type":41,"tag":101,"props":412,"children":414},{"className":413},[],[415],{"type":46,"value":416},"HKLM\\...\\S-1-5-21-...",{"type":46,"value":376},{"type":41,"tag":168,"props":419,"children":420},{},[421,426],{"type":41,"tag":153,"props":422,"children":423},{},[424],{"type":46,"value":425},"Connection strings",{"type":46,"value":427},": database URIs, Redis URLs, any connection string that includes credentials or internal hostnames",{"type":41,"tag":168,"props":429,"children":430},{},[431,436],{"type":41,"tag":153,"props":432,"children":433},{},[434],{"type":46,"value":435},"Resource ownership",{"type":46,"value":437},": owner email, creator email, last-modified-by identity, delegate user email, assignee email, impersonator fields — any field that names a specific person as the actor on a resource",{"type":41,"tag":168,"props":439,"children":440},{},[441,446],{"type":41,"tag":153,"props":442,"children":443},{},[444],{"type":46,"value":445},"Tracking identifiers",{"type":46,"value":447},": session IDs, request\u002Fcorrelation IDs, transaction IDs, or any long opaque string tied to a real entity",{"type":41,"tag":168,"props":449,"children":450},{},[451,456],{"type":41,"tag":153,"props":452,"children":453},{},[454],{"type":46,"value":455},"Hash values",{"type":46,"value":457},": replace when they could be derived from sensitive input (password hashes, HMAC secrets) — preserve file hashes (MD5, SHA1, SHA256 of file content) and other content-addressable references (git SHAs, TLS cert hashes used as identifiers)",{"type":41,"tag":168,"props":459,"children":460},{},[461,466],{"type":41,"tag":153,"props":462,"children":463},{},[464],{"type":46,"value":465},"Geographic specifics",{"type":46,"value":467},": precise GPS coordinates, real street addresses — city and country names are generally safe to keep",{"type":41,"tag":49,"props":469,"children":470},{},[471],{"type":46,"value":472},"Apply placeholder conventions and shape rules (see below) as you go.",{"type":41,"tag":218,"props":474,"children":476},{"id":475},"step-2-verify-structure-is-intact",[477],{"type":46,"value":478},"Step 2 — Verify structure is intact",{"type":41,"tag":49,"props":480,"children":481},{},[482],{"type":46,"value":483},"Confirm after sanitization:",{"type":41,"tag":164,"props":485,"children":486},{},[487,492,603,608],{"type":41,"tag":168,"props":488,"children":489},{},[490],{"type":46,"value":491},"Line count is unchanged",{"type":41,"tag":168,"props":493,"children":494},{},[495,497],{"type":46,"value":496},"JSON lines are still valid JSON (for NDJSON files):\n",{"type":41,"tag":498,"props":499,"children":504},"pre",{"className":500,"code":501,"language":502,"meta":503,"style":503},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","python3 -c \"\nimport json, sys\nwith open('FILE') as f:\n    for i, line in enumerate(f, 1):\n        line = line.strip()\n        if line:\n            try: json.loads(line)\n            except Exception as e: print(f'Line {i}: {e}')\n\"\n","bash","",[505],{"type":41,"tag":101,"props":506,"children":507},{"__ignoreMap":503},[508,532,540,549,558,567,576,585,594],{"type":41,"tag":509,"props":510,"children":513},"span",{"class":511,"line":512},"line",1,[514,520,526],{"type":41,"tag":509,"props":515,"children":517},{"style":516},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[518],{"type":46,"value":519},"python3",{"type":41,"tag":509,"props":521,"children":523},{"style":522},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[524],{"type":46,"value":525}," -c",{"type":41,"tag":509,"props":527,"children":529},{"style":528},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[530],{"type":46,"value":531}," \"\n",{"type":41,"tag":509,"props":533,"children":534},{"class":511,"line":29},[535],{"type":41,"tag":509,"props":536,"children":537},{"style":522},[538],{"type":46,"value":539},"import json, sys\n",{"type":41,"tag":509,"props":541,"children":543},{"class":511,"line":542},3,[544],{"type":41,"tag":509,"props":545,"children":546},{"style":522},[547],{"type":46,"value":548},"with open('FILE') as f:\n",{"type":41,"tag":509,"props":550,"children":552},{"class":511,"line":551},4,[553],{"type":41,"tag":509,"props":554,"children":555},{"style":522},[556],{"type":46,"value":557},"    for i, line in enumerate(f, 1):\n",{"type":41,"tag":509,"props":559,"children":561},{"class":511,"line":560},5,[562],{"type":41,"tag":509,"props":563,"children":564},{"style":522},[565],{"type":46,"value":566},"        line = line.strip()\n",{"type":41,"tag":509,"props":568,"children":570},{"class":511,"line":569},6,[571],{"type":41,"tag":509,"props":572,"children":573},{"style":522},[574],{"type":46,"value":575},"        if line:\n",{"type":41,"tag":509,"props":577,"children":579},{"class":511,"line":578},7,[580],{"type":41,"tag":509,"props":581,"children":582},{"style":522},[583],{"type":46,"value":584},"            try: json.loads(line)\n",{"type":41,"tag":509,"props":586,"children":588},{"class":511,"line":587},8,[589],{"type":41,"tag":509,"props":590,"children":591},{"style":522},[592],{"type":46,"value":593},"            except Exception as e: print(f'Line {i}: {e}')\n",{"type":41,"tag":509,"props":595,"children":597},{"class":511,"line":596},9,[598],{"type":41,"tag":509,"props":599,"children":600},{"style":528},[601],{"type":46,"value":602},"\"\n",{"type":41,"tag":168,"props":604,"children":605},{},[606],{"type":46,"value":607},"Timestamps still match the format the pipeline uses for date parsing",{"type":41,"tag":168,"props":609,"children":610},{},[611],{"type":46,"value":612},"Enum \u002F status \u002F action values that pipeline conditions branch on are untouched",{"type":41,"tag":55,"props":614,"children":616},{"id":615},"placeholder-conventions",[617],{"type":46,"value":618},"Placeholder conventions",{"type":41,"tag":49,"props":620,"children":621},{},[622,624,630],{"type":46,"value":623},"Use consistent, realistic-looking replacements — not ",{"type":41,"tag":101,"props":625,"children":627},{"className":626},[],[628],{"type":46,"value":629},"REDACTED",{"type":46,"value":631}," strings, which break format-sensitive parsers.",{"type":41,"tag":62,"props":633,"children":634},{},[635,651],{"type":41,"tag":66,"props":636,"children":637},{},[638],{"type":41,"tag":70,"props":639,"children":640},{},[641,646],{"type":41,"tag":74,"props":642,"children":643},{},[644],{"type":46,"value":645},"Type",{"type":41,"tag":74,"props":647,"children":648},{},[649],{"type":46,"value":650},"Replacement",{"type":41,"tag":85,"props":652,"children":653},{},[654,678,711,728,752,783,800,824,848,872,896,920,937,954,973,990,1009,1026,1043,1068,1092,1111,1135,1159,1172,1189,1202,1229],{"type":41,"tag":70,"props":655,"children":656},{},[657,662],{"type":41,"tag":92,"props":658,"children":659},{},[660],{"type":46,"value":661},"Email",{"type":41,"tag":92,"props":663,"children":664},{},[665,671,672],{"type":41,"tag":101,"props":666,"children":668},{"className":667},[],[669],{"type":46,"value":670},"user@example.com",{"type":46,"value":249},{"type":41,"tag":101,"props":673,"children":675},{"className":674},[],[676],{"type":46,"value":677},"admin@example.org",{"type":41,"tag":70,"props":679,"children":680},{},[681,686],{"type":41,"tag":92,"props":682,"children":683},{},[684],{"type":46,"value":685},"IPv4",{"type":41,"tag":92,"props":687,"children":688},{},[689,691,697,698,704,705],{"type":46,"value":690},"RFC 5737 ranges: ",{"type":41,"tag":101,"props":692,"children":694},{"className":693},[],[695],{"type":46,"value":696},"198.51.100.10",{"type":46,"value":249},{"type":41,"tag":101,"props":699,"children":701},{"className":700},[],[702],{"type":46,"value":703},"203.0.113.20",{"type":46,"value":249},{"type":41,"tag":101,"props":706,"children":708},{"className":707},[],[709],{"type":46,"value":710},"192.0.2.30",{"type":41,"tag":70,"props":712,"children":713},{},[714,719],{"type":41,"tag":92,"props":715,"children":716},{},[717],{"type":46,"value":718},"IPv6",{"type":41,"tag":92,"props":720,"children":721},{},[722],{"type":41,"tag":101,"props":723,"children":725},{"className":724},[],[726],{"type":46,"value":727},"2001:db8::10",{"type":41,"tag":70,"props":729,"children":730},{},[731,736],{"type":41,"tag":92,"props":732,"children":733},{},[734],{"type":46,"value":735},"Hostname \u002F FQDN",{"type":41,"tag":92,"props":737,"children":738},{},[739,745,746],{"type":41,"tag":101,"props":740,"children":742},{"className":741},[],[743],{"type":46,"value":744},"host-1.example.local",{"type":46,"value":249},{"type":41,"tag":101,"props":747,"children":749},{"className":748},[],[750],{"type":46,"value":751},"srv-web-01.example.internal",{"type":41,"tag":70,"props":753,"children":754},{},[755,760],{"type":41,"tag":92,"props":756,"children":757},{},[758],{"type":46,"value":759},"Domain",{"type":41,"tag":92,"props":761,"children":762},{},[763,769,770,776,777],{"type":41,"tag":101,"props":764,"children":766},{"className":765},[],[767],{"type":46,"value":768},"example.com",{"type":46,"value":249},{"type":41,"tag":101,"props":771,"children":773},{"className":772},[],[774],{"type":46,"value":775},"example.org",{"type":46,"value":249},{"type":41,"tag":101,"props":778,"children":780},{"className":779},[],[781],{"type":46,"value":782},"example.net",{"type":41,"tag":70,"props":784,"children":785},{},[786,791],{"type":41,"tag":92,"props":787,"children":788},{},[789],{"type":46,"value":790},"UUID",{"type":41,"tag":92,"props":792,"children":793},{},[794],{"type":41,"tag":101,"props":795,"children":797},{"className":796},[],[798],{"type":46,"value":799},"89a1d5c1-2b3e-4f67-8a9b-0c1d2e3f4a5b",{"type":41,"tag":70,"props":801,"children":802},{},[803,808],{"type":41,"tag":92,"props":804,"children":805},{},[806],{"type":46,"value":807},"API key \u002F token",{"type":41,"tag":92,"props":809,"children":810},{},[811,817,818],{"type":41,"tag":101,"props":812,"children":814},{"className":813},[],[815],{"type":46,"value":816},"sk_test_example_key_1234567890",{"type":46,"value":249},{"type":41,"tag":101,"props":819,"children":821},{"className":820},[],[822],{"type":46,"value":823},"dGVzdC10b2tlbi0xMjM0NTY3ODk=",{"type":41,"tag":70,"props":825,"children":826},{},[827,832],{"type":41,"tag":92,"props":828,"children":829},{},[830],{"type":46,"value":831},"Username",{"type":41,"tag":92,"props":833,"children":834},{},[835,841,842],{"type":41,"tag":101,"props":836,"children":838},{"className":837},[],[839],{"type":46,"value":840},"alice.johnson",{"type":46,"value":249},{"type":41,"tag":101,"props":843,"children":845},{"className":844},[],[846],{"type":46,"value":847},"bob.smith",{"type":41,"tag":70,"props":849,"children":850},{},[851,856],{"type":41,"tag":92,"props":852,"children":853},{},[854],{"type":46,"value":855},"Display name",{"type":41,"tag":92,"props":857,"children":858},{},[859,865,866],{"type":41,"tag":101,"props":860,"children":862},{"className":861},[],[863],{"type":46,"value":864},"Alice Johnson",{"type":46,"value":249},{"type":41,"tag":101,"props":867,"children":869},{"className":868},[],[870],{"type":46,"value":871},"Bob Smith",{"type":41,"tag":70,"props":873,"children":874},{},[875,880],{"type":41,"tag":92,"props":876,"children":877},{},[878],{"type":46,"value":879},"Org \u002F company name",{"type":41,"tag":92,"props":881,"children":882},{},[883,889,890],{"type":41,"tag":101,"props":884,"children":886},{"className":885},[],[887],{"type":46,"value":888},"Example Corp",{"type":46,"value":249},{"type":41,"tag":101,"props":891,"children":893},{"className":892},[],[894],{"type":46,"value":895},"Acme Inc",{"type":41,"tag":70,"props":897,"children":898},{},[899,904],{"type":41,"tag":92,"props":900,"children":901},{},[902],{"type":46,"value":903},"Account \u002F tenant ID",{"type":41,"tag":92,"props":905,"children":906},{},[907,913,914],{"type":41,"tag":101,"props":908,"children":910},{"className":909},[],[911],{"type":46,"value":912},"000000000000",{"type":46,"value":249},{"type":41,"tag":101,"props":915,"children":917},{"className":916},[],[918],{"type":46,"value":919},"example-tenant-id",{"type":41,"tag":70,"props":921,"children":922},{},[923,928],{"type":41,"tag":92,"props":924,"children":925},{},[926],{"type":46,"value":927},"Cloud resource ID",{"type":41,"tag":92,"props":929,"children":930},{},[931],{"type":41,"tag":101,"props":932,"children":934},{"className":933},[],[935],{"type":46,"value":936},"arn:aws:iam::000000000000:user\u002Fexample-user",{"type":41,"tag":70,"props":938,"children":939},{},[940,945],{"type":41,"tag":92,"props":941,"children":942},{},[943],{"type":46,"value":944},"S3 bucket name",{"type":41,"tag":92,"props":946,"children":947},{},[948],{"type":41,"tag":101,"props":949,"children":951},{"className":950},[],[952],{"type":46,"value":953},"example-bucket",{"type":41,"tag":70,"props":955,"children":956},{},[957,962],{"type":41,"tag":92,"props":958,"children":959},{},[960],{"type":46,"value":961},"MAC address",{"type":41,"tag":92,"props":963,"children":964},{},[965,971],{"type":41,"tag":101,"props":966,"children":968},{"className":967},[],[969],{"type":46,"value":970},"00-00-5E-00-53-23",{"type":46,"value":972}," (RFC 7042 documentation range)",{"type":41,"tag":70,"props":974,"children":975},{},[976,981],{"type":41,"tag":92,"props":977,"children":978},{},[979],{"type":46,"value":980},"Serial number",{"type":41,"tag":92,"props":982,"children":983},{},[984],{"type":41,"tag":101,"props":985,"children":987},{"className":986},[],[988],{"type":46,"value":989},"SN000000000001",{"type":41,"tag":70,"props":991,"children":992},{},[993,998],{"type":41,"tag":92,"props":994,"children":995},{},[996],{"type":46,"value":997},"Device \u002F machine ID",{"type":41,"tag":92,"props":999,"children":1000},{},[1001,1003],{"type":46,"value":1002},"use a synthetic UUID or ",{"type":41,"tag":101,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":46,"value":1008},"device-id-example-000001",{"type":41,"tag":70,"props":1010,"children":1011},{},[1012,1017],{"type":41,"tag":92,"props":1013,"children":1014},{},[1015],{"type":46,"value":1016},"Windows SID",{"type":41,"tag":92,"props":1018,"children":1019},{},[1020],{"type":41,"tag":101,"props":1021,"children":1023},{"className":1022},[],[1024],{"type":46,"value":1025},"S-1-5-21-000000000-000000000-000000000-1000",{"type":41,"tag":70,"props":1027,"children":1028},{},[1029,1034],{"type":41,"tag":92,"props":1030,"children":1031},{},[1032],{"type":46,"value":1033},"File path (Windows)",{"type":41,"tag":92,"props":1035,"children":1036},{},[1037],{"type":41,"tag":101,"props":1038,"children":1040},{"className":1039},[],[1041],{"type":46,"value":1042},"C:\\Users\\example-user\\AppData\\...",{"type":41,"tag":70,"props":1044,"children":1045},{},[1046,1051],{"type":41,"tag":92,"props":1047,"children":1048},{},[1049],{"type":46,"value":1050},"File path (Unix)",{"type":41,"tag":92,"props":1052,"children":1053},{},[1054,1060,1062],{"type":41,"tag":101,"props":1055,"children":1057},{"className":1056},[],[1058],{"type":46,"value":1059},"\u002Fhome\u002Fexample-user\u002F...",{"type":46,"value":1061}," or use ",{"type":41,"tag":101,"props":1063,"children":1065},{"className":1064},[],[1066],{"type":46,"value":1067},"~",{"type":41,"tag":70,"props":1069,"children":1070},{},[1071,1076],{"type":41,"tag":92,"props":1072,"children":1073},{},[1074],{"type":46,"value":1075},"Kubernetes cluster",{"type":41,"tag":92,"props":1077,"children":1078},{},[1079,1085,1086],{"type":41,"tag":101,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":46,"value":1084},"example-cluster",{"type":46,"value":249},{"type":41,"tag":101,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":46,"value":1091},"example-node-1",{"type":41,"tag":70,"props":1093,"children":1094},{},[1095,1100],{"type":41,"tag":92,"props":1096,"children":1097},{},[1098],{"type":46,"value":1099},"Phone number",{"type":41,"tag":92,"props":1101,"children":1102},{},[1103,1109],{"type":41,"tag":101,"props":1104,"children":1106},{"className":1105},[],[1107],{"type":46,"value":1108},"734-555-0100",{"type":46,"value":1110}," (555 range is reserved for fiction)",{"type":41,"tag":70,"props":1112,"children":1113},{},[1114,1119],{"type":41,"tag":92,"props":1115,"children":1116},{},[1117],{"type":46,"value":1118},"Database host \u002F name",{"type":41,"tag":92,"props":1120,"children":1121},{},[1122,1128,1129],{"type":41,"tag":101,"props":1123,"children":1125},{"className":1124},[],[1126],{"type":46,"value":1127},"db-host.example.local",{"type":46,"value":249},{"type":41,"tag":101,"props":1130,"children":1132},{"className":1131},[],[1133],{"type":46,"value":1134},"example_database",{"type":41,"tag":70,"props":1136,"children":1137},{},[1138,1143],{"type":41,"tag":92,"props":1139,"children":1140},{},[1141],{"type":46,"value":1142},"Department \u002F org unit",{"type":41,"tag":92,"props":1144,"children":1145},{},[1146,1152,1153],{"type":41,"tag":101,"props":1147,"children":1149},{"className":1148},[],[1150],{"type":46,"value":1151},"example-department",{"type":46,"value":249},{"type":41,"tag":101,"props":1154,"children":1156},{"className":1155},[],[1157],{"type":46,"value":1158},"\u002Fexample-org\u002Fexample-unit",{"type":41,"tag":70,"props":1160,"children":1161},{},[1162,1167],{"type":41,"tag":92,"props":1163,"children":1164},{},[1165],{"type":46,"value":1166},"Hashed \u002F partial token",{"type":41,"tag":92,"props":1168,"children":1169},{},[1170],{"type":46,"value":1171},"replace with full synthetic token of same format",{"type":41,"tag":70,"props":1173,"children":1174},{},[1175,1180],{"type":41,"tag":92,"props":1176,"children":1177},{},[1178],{"type":46,"value":1179},"DHCP fingerprint",{"type":41,"tag":92,"props":1181,"children":1182},{},[1183],{"type":41,"tag":101,"props":1184,"children":1186},{"className":1185},[],[1187],{"type":46,"value":1188},"example-dhcp-fingerprint-000001",{"type":41,"tag":70,"props":1190,"children":1191},{},[1192,1197],{"type":41,"tag":92,"props":1193,"children":1194},{},[1195],{"type":46,"value":1196},"JA4 fingerprint",{"type":41,"tag":92,"props":1198,"children":1199},{},[1200],{"type":46,"value":1201},"replace with same-length hex string",{"type":41,"tag":70,"props":1203,"children":1204},{},[1205,1210],{"type":41,"tag":92,"props":1206,"children":1207},{},[1208],{"type":46,"value":1209},"Transaction \u002F sequence \u002F event-instance ID (numeric)",{"type":41,"tag":92,"props":1211,"children":1212},{},[1213,1215,1221,1223],{"type":46,"value":1214},"synthetic integer matching the original digit count — e.g. ",{"type":41,"tag":101,"props":1216,"children":1218},{"className":1217},[],[1219],{"type":46,"value":1220},"48273915",{"type":46,"value":1222}," → ",{"type":41,"tag":101,"props":1224,"children":1226},{"className":1225},[],[1227],{"type":46,"value":1228},"10000002",{"type":41,"tag":70,"props":1230,"children":1231},{},[1232,1237],{"type":41,"tag":92,"props":1233,"children":1234},{},[1235],{"type":46,"value":1236},"Session \u002F request \u002F correlation ID",{"type":41,"tag":92,"props":1238,"children":1239},{},[1240],{"type":46,"value":1241},"same-length synthetic string (preserve length and charset), not a descriptive name",{"type":41,"tag":49,"props":1243,"children":1244},{},[1245,1250],{"type":41,"tag":153,"props":1246,"children":1247},{},[1248],{"type":46,"value":1249},"Consistency rule",{"type":46,"value":1251},": map identical original values to identical placeholders throughout the file. If the same IP appears 10 times, it must become the same replacement IP all 10 times — so cross-event correlations remain testable.",{"type":41,"tag":55,"props":1253,"children":1255},{"id":1254},"shape-rule-replacements-must-match-the-original-format",[1256],{"type":46,"value":1257},"Shape rule — replacements must match the original format",{"type":41,"tag":49,"props":1259,"children":1260},{},[1261],{"type":46,"value":1262},"Every replacement must have the same shape as the original value. The parser and pipeline conditions depend on value format, not just field presence.",{"type":41,"tag":164,"props":1264,"children":1265},{},[1266,1297,1320,1330,1387,1397],{"type":41,"tag":168,"props":1267,"children":1268},{},[1269,1274,1276,1282,1283,1289,1291],{"type":41,"tag":153,"props":1270,"children":1271},{},[1272],{"type":46,"value":1273},"Numeric ID → numeric ID",{"type":46,"value":1275},": ",{"type":41,"tag":101,"props":1277,"children":1279},{"className":1278},[],[1280],{"type":46,"value":1281},"\u002Fd\u002F123\u002Fedit",{"type":46,"value":1222},{"type":41,"tag":101,"props":1284,"children":1286},{"className":1285},[],[1287],{"type":46,"value":1288},"\u002Fd\u002F456\u002Fedit",{"type":46,"value":1290},", not ",{"type":41,"tag":101,"props":1292,"children":1294},{"className":1293},[],[1295],{"type":46,"value":1296},"\u002Fd\u002Fexample-document-id\u002Fedit",{"type":41,"tag":168,"props":1298,"children":1299},{},[1300,1305,1307,1313,1314],{"type":41,"tag":153,"props":1301,"children":1302},{},[1303],{"type":46,"value":1304},"Transaction \u002F sequence \u002F event-instance ID → same-shape number",{"type":46,"value":1306},": when the value is a per-event tracking identifier, mask it, preserving digit count. e.g. CEF ",{"type":41,"tag":101,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":46,"value":1312},"cn1=48273915 cn2=3061847",{"type":46,"value":1222},{"type":41,"tag":101,"props":1315,"children":1317},{"className":1316},[],[1318],{"type":46,"value":1319},"cn1=10000002 cn2=1000002",{"type":41,"tag":168,"props":1321,"children":1322},{},[1323,1328],{"type":41,"tag":153,"props":1324,"children":1325},{},[1326],{"type":46,"value":1327},"UUID → UUID",{"type":46,"value":1329},": a real UUID must become a synthetic UUID of the same version, not a descriptive string",{"type":41,"tag":168,"props":1331,"children":1332},{},[1333,1338,1340],{"type":41,"tag":153,"props":1334,"children":1335},{},[1336],{"type":46,"value":1337},"URL → URL",{"type":46,"value":1339},": replace only the sensitive segment (hostname, path ID) — preserve the scheme, path structure, and query string shape\n",{"type":41,"tag":164,"props":1341,"children":1342},{},[1343,1369],{"type":41,"tag":168,"props":1344,"children":1345},{},[1346,1352,1353,1359,1361,1367],{"type":41,"tag":101,"props":1347,"children":1349},{"className":1348},[],[1350],{"type":46,"value":1351},"https:\u002F\u002Fdocs.google.com\u002Fdrawings\u002Fd\u002F123\u002Fedit",{"type":46,"value":1222},{"type":41,"tag":101,"props":1354,"children":1356},{"className":1355},[],[1357],{"type":46,"value":1358},"https:\u002F\u002Fdocs.google.com\u002Fdrawings\u002Fd\u002F000000000000\u002Fedit",{"type":46,"value":1360}," (replace the ID, not the host — ",{"type":41,"tag":101,"props":1362,"children":1364},{"className":1363},[],[1365],{"type":46,"value":1366},"docs.google.com",{"type":46,"value":1368}," is a public service name, not an org identifier)",{"type":41,"tag":168,"props":1370,"children":1371},{},[1372,1378,1379,1385],{"type":41,"tag":101,"props":1373,"children":1375},{"className":1374},[],[1376],{"type":46,"value":1377},"https:\u002F\u002Finternal.corp.com\u002Fapi\u002Fv1\u002Fresource",{"type":46,"value":1222},{"type":41,"tag":101,"props":1380,"children":1382},{"className":1381},[],[1383],{"type":46,"value":1384},"https:\u002F\u002Fhost-redacted.example.local\u002Fapi\u002Fv1\u002Fresource",{"type":46,"value":1386}," (replace the internal hostname, keep the path)",{"type":41,"tag":168,"props":1388,"children":1389},{},[1390,1395],{"type":41,"tag":153,"props":1391,"children":1392},{},[1393],{"type":46,"value":1394},"String ID → same-length or same-format string",{"type":46,"value":1396},": opaque alphanumeric IDs should become opaque alphanumeric placeholders of similar length, not descriptive names",{"type":41,"tag":168,"props":1398,"children":1399},{},[1400,1405,1407,1412,1413,1419,1420,1426],{"type":41,"tag":153,"props":1401,"children":1402},{},[1403],{"type":46,"value":1404},"Hostname in a URL vs. standalone hostname",{"type":46,"value":1406},": only replace hostnames that identify real internal infrastructure — public well-known hostnames (",{"type":41,"tag":101,"props":1408,"children":1410},{"className":1409},[],[1411],{"type":46,"value":1366},{"type":46,"value":249},{"type":41,"tag":101,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":46,"value":1418},"api.github.com",{"type":46,"value":249},{"type":41,"tag":101,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":46,"value":1425},"s3.amazonaws.com",{"type":46,"value":1427},") identify a service, not an organization, and do not need to be replaced",{"type":41,"tag":49,"props":1429,"children":1430},{},[1431,1436,1438,1444,1445,1451,1452,1458],{"type":41,"tag":153,"props":1432,"children":1433},{},[1434],{"type":46,"value":1435},"Malformed or garbage values must not be replaced.",{"type":46,"value":1437}," If a value looks broken, synthetic, or contains no real identifying information (e.g. ",{"type":41,"tag":101,"props":1439,"children":1441},{"className":1440},[],[1442],{"type":46,"value":1443},"http:\u002F\u002F1=Y +z\\\\",{"type":46,"value":249},{"type":41,"tag":101,"props":1446,"children":1448},{"className":1447},[],[1449],{"type":46,"value":1450},"00\u002F00\u002F0000",{"type":46,"value":249},{"type":41,"tag":101,"props":1453,"children":1455},{"className":1454},[],[1456],{"type":46,"value":1457},"N\u002FA",{"type":46,"value":1459},", empty strings, placeholder-looking values), leave it exactly as-is. Replacing a malformed value with a well-formed placeholder changes the shape and can alter pipeline behaviour — a grok that fails on the original will now succeed on the sanitized version, masking the real error.",{"type":41,"tag":49,"props":1461,"children":1462},{},[1463],{"type":46,"value":1464},"If you are unsure what shape to use, look at neighbouring values of the same field type in the same file and match their format.",{"type":41,"tag":55,"props":1466,"children":1468},{"id":1467},"what-to-preserve",[1469],{"type":46,"value":1470},"What to preserve",{"type":41,"tag":49,"props":1472,"children":1473},{},[1474],{"type":46,"value":1475},"Do not replace:",{"type":41,"tag":164,"props":1477,"children":1478},{},[1479,1512,1517,1522,1527,1532,1537,1555,1560,1573],{"type":41,"tag":168,"props":1480,"children":1481},{},[1482,1484,1490,1491,1497,1498,1504,1505,1511],{"type":46,"value":1483},"Protocol names, action verbs, event types, severity levels (",{"type":41,"tag":101,"props":1485,"children":1487},{"className":1486},[],[1488],{"type":46,"value":1489},"ALLOW",{"type":46,"value":249},{"type":41,"tag":101,"props":1492,"children":1494},{"className":1493},[],[1495],{"type":46,"value":1496},"DENY",{"type":46,"value":249},{"type":41,"tag":101,"props":1499,"children":1501},{"className":1500},[],[1502],{"type":46,"value":1503},"INFO",{"type":46,"value":249},{"type":41,"tag":101,"props":1506,"children":1508},{"className":1507},[],[1509],{"type":46,"value":1510},"ERROR",{"type":46,"value":376},{"type":41,"tag":168,"props":1513,"children":1514},{},[1515],{"type":46,"value":1516},"Product-defined event codes\u002Ftype IDs, such as Windows event IDs — these describe event semantics, not customer-specific event instances",{"type":41,"tag":168,"props":1518,"children":1519},{},[1520],{"type":46,"value":1521},"HTTP status codes, port numbers, numeric metric values (counts, sizes, durations)",{"type":41,"tag":168,"props":1523,"children":1524},{},[1525],{"type":46,"value":1526},"Field names and keys",{"type":41,"tag":168,"props":1528,"children":1529},{},[1530],{"type":46,"value":1531},"Timestamps (format and timezone must stay intact)",{"type":41,"tag":168,"props":1533,"children":1534},{},[1535],{"type":46,"value":1536},"Structural tokens (brackets, braces, pipes, commas, tabs)",{"type":41,"tag":168,"props":1538,"children":1539},{},[1540,1542,1547,1548,1553],{"type":46,"value":1541},"Public well-known service hostnames in URLs (",{"type":41,"tag":101,"props":1543,"children":1545},{"className":1544},[],[1546],{"type":46,"value":1366},{"type":46,"value":249},{"type":41,"tag":101,"props":1549,"children":1551},{"className":1550},[],[1552],{"type":46,"value":1418},{"type":46,"value":1554},", etc.) — replace the path ID if it is sensitive, not the host",{"type":41,"tag":168,"props":1556,"children":1557},{},[1558],{"type":46,"value":1559},"File hashes (MD5, SHA1, SHA256 of file content) — these are content-addressable and safe; do not replace them",{"type":41,"tag":168,"props":1561,"children":1562},{},[1563,1565,1571],{"type":46,"value":1564},"User agent strings (",{"type":41,"tag":101,"props":1566,"children":1568},{"className":1567},[],[1569],{"type":46,"value":1570},"Mozilla\u002F5.0 ...",{"type":46,"value":1572},") — these reveal browser\u002FOS type but not identity; safe to keep",{"type":41,"tag":168,"props":1574,"children":1575},{},[1576],{"type":46,"value":1577},"City and country names in geo enrichment fields — replace only precise coordinates and street addresses",{"type":41,"tag":1579,"props":1580,"children":1581},"style",{},[1582],{"type":46,"value":1583},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1585,"total":1681},[1586,1593,1610,1621,1638,1651,1666],{"slug":4,"name":4,"fn":5,"description":6,"org":1587,"tags":1588,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1589,1590,1591,1592],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":1594,"name":1594,"fn":1595,"description":1596,"org":1597,"tags":1598,"stars":25,"repoUrl":26,"updatedAt":1609},"cel-programs","write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1599,1602,1605,1606],{"name":1600,"slug":1601,"type":15},"API Development","api-development",{"name":1603,"slug":1604,"type":15},"Data Engineering","data-engineering",{"name":9,"slug":8,"type":15},{"name":1607,"slug":1608,"type":15},"Integrations","integrations","2026-07-12T07:47:10.207064",{"slug":1611,"name":1611,"fn":1612,"description":1613,"org":1614,"tags":1615,"stars":25,"repoUrl":26,"updatedAt":1620},"create-integration","create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1616,1619],{"name":1617,"slug":1618,"type":15},"Elasticsearch","elasticsearch",{"name":1607,"slug":1608,"type":15},"2026-07-12T07:46:56.318866",{"slug":1622,"name":1622,"fn":1623,"description":1624,"org":1625,"tags":1626,"stars":25,"repoUrl":26,"updatedAt":1637},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1627,1630,1631,1634],{"name":1628,"slug":1629,"type":15},"Dashboards","dashboards",{"name":1617,"slug":1618,"type":15},{"name":1632,"slug":1633,"type":15},"Kibana","kibana",{"name":1635,"slug":1636,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":1639,"name":1639,"fn":1640,"description":1641,"org":1642,"tags":1643,"stars":25,"repoUrl":26,"updatedAt":1650},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1644,1647,1648,1649],{"name":1645,"slug":1646,"type":15},"Code Review","code-review",{"name":1628,"slug":1629,"type":15},{"name":9,"slug":8,"type":15},{"name":1632,"slug":1633,"type":15},"2026-07-12T07:47:06.493988",{"slug":1652,"name":1652,"fn":1653,"description":1654,"org":1655,"tags":1656,"stars":25,"repoUrl":26,"updatedAt":1665},"ecs-field-mappings","define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1657,1660,1663,1664],{"name":1658,"slug":1659,"type":15},"Data Modeling","data-modeling",{"name":1661,"slug":1662,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":1607,"slug":1608,"type":15},"2026-07-12T07:47:13.472534",{"slug":1667,"name":1667,"fn":1668,"description":1669,"org":1670,"tags":1671,"stars":25,"repoUrl":26,"updatedAt":1680},"elastic-package-cli","develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1672,1675,1676,1677],{"name":1673,"slug":1674,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":1607,"slug":1608,"type":15},{"name":1678,"slug":1679,"type":15},"Testing","testing","2026-07-12T07:46:57.647395",14,{"items":1683,"total":1847},[1684,1703,1720,1731,1750,1762,1772,1785,1797,1810,1821,1834],{"slug":1685,"name":1685,"fn":1686,"description":1687,"org":1688,"tags":1689,"stars":1700,"repoUrl":1701,"updatedAt":1702},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1690,1693,1696,1697],{"name":1691,"slug":1692,"type":15},"Analytics","analytics",{"name":1694,"slug":1695,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":1698,"slug":1699,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1704,"name":1704,"fn":1705,"description":1706,"org":1707,"tags":1708,"stars":1700,"repoUrl":1701,"updatedAt":1719},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1709,1712,1713,1716],{"name":1710,"slug":1711,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1714,"slug":1715,"type":15},"Engineering","engineering",{"name":1717,"slug":1718,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1721,"name":1721,"fn":1722,"description":1723,"org":1724,"tags":1725,"stars":1700,"repoUrl":1701,"updatedAt":1730},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1726,1727,1728,1729],{"name":9,"slug":8,"type":15},{"name":1617,"slug":1618,"type":15},{"name":1698,"slug":1699,"type":15},{"name":1678,"slug":1679,"type":15},"2026-07-12T07:46:37.277964",{"slug":1732,"name":1732,"fn":1733,"description":1734,"org":1735,"tags":1736,"stars":1747,"repoUrl":1748,"updatedAt":1749},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1737,1740,1741,1744],{"name":1738,"slug":1739,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1742,"slug":1743,"type":15},"Operations","operations",{"name":1745,"slug":1746,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":1751,"name":1751,"fn":1752,"description":1753,"org":1754,"tags":1755,"stars":1747,"repoUrl":1748,"updatedAt":1761},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1756,1757,1760],{"name":1738,"slug":1739,"type":15},{"name":1758,"slug":1759,"type":15},"Deployment","deployment",{"name":1617,"slug":1618,"type":15},"2026-07-12T07:46:42.353362",{"slug":1763,"name":1763,"fn":1764,"description":1765,"org":1766,"tags":1767,"stars":1747,"repoUrl":1748,"updatedAt":1771},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1768,1769,1770],{"name":1738,"slug":1739,"type":15},{"name":1617,"slug":1618,"type":15},{"name":1742,"slug":1743,"type":15},"2026-07-12T07:46:41.097412",{"slug":1773,"name":1773,"fn":1774,"description":1775,"org":1776,"tags":1777,"stars":1747,"repoUrl":1748,"updatedAt":1784},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1778,1779,1780,1783],{"name":1738,"slug":1739,"type":15},{"name":1617,"slug":1618,"type":15},{"name":1781,"slug":1782,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":1786,"name":1786,"fn":1787,"description":1788,"org":1789,"tags":1790,"stars":1747,"repoUrl":1748,"updatedAt":1796},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1791,1794,1795],{"name":1792,"slug":1793,"type":15},"Authentication","authentication",{"name":1738,"slug":1739,"type":15},{"name":1617,"slug":1618,"type":15},"2026-07-12T07:46:39.783105",{"slug":1798,"name":1798,"fn":1799,"description":1800,"org":1801,"tags":1802,"stars":1747,"repoUrl":1748,"updatedAt":1809},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1803,1806,1807,1808],{"name":1804,"slug":1805,"type":15},"Audit","audit",{"name":1617,"slug":1618,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":1811,"name":1811,"fn":1812,"description":1813,"org":1814,"tags":1815,"stars":1747,"repoUrl":1748,"updatedAt":1820},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1816,1817,1818,1819],{"name":1792,"slug":1793,"type":15},{"name":9,"slug":8,"type":15},{"name":1617,"slug":1618,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":1822,"name":1822,"fn":1823,"description":1824,"org":1825,"tags":1826,"stars":1747,"repoUrl":1748,"updatedAt":1833},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1827,1828,1829,1832],{"name":9,"slug":8,"type":15},{"name":1617,"slug":1618,"type":15},{"name":1830,"slug":1831,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":1835,"name":1835,"fn":1836,"description":1837,"org":1838,"tags":1839,"stars":1747,"repoUrl":1748,"updatedAt":1846},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1840,1841,1842,1843],{"name":1691,"slug":1692,"type":15},{"name":1694,"slug":1695,"type":15},{"name":1617,"slug":1618,"type":15},{"name":1844,"slug":1845,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]