Re: Anonymizing System Logs

Also, when you're anonymizing, make sure you map the same fields to the same
random outputs. I was experimenting with a correlation engine way back in the
day and used some anonymized logs -- then I discovered that it was always
mapping
[email protected] -> [email protected]
[email protected] -> [email protected]
message-ids were also getting "crushed down" - so my tool was trying to build
sequence-trees of events and concluded that one person was REALLY busy. ;)

So just keep a table of randomly generated IDs and always map the same input
to the matching randomly-generated output wherever you see it.

mjr.