gdpr_check
Identify sensitive personal fields in an index via rules, names, and sampled values. Dry-run suggests mask fields; apply merges them into config, logs the change, and writes a compliance report.
Instructions
Run the DSGVO plausibility check on an index: find sensitive fields.
Reads the index mappings, samples a few documents, and classifies the
fields by three heuristics in decreasing certainty: custom rules from
config.yaml (gdpr_checker.custom_patterns), field-name patterns
(source.ip, user.name, host.hostname, user.email, ...), and sampled
values (an actual value like 192.168.1.100 reveals an IP even when the
field name does not).
Priorities: IPs, usernames and e-mails are directly personal (high);
hostnames and agent ids are indirectly personal (medium); free-text fields
that embed personal data are flagged as such. Fields already in the
anonymization mask_fields are reported as covered, not re-suggested.
With apply=true the suggested fields are merged into
anonymization.mask_fields of config.yaml (KLAXON_CONFIG), the action is
appended to gdpr_check.log, and gdpr_compliance_report.json is
written. The change takes effect for the running server on restart unless
KLAXON_ANONYMIZATION_MASK_FIELDS is set, which always overrides the file.
apply=false (default) is a dry run: suggestions only, nothing changed.
Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-*". prefix: Restrict to a field namespace, e.g. "user." or "source.". sample_docs: Documents to sample for content analysis. Defaults to KLAXON_GDPR_SAMPLE_SIZE (10). 0 disables sampling. apply: When true, merge the suggested fields into config.yaml and log. exclude: Field names to skip (e.g. internal fields without GDPR relevance). as_json: When true, return a machine-readable JSON report instead of the table.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | ||
| index | Yes | ||
| prefix | No | ||
| as_json | No | ||
| exclude | No | ||
| sample_docs | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |