Masking

The Mask pipeline step transforms sensitive values inside an event before it is written to storage. Use it to protect PII (emails, IPs, tokens, SSNs) while keeping the rest of the event intact for search and detections. Each rule targets a single field and applies one of three modes: redact, hash, or partial.

Add masking from Pipelines → edit a pipeline → add the Mask step. Add one rule per field you want to transform, choose a mode, and use step preconditions to scope which events the rules apply to.

How it works

For each rule, the step reads the value at the target field, transforms it according to the rule's mode, and writes the result back onto the event. Masking mutates the event in place, so every step and destination after it sees the masked value.

Order matters. Masking only affects events that reach the step. Place the Mask step before any Destination steps so the original value is never written to storage, and before Detect if your Sigma rules should run against masked values.

Masking modes

Mode	What it does	Config
Redact	Replaces the entire value with a static token.	Optional replacement token (defaults to `***`).
Hash	Replaces the value with a deterministic, non-reversible pseudonym. Equal values produce equal hashes within a workspace, so masked fields stay joinable and countable in detections.	Optional salt (see below).
Partial	Replaces only the regex-matched section(s) of the value with the token, leaving the rest visible (e.g. keep the email domain, mask the local part).	Regex pattern + optional replacement token.

About hash mode

Hash mode uses HMAC-SHA256 keyed by a secret, per-workspace key that is generated automatically and never exposed in pipeline config. Because the key is secret, the mapping from value to hash cannot be recomputed or brute-forced by anyone reading the stored logs — but the same input still hashes to the same output, so you can group and correlate on the masked value.

By default, all hash-mode rules in a workspace share the same domain, so a value hashed by one rule matches the same value hashed by another. Set an optional salt on a rule to give it its own separate set of hashes: the same salt yields the same hashes, a different salt yields unrelated ones.

Configuration

Each mask rule has the following settings:

Setting	Applies to	Description	Example
Field	all modes	The field to mask. Pick a normalized field from the dropdown, or choose Other to enter a raw log JSON path.	`normalized.actor.email` or `user.email`
Mode	all modes	`redact`, `hash`, or `partial`.	`hash`
Replacement token	redact, partial	Value written in place of the (matched) content.	`***`
Match pattern	partial	RE2 regex selecting the section(s) to replace.	`^[^@]+`
Salt	hash	Optional label separating this rule's hashes from other rules.	`pii-emails`

Field targeting

Fields use the same vocabulary as preconditions and the frontend field picker:

Normalized fields: values prefixed with normalized. target RunReveal's normalized schema (e.g. normalized.actor.email, normalized.src.ip). Only string values are masked.
Raw log fields: any other value is a bare GJSON path into the raw log (e.g. user.email, request.headers.authorization).

A rule whose field is not present on an event is silently skipped, so mask configs can safely reference fields that only appear on some sources.

Use Cases

Hash User Emails for Joinable Analytics

You want to analyze user behavior and correlate events by identity, but you don't want raw email addresses stored in the clear. Hash the email so the same user is consistently identifiable without exposing their address.

{
  "eventName": "login",
  "actor": { "email": "[email protected]" },
  "src": { "ip": "203.0.113.50" }
}

Precondition: Regex

Only mask corporate emailsactor.email regex: @company.com$

Partially Mask Emails, Keep the Domain

For triage you often only need the domain of an email, not the individual. Use partial mode to redact the local part while keeping the domain readable for grouping and filtering.

{
  "actor": { "email": "[email protected]" }
}

Redact Secrets from a Raw Log Field

A webhook payload includes an authorization header or API token you never want to retain. Redact the raw log field entirely with a static token.

{
  "request": {
    "headers": { "authorization": "Bearer sk_live_51H8x...redacted" }
  }
}

Mask vs Drop vs Filter

Action	What Happens	When to Use
Mask	Transforms specific field values (redact/hash/partial), keeping the event	You need the event for analysis but must protect or pseudonymize sensitive fields
Drop	Removes the entire event	The whole event has no value and should never be stored
Filter	Drops matching events using reusable rules	Reusable, shareable drop rules across pipelines

Pipelines Overview - Topics, pipelines, steps, and precondition reference
Transforms - Normalize fields before masking so normalized paths resolve
Destinations - Route events after masking; keep Mask steps ahead of Destination steps

Hash User Emails for Joinable Analytics

Precondition: Regex

Partially Mask Emails, Keep the Domain

Redact Secrets from a Raw Log Field

On this page