This enrichment replaces the end of the user’s IP address with “x”s, on a configurable length. For instance 18.104.22.168 could become 13.54.x.x.
Both IPv4 and IPv6 are supported.
This enrichment runs after IP lookup enrichment.
The number of octets (IPv4) to anonymize is specified with
anonOctets and the number of segments (IPv6) to anonymize is specified with
For example anonymizing one octet would change an IPv4 address of 255.255.255.255 to 255.255.255.x, and anonymizing three octets would change it to 255.x.x.x.
This enrichment uses the IP of the user, that can be found in
user_ipaddress field of the atomic event.
The anonymized value of the IP address is updated in-place in
user_ipaddress field, before ever being stored.