Can iRule mask the payload content on event logs of security

try REGSUB -all , something like this to mask you mobile umber or password shown in the HTTP responses

when HTTP_RESPONSE {
    set clen [HTTP::header Content-Length]
    HTTP::collect $clen
}

when HTTP_RESPONSE_DATA {

    regsub -all {<PhoneNumber>(.*?)</PhoneNumber>} [HTTP::payload] {<PhoneNumber>********</PhoneNumber>} fixeddata
    log "Replacing payload with new data."
    HTTP::payload replace 0 $clen $fixeddata
    HTTP::release

}

https://my.f5.com/manage/s/article/K16533717

https://wiki.tcl-lang.org/page/regsub

https://spy86.github.io/CheatSheetCollection/DevOpsServices/F5.html

Hi F5_Design_Engineer 


Thanks for the resources and commands but, I need to mask the the payload on the HTTP_REQUEST so that the Application > Event Logs does not displays the credentials - input the user.  

Try this article:

Irule Check payload contains | DevCentral

https://f5-agility-labs-irules.readthedocs.io/en/latest/class2/module1/lab4.html

https://clouddocs.f5.com/api/irules/HTTP__payload.html

Use

HTTP::payload replace <offset> <length> <string>

HTTP::payload replace¶

• Replaces the amount of content that you specified with the argument, starting at with , adjusting the Content-Length header appropriately.
• To clarify, the length argument should be the length of original content to replace. In order to replace the entire payload, the offset should be 0 and the length should be the original size in bytes of the payload.
• Note that the argument will be interpreted as a byte array. If it is actually a UTF-8 string with multibyte characters, the output will not be what you expect. In order to prepare a UTF-8 string for use as input to HTTP::payload replace, you should first run ‘binary scan c* throwawayvariable’.
• Note: This function is callable, but will not work as expected in the HTTP_REQUEST_SEND event

Examples¶

when HTTP_RESPONSE { if {[HTTP::status] == 205}{ HTTP::collect [HTTP::header Content-Length] set clen [HTTP::header Content-Length] } } when HTTP_RESPONSE_DATA { HTTP::respond 200 content [HTTP::payload] } when HTTP_RESPONSE_DATA { regsub -all "oursite" [HTTP::payload] "oursitedev" newdata log "Replacing payload with new data." HTTP::payload replace 0 $clen $newdata HTTP::release }

Thanks F5_Design_Engineer for the articles. 

Most of the articles is all about the HTTP_RESPONSES, whereas I need to make the payload changes on the HTTP_REQUEST, and the key challenge is the unstructured format in between the username and password to be identified by the f5. 

 
I will try to work on the application "Content-Type" instead, which seems to more easy because of the complexity on the iRule, mainly for identifying the pattern of the payloads (username and password).