# Can iRule mask the payload content on event logs of security **URL:** \ **Category:** Technical Forums\ **Tags:** security\ **Created:** [April 15, 2024, 10:21am UTC](https://community.f5.com/t/can-irule-mask-the-payload-content-on-event-logs-of-security/74339 "2024-04-15T10:21:49Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Nishal\_Rai](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nishal_rai/32/4896_2.png) [@Nishal\_Rai](https://community.f5.com/u/Nishal_Rai)\ **Post date:** [April 15, 2024, 10:21am UTC](https://community.f5.com/t/can-irule-mask-the-payload-content-on-event-logs-of-security/74339/1 "2024-04-15T10:21:49Z")
Hello Everyone,  Is it possible to mask the certain value of the request on the **Application Security \> Event Logs** using iRule, Since the application “Content-Type: application/octet-stream” and the payload consists some sensitive information of the user which are not associated with any parameters in the payload.   The requested URL is “/api/v1/client/client-auth/login” and I want to mask the content after first value (which is a cell number and follows a pattern) till the 15 characters, regardless of the character used. The payload sample: ```asciidoc 9844445555 password@123 ``` I tried with a below iRule script but the application stopped working: ```tcl when HTTP_REQUEST { if { [HTTP::uri] equals "/api/v1/client/client-auth/login" && [HTTP::header "Content-Type"] equals "application/octet-stream" } { set payload [TCP::payload] set pattern {(\d+).*?} if {[regexp -indices $pattern $payload match_indices]} { foreach {start_index end_index} $match_indices { set dynamic_length [expr {$end_index - $start_index - 10}] ; set masked_part [string repeat "*" $dynamic_length] set masked_payload [string replace $payload [expr $start_index] [expr $end_index - 1] $masked_part] set payload $masked_payload } TCP::payload replace 0 [string length $payload] $payload } } } ``` ---
**Author:** ![F5\_Design\_Engineer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/f5_design_engineer/32/2479_2.png) [@F5\_Design\_Engineer](https://community.f5.com/u/F5_Design_Engineer)\ **Post date:** [April 15, 2024, 6:54pm UTC](https://community.f5.com/t/can-irule-mask-the-payload-content-on-event-logs-of-security/74339/2 "2024-04-15T18:54:30Z")
try REGSUB -all , something like this to mask you mobile umber or password shown in the HTTP responses when HTTP\_RESPONSE {     set clen [HTTP::header Content-Length]     HTTP::collect $clen } when HTTP\_RESPONSE\_DATA { regsub -all {\(.\*?)\} [HTTP::payload] {\\*\*\*\*\*\*\*\*\} fixeddata     log “Replacing payload with new data.”     HTTP::payload replace 0 $clen $fixeddata     HTTP::release } > **[myF5](https://my.f5.com/manage/s/article/K16533717)** > **[regsub](https://wiki.tcl-lang.org/page/regsub)** > > Tclers wiki > **[F5 irule Regex Examples](https://spy86.github.io/CheatSheetCollection/DevOpsServices/F5.html)** ---
**Author:** ![Nishal\_Rai](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nishal_rai/32/4896_2.png) [@Nishal\_Rai](https://community.f5.com/u/Nishal_Rai)\ **Post date:** [April 22, 2024, 8:17am UTC](https://community.f5.com/t/can-irule-mask-the-payload-content-on-event-logs-of-security/74339/3 "2024-04-22T08:17:01Z")
Hi @F5_Design_Engineer Thanks for the resources and commands but, I need to mask the the payload on the HTTP\_REQUEST so that the **Application \> Event Logs** does not displays the credentials - input the user. ---
**Author:** ![F5\_Design\_Engineer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/f5_design_engineer/32/2479_2.png) [@F5\_Design\_Engineer](https://community.f5.com/u/F5_Design_Engineer)\ **Post date:** [April 25, 2024, 12:56am UTC](https://community.f5.com/t/can-irule-mask-the-payload-content-on-event-logs-of-security/74339/4 "2024-04-25T00:56:25Z")
Try this article: [Irule Check payload contains | DevCentral](https://community.f5.com/topic/328422) > **[3.1.4. Lab 4 - Content Rewrite](https://f5-agility-labs-irules.readthedocs.io/en/latest/class2/module1/lab4.html)** > **[HTTP::payload](https://clouddocs.f5.com/api/irules/HTTP__payload.html)** Use HTTP::payload replace \ \ \ ### HTTP::payload replace[¶](https://clouddocs.f5.com/api/irules/HTTP__payload.html#http-payload-replace) - Replaces the amount of content that you specified with the argument, starting at with , adjusting the Content-Length header appropriately. - To clarify, the length argument should be the length of original content to replace. In order to replace the entire payload, the offset should be 0 and the length should be the original size in bytes of the payload. - Note that the argument will be interpreted as a byte array. If it is actually a UTF-8 string with multibyte characters, the output will not be what you expect. In order to prepare a UTF-8 string for use as input to HTTP::payload replace, you should first run ‘binary scan c\* throwawayvariable’. - **Note:**  This function is callable, but will not work as expected in the HTTP\_REQUEST\_SEND event ## Examples[¶](https://clouddocs.f5.com/api/irules/HTTP__payload.html#examples) when HTTP\_RESPONSE { if {[HTTP::status] == 205}{ HTTP::collect [HTTP::header Content-Length] set clen [HTTP::header Content-Length] } } when HTTP\_RESPONSE\_DATA { HTTP::respond 200 content [HTTP::payload] } when HTTP\_RESPONSE\_DATA { regsub -all “oursite” [HTTP::payload] “oursitedev” newdata log “Replacing payload with new data.” HTTP::payload replace 0 $clen $newdata HTTP::release } ---
**Author:** ![Nishal\_Rai](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nishal_rai/32/4896_2.png) [@Nishal\_Rai](https://community.f5.com/u/Nishal_Rai)\ **Post date:** [April 25, 2024, 6:25am UTC](https://community.f5.com/t/can-irule-mask-the-payload-content-on-event-logs-of-security/74339/5 "2024-04-25T06:25:22Z")
Thanks @F5_Design_Engineer for the articles. Most of the articles is all about the HTTP\_RESPONSES, whereas I need to make the payload changes on the HTTP\_REQUEST, and the key challenge is the unstructured format in between the username and password to be identified by the f5. ![image_329348.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/d/d9cc65db16d960bbf71ec9f9ef1bc9a4caab7d69.png) I will try to work on the application “ **Content-Type** ” instead, which seems to more easy because of the complexity on the iRule, mainly for identifying the pattern of the payloads (username and password).