Obfuscation in ApplicationInsight

Question

Obfuscation in ApplicationInsight

Yauheni Yefimenka 41

Hi guys, I have a question about Azure ApplicationInsight. In our project, there is a customer who has a bad API where we send sensitive information over GET requests. The problem is we can see HTTP requests with all parameters in ApplicationInsight. We need either obfuscate some parameters or hide them at all. Could you help us, please? Is there such a possibility?

Accepted answer

0 additional answers

Your answer

Answer 1

AnuragSingh-MSFT 21,546 Moderator

Hi @Yauheni Yefimenka ,

Thank you for posting this question on Microsoft Q&A.

I understand that you want to edit the URL being collected through ApplicationInsights for the requests to exclude certain parameters. For that, you may use telemetry initializers to modify the properties of telemetry being submitted to ApplicationInsights. The link here provides a basic example of how to use it in your application - Add/modify properties: ITelemetryInitializer

Note the line var requestTelemetry = telemetry as RequestTelemetry; in the sample provided. RequestTelemetry has a property called URL which can be read and overwritten with some obfuscated data.

I also noticed based on the screenshot that the URL was related to a PHP application. Note that PHP is not officially supported language for ApplicationInsights. For details, please see this link.

Please let me know if you have any questions.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Yauheni Yefimenka 41 Reputation points

2022-08-11T06:10:59.523+00:00

Hi @AnuragSingh-MSFT ,

I'd like to add that we don't have a PHP, we code on JAVA and all metrics and logs are gathered by java agent in webapp of Azur. Is there one more solution in order to tune such behavior of agent? Because, unfortunately, we don't use any libs for this and we can't set it up on the code base side. Moreover, my last investigation shows us that we cannot use the library of web telemetry because we use reactive approach in app. I cannot find any libs which would work with webflux in spring boot.

Thanks in advance.
AnuragSingh-MSFT 21,546 Reputation points Moderator

2022-08-11T09:28:20.983+00:00

@Yauheni Yefimenka , thank you for sharing additional information.
I am sorry for the confusion as I noticed .php in the URL and assumed it was a PHP application. I understand that it is a Java application already hosted as Azure WebApps.

In this scenario, you can use Telemetry processors for Java, which can be configured using applicatapingsights.json file and does not require any code change. Please see the following link for options available to specify this configuration json file- Configuration file path

Based on the documentation, the extract and delete Attribute Processors (for http.url attribute) could be used for masking selective items from the URL. A sample for using this method for log message is available here - Masking sensitive data in log message

Please let me know if you have any questions.

Share via

Obfuscation in ApplicationInsight

0 additional answers

Your answer