> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/configure/log-scrubbing.md).

# Log scrubbing

Prisma Cloud Compute Runtime events may include sensitive information that’s found in commands that are run by protected workloads, such as secrets, tokens, PII, or other information considered to be personal by various laws and regulations.

Using the Runtime log scrubbing capabilities, you can filter such sensitive information and ensure that it is not included in the Runtime findings (such as Forensics, Incidents, audits, and so on.).

You can filter your Runtime sensitive data out using the automatic scrubbing capability, as well as using custom scrubbing rules. Follow the documentation instructions to learn more about these two options.

Sensitive information from WAAS logs can be scrubbed as well, see [WAAS Log Scrubbing](/admin-guide/32/web-application-and-api-security-waas/log-scrubbing.md) to learn more.

## Automatically scrub secrets from runtime events

You can enable the automatic scrubbing of known sensitive phrases (such as "secrets", "passwords", "tokens", and so on.) from your runtime events. The detected sensitive data will be replaced in the events by `"[*****]"`.

### Enable/Disable the automatic scrubbing:

1. Open the Console, and go to **Manage > System > General**.
2. Enable/Disable **Automatically scrub secrets from runtime events**.

## Add/Edit custom scrubbing rule

Create or edit log scrubbing rules.

1. Open the Console, and go to **Manage > System > General**.
2. In the **Custom log scrubber** section select **Runtime** or **WAAS**.
3. Click on **Add rule** or select an existing rule.
4. Enter the rule **Name**.
5. Provide a matching **Pattern** in the form of a regular expression ([re2](https://github.com/google/re2/wiki/Syntax)), e.g. `^sessionID$`, `key-[a-zA-Z]{8,16}`.
6. Provide a **Placeholder** string e.g. `[scrubbed email]`.
   1. Placeholder strings indicating the nature of the scrubbed data should be used as users will not be able to see the underlying scrubbed data.
7. Click **Save**.

   * Data will now be scrubbed from any Runtime and WAAS event before it is written (either to the Defender log or syslog) and sent to the console.
   * The automatic scrubbing and custom scrubbing are independent, meaning that you can choose to use each one of them separately.
   * Data will be scrubbed only in messages that are generated while the scrubbing toggle or scrubbing rule is **enabled**. Messages that were generated **before** enabling one of the scrubbing configurations above or **after** disabling them, won’t be scrubbed.
   * The WAAS scrubbing rules are synced with the rules in **Defend > WAAS > Sensitive data**.
   * Serverless Runtime events are not scrubbed.

   <figure><img src="/files/qHpH8bkWjSXK3p8swyUe" alt="runtime log scrubbing"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/32/configure/log-scrubbing.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.