SOLVED

Obfuscated string literals

%3CLINGO-SUB%20id%3D%22lingo-sub-1053031%22%20slang%3D%22en-US%22%3EObfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1053031%22%20slang%3D%22en-US%22%3E%3CP%3EI%20came%20across%20this%20tidbit%20in%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fscalar-data-types%2Fstring%23obfuscated-string-literals%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fscalar-data-types%2Fstring%23obfuscated-string-literals%3C%2FA%3E%26nbsp%3Babout%20obfuscating%20string%20literals%20in%20KQL%20and%20it%20gives%20this%20example%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22hljs-keyword%22%3Eprint%3C%2FSPAN%3E%3CSPAN%3E%20x%3D%3C%2FSPAN%3E%3CSPAN%20class%3D%22hljs-string%22%3E%22%3CA%20href%3D%22https%3A%2F%2Fcontoso.blob.core.windows.net%2Fcontainer%2Fblob.txt%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcontoso.blob.core.windows.net%2Fcontainer%2Fblob.txt%3C%2FA%3E%3F%22%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22hljs-string%22%3Eh'sv%3D2012-02-12%26amp%3Bse%3D2013-04-13T0...'%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22hljs-string%22%3EHowever%20when%20I%20run%20it%2C%20nothing%20gets%20obfuscated.%20Based%20on%20my%20reading%20I%20should%20see%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22hljs-string%22%3E%3CA%20href%3D%22https%3A%2F%2Fcontoso.blob.core.windows.net%2Fcontainer%2Fblob.txt%3F*****************************%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcontoso.blob.core.windows.net%2Fcontainer%2Fblob.txt%3F*****************************%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22hljs-string%22%3Ebut%20I%20don't.%26nbsp%3B%20Has%20anyone%20else%20tried%20this%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1055357%22%20slang%3D%22en-US%22%3ERe%3A%20Obfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1055357%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI'm%20fairly%20sure%20this%20applies%20only%20to%20KQL%20in%20Azure%20Data%20Explorer%20and%20isn't%20supported%20by%20Log%20Analytics%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1055855%22%20slang%3D%22en-US%22%3ERe%3A%20Obfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1055855%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3BI%20don't%20think%20obfuscation%20hides%20the%20data%20in%20query%20results%2C%20but%20rather%20in%20query%20logging.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1056716%22%20slang%3D%22en-US%22%3ERe%3A%20Obfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1056716%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BWell%20bummer.%26nbsp%3B%20Thanks%20for%20the%20answer%20%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1068073%22%20slang%3D%22en-US%22%3ERe%3A%20Obfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1068073%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3A%20using%20the%20obfuscation%20format%20is%20still%20recommended%20as%20it%20would%20ensure%20the%20string%20is%20obfuscated%20when%20logged.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1068170%22%20slang%3D%22en-US%22%3ERe%3A%20Obfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1068170%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F293879%22%20target%3D%22_blank%22%3E%40Ofer_Shezaf%3C%2FA%3E%26nbsp%3BI%20could%20see%20using%20it%20if%20you%20are%20writing%20to%20the%20logs%20yourself%20but%20if%20I%20am%20using%20something%20like%20the%20OfficeActivity%20log%20I%20don't%20see%20any%20way%20that%20I%20would%20be%20able%20to%20control%20what%20is%20obfuscated%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1068251%22%20slang%3D%22en-US%22%3ERe%3A%20Obfuscated%20string%20literals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1068251%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3A%20Should%20have%20been%20clearer%2C%20I%20meant%20when%20the%20service%20logs%20internally%20queries%20execution%2C%20and%20in%20the%20future%20also%20to%20users%2C%20they%20are%20obfuscated.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Super Contributor

I came across this tidbit in https://docs.microsoft.com/en-us/azure/kusto/query/scalar-data-types/string#obfuscated-string-litera... about obfuscating string literals in KQL and it gives this example

 

print x="https://contoso.blob.core.windows.net/container/blob.txt?" h'sv=2012-02-12&se=2013-04-13T0...'

 

However when I run it, nothing gets obfuscated. Based on my reading I should see:

https://contoso.blob.core.windows.net/container/blob.txt?*****************************

 

but I don't.  Has anyone else tried this?

6 Replies
Best Response confirmed by Gary Bushey (Super Contributor)
Solution

@Gary Bushey 

 

I'm fairly sure this applies only to KQL in Azure Data Explorer and isn't supported by Log Analytics 

@Gary Bushey I don't think obfuscation hides the data in query results, but rather in query logging. 

@Clive Watson Well bummer.  Thanks for the answer :smile:

@Gary Bushey : using the obfuscation format is still recommended as it would ensure the string is obfuscated when logged.

@Ofer_Shezaf I could see using it if you are writing to the logs yourself but if I am using something like the OfficeActivity log I don't see any way that I would be able to control what is obfuscated

@Gary Bushey : Should have been clearer, I meant when the service logs internally queries execution, and in the future also to users, they are obfuscated.