Potential PCI Data Exposure in Network Traffic

Ali AlEnezi@site

•updated Apr 4, 2026•7•0•56

This rule detects potential exposure of Payment Card Industry (PCI) data, specifically Payment Account Numbers (PANs), within network traffic. It looks for keywords related to payment information (e.g., 'post', 'put', 'payment', 'card', 'ccnum', 'account number') in conjunction with sequences of 13 to 19 digits that resemble PANs. The rule attempts to filter out masked PANs (e.g., those containing '****' or 'xxxx'). This could indicate sensitive data being transmitted insecurely or logged inappropriately.