2

I've been using grep to run a few PII scans and while it's finding results, it's indeed finding too many false positives.

Is there a way that I can tell grep not to trigger a match for a file unless it contains other data?

For instance, can I tell it not to trigger an alert on a regex for a SSN unless the file includes text like "ssn" or "social security number" somewhere else in the file?

Improve this question

2 Answers 2

Reset to default
1 
grep -lZ ssn files_to_search | xargs -0 grep what_to_search_for
Improve this answer
0

Sure, just pipe the first output to another grep. Grep for foo and then grep for bar, so your output will only be lines that have both foo AND bar.

grep SSN filename.txt | grep -e "ssn|social security number"

This only hits on uppercase SSN, then passes any lines with either sss OR social security number. lower case. Add -i for any case. If you reall want both SSN and ssn try this;

grep -i SSN filename.txt | grep social.security.number

Another one I like is to only shows lines that don't have bar. Do Grep for foo then grep -v bar. Only lines with foo, that also do not have bar. Using GNU grep 2.5.4 in windows

Improve this answer
3
  • The OP said "somewhere else in the file" not "on the same line".
    – Dennis Williamson
    Mar 17, 2010 at 18:17
  • how far away? You can set 10 lines before and 3 lines after, or on a file by file basis. Grep lets you set a window around the mask. What do you need?
    – RedBarn
    Mar 17, 2010 at 18:22
  • Pretty much anywhere in the file.
    – tearman
    Mar 17, 2010 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .