Build a lookup table for hashed IP

For engineers Enrichment
1

Hi all,
I believe my IP addresses are hashed using the PII enrichment. Therefore I’m trying to build a lookup table for the hashed IPs.

I’m able to match the same hashed and unhashed IP from two different tables with the approximate timestamp (they are down to only seconds different so I’m pretty confident that they are the same IPs). I tried ‘hashing’ the IP with sha1 function (my hashed IP is 40 digits long, for instance e60fb13bebb2c1cd84532ba8d3b3e5b4d828299e). However, It is not giving me the desired matching address.

I’m using a function like this sha1( IP || Salt). I have also tried different ways of inputting the IP address, for example removing the dots and with different combination etc. But still not matching.

Would be great to hear some ideas on this topic, thanks!

2

This sounds like a bit of an unusual use case (that is building a lookup table).

If you are using the PII enrichment then the raw (unhashed) data will be sent to the PII stream so this should give you the original, unhashed values to compare to your hashed output - this will enable direct comparisons with the event_id.

Assuming that you are using SHA-1 in the PII enrichment then the SHA1(IP + salt) should given you an identical result assuming that everything is UTF-8 encoded.