Filtering events from specific IPs

[robkingston]

For a less permanent or retroactive application, you could try this script:

Retrieve User_ids encrypted by enrichment

I cobbled together a quick Python script to reverse hashed data for IPs. However it could also be used/modified to work with your User IDs. It accepts input via arguments or stdin - so it’s not really limited to just IPs. import hashlib, os, sys salt = os.getenv('SNOWPLOW_PII_SALT') def hash_ip(input_ip): hashed_ip = hashlib.md5() hashed_ip.update(f'{input_ip}{salt}'.encode('utf-8')) return hashed_ip.hexdigest() def hash_range(start, end): import socket, struct start =…

If you know your Salt, IP addresses and push it through the same cryptographic hash function, you will get the same output as the Snowplow enrichment emits.

Then you can just filter by hashed user_ipaddress in SQL.