Source-side redaction
Redact sensitive log fields where they originate - inside your
application.
In-process redaction is one supported control within a wider logging-policy lifecycle. Existing framework filters and pipelines can also redact data; test whether they already meet your requirement.
The problem
Redaction needs a defined scope and operating record
A rule is only effective on the fields and paths it evaluates. Check integration coverage, policy version, exceptions, and recorded outcomes. CerbiShield supports ongoing policy and evidence management where scattered controls leave a recurring gap.
Before and after
// Governance runs at emission time, inside the application process. The sink receives only governed output.
Architecture
In-process redaction runs before any network call
CerbiStream applies policy inside selected .NET applications. Dedicated adapters support other logger families and runtimes; actions vary by integration. Configure and test your selected path. Unconnected loggers and fields outside the configured policy are not automatically protected.
Application code
constructs log event
Logger framework
MEL / Serilog / NLog
CerbiStream
redacts at emission time
Log sink
receives clean output only
// Cerbi runs inside your process. No sidecar, no agent, no additional network hop.
Why existing tools are too late
Evaluate coverage beyond one redaction rule
Data leaves the application before redaction runs
Pipeline tools receive log events over the network. The raw sensitive value is already outside your application process before any redaction rule executes.
Regex rules miss structural variations
Sensitive data appears in many formats. A regex that matches '078-05-1120' may not match the same SSN formatted differently or embedded in a JSON string. In-process governance can evaluate field names, not just values.
Pipeline redaction adds operational complexity
Every redaction rule in a pipeline is a configuration artefact that must be maintained, tested, and kept in sync with application changes. Source-side governance co-locates rules with application code.
How Cerbi fits with your stack
Drop Cerbi into your existing logging setup
One NuGet, PyPI, Maven, or Go package
Choose the supported runtime integration. CerbiShield adds customer-hosted policy operation and evidence.
Works alongside pipeline tools
Cerbi governs events before they reach the pipeline. Your Cribl or Logstash config can stay in place for routing and enrichment.
Field-level control
Specify exactly which fields to redact, mask, or block. Rules are evaluated by field name and optionally by value pattern.
CI validation
The Cerbi Scanner ADO extension validates governance profiles against log output shapes at CI time, catching policy violations before they reach production.
Common questions
Frequently asked
Review the logging-control gap
Bring a logging finding or evidence requirement. Compare existing controls, then scope one CerbiShield workload and policy if a recurring gap remains.
// local demo path: install from NuGet, PyPI, Maven, or the Go module registry - no account required