<commit_before>[[encrypting-data]]
== Encrypting Sensitive Data in {watcher}

Watches might have access to sensitive data such as HTTP basic authentication
information or details about your SMTP email service. You can encrypt this
data by generating a key and adding some secure settings on each node in your
cluster.

To encrypt sensitive data in {watcher}:

. Use the {ref}/syskeygen.html[elasticsearch-syskeygen] command to create a system key file.

. Copy the `system_key` file to all of the nodes in your cluster.
+
--
IMPORTANT: The system key is a symmetric key, so the same key must be used on
every node in the cluster.

--

. Set the
{ref}/notification-settings.html[`xpack.watcher.encrypt_sensitive_data` setting]:
+
--

[source,sh]
----------------------------------------------------------------
xpack.watcher.encrypt_sensitive_data: true
----------------------------------------------------------------
--

. Set the<commit_msg>Docs: Clarify sensitive fields watcher encryption (#31551)<commit_after>[[encrypting-data]]
== Encrypting Sensitive Data in {watcher}

Watches might have access to sensitive data such as HTTP basic authentication
information or details about your SMTP email service. You can encrypt this
data by generating a key and adding some secure settings on each node in your
cluster.

Every `password` field that is used in your watch within a HTTP basic
authentication block - for example within a webhook, a HTTP input or when using
the reporting email attachment - will not be stored as plain text anymore. Also
be aware, that there is no way to configure your own fields in a watch to be
encrypted.

To encrypt sensitive data in {watcher}:

. Use the {ref}/syskeygen.html[elasticsearch-syskeygen] command to create a system key file.

. Copy the `system_key` file to all of the nodes in your cluster.
+
--
IMPORTANT: The system key is a symmetric key, so the same key must be used on
every node in the cluster.

--

. Set the
{ref}/notification-settings.html[`xpack.watcher.encrypt_sensitive_data` setting]:
+
--

[source,sh]
----------------------------------------------------------------
xpack.watcher.encrypt_sensitive_data: true
----------------------------------------------------------------
--

. Set the
{'fraction_non_alphanumeric': 0.1751111111111111, 'fraction_numerical': 0.0022222222222222222, 'mean_word_length': 2.5673534072900157, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1362740', 'n_tokens_mistral': 578, 'n_tokens_neox': 566, 'n_words': 270}