Library Rules

Library rules are the built-in patterns that Atatus maintains for you. They cover formats that are the same for everyone, such as payment card numbers and email addresses, so you do not have to write and maintain the regular expressions yourself.

To use one, open a scanning group, select Add Rule, choose Library Rules, and pick the rules you want. You then choose the match action and any extra tags.

What is included

There are 35 library rules across four categories:

Why there are several rules per card brand

Card numbers appear in different groupings depending on how the application formatted them. A Visa number might arrive as 4111111111111111, 4111 1111 1111 1111, or 41111111 11111111. Each grouping needs its own pattern, which is why you see rules such as Visa Card Scanner (4x4 digits) and Visa Card Scanner (2x8 digits).

Enable every variant for a brand you care about. Enabling only one leaves the other formats unmasked.

Rule catalog

The Priority column is the default triage label Atatus assigns to each rule. You can change it when you add the rule to a group.

Personally identifiable information

Credit card and banking

Secrets and credentials

Network and device information

Tags applied by library rules

Every library rule attaches two tags to a matched event:

• sensitive_data:<type> records what was found, for example sensitive_data:visa_credit_card.
• sensitive_data_category:<category> records the broad grouping, for example sensitive_data_category:credit_card.

You can add your own tags on top when you add the rule, which is useful for routing findings to a team or a compliance program.

These tags become the Sensitive Data and SDC Category facets in Logs. See Investigate Sensitive Data for how to search and alert on them.

Next steps

• Scanning Rules explains actions, keywords, and scoping.
• Custom Rules covers patterns the library does not include.