A scanning group decides what the Sensitive Data Classifier looks at. Rules decide what to look for, and every rule belongs to exactly one group. This page covers each group setting and how groups interact.

Anatomy of a scanning group

The group form has two steps.

1. Describe the scanning group

Field Description
Filter for telemetry Data Narrows the logs the group sees. Enter space separated key:value pairs. Leave it empty to scan all of your logs.
Scanning group name Required. Shown in the group list and in rule assignment, so make it descriptive.
Description Optional note about what this group covers and why.

2. Telemetry to scan

Pick a scanning method for Logs and, if sampling, a rate:

Column Description
Type The product being scanned. Logs today.
Scanning Method None, Sample, or 100%.
Sampling Rate Only used when the method is Sample. Accepts 10 to 90 percent.
Note:

Logs is the only product available for scanning today. Support for APM spans and API analytics is planned, and this page will be updated when they are available.

Filters

The filter query restricts a group to a subset of your logs. It is made up of space separated key:value pairs, and a log event has to match for the group's rules to run against it.

Filtering is worth using when:

  • Only some services log regulated data, and scanning everything would be wasteful.
  • You want different match actions for different environments, for example redact in production and no action in staging.
  • You are rolling a new rule out to one service before applying it everywhere.
Note:

An empty filter means the group sees all of your log traffic. That is the right default for a broad rule such as credit card detection, where you do not want a gap in coverage.

Sampling

Sampling limits how much of the matched traffic is actually scanned. It is a tuning and cost control, not a security control.

  • 100% scans everything the group sees. Use this for any rule you rely on for compliance.
  • Sample scans the given percentage, between 10 and 90.
  • None removes Logs from the group, so the group scans nothing.
Warning:

Do not leave a compliance rule on Sample. At a 50% sampling rate, half of the events containing a credit card number are stored unmasked. Use Sample while you are tuning a rule, then move it to 100%.

Group order

Groups are evaluated in the order they appear in the list, and you can drag them to reorder. Order matters when more than one group could act on the same event, since an earlier group's match action changes the text that later groups see.

A practical pattern is to put narrow, high confidence groups first and broad catch-all groups last.

Enabling and disabling

Both the group and its individual rules have their own enabled state, and both are off when first created.

State Result
Group enabled, at least one rule enabled The group scans logs. Only the enabled rules run.
Group enabled, no rules enabled The group is skipped entirely.
Group disabled Nothing in the group runs, whatever the rules say.

Disabling a group is the clean way to pause scanning. Your rules, filters, and sampling settings are all kept.

Deleting a group

Deleting a scanning group deletes every rule inside it. Custom rules you wrote are removed along with the group and cannot be recovered.

Warning:

If you want to keep your custom rules, move them to another group before deleting this one, or disable the group instead of deleting it.

When configuration takes effect

Changes to groups and rules apply to newly received logs. Already stored events are not rescanned, so data that arrived before you enabled a rule stays as it was received.

Next steps