A scanning rule defines what the Sensitive Data Classifier looks for and what it does when it finds a match. Rules live inside a scanning group, which decides which logs the rule sees.

This page is the reference for every rule setting. To write your own pattern, see Custom Rules.

Library rules and custom rules

There are two kinds of rule:

  • Library rules are maintained by Atatus and cover common formats such as payment cards, email addresses, and authentication tokens. You pick them from a list and choose an action. The regular expression is managed for you and is not editable. See Library Rules for the full catalog.
  • Custom rules use a regular expression you supply, for patterns that are specific to your business such as an internal account number.

You select which kind you are adding at the top of the rule form.

1. Rule settings

Field Description
Scanning group Required. The group this rule belongs to. A rule belongs to exactly one group.
Rule Name The name shown in the rule list. Library rules are named for you. Required for custom rules.
Priority A triage label: Info, Low, Medium, High, or Critical. It does not affect matching or the order rules run in. Use it to signal how serious a match is when you are reviewing findings.

2. Match conditions

Pattern

Custom rules take a regular expression in the Define Regex Pattern field. The form validates the expression as you type and shows Invalid regex pattern if it will not compile. See Custom Rules for syntax guidance and worked examples.

Library rules already carry their pattern, so this field is not shown for them.

Keywords and proximity

Keyword proximity is the single most effective way to cut false positives. A nine digit number on its own could be anything. A nine digit number sitting next to the word passport is much more likely to be a passport number.

Under Cross-check matches with nearby keywords to prevent false alerts, add the keywords that should appear near a genuine match. You can add up to 30.

Characters before match controls how far back the classifier looks for those keywords. The default is 30 characters and the maximum is 50.

Given this log line and an included keyword of card:

payment card 4111 1111 1111 1111 accepted

The word card appears within 30 characters before the number, so the match is kept. A bare number with no nearby keyword is skipped.

Note:

If you add no keywords, the pattern matches on its own with no proximity check. That is the right choice for formats that are unambiguous by themselves, such as a JSON Web Token.

Test a rule before you enable it

When you edit an existing rule, the form includes an evaluator. Paste a sample message into it and Atatus runs your rule against that text and highlights each match, along with a count such as 2 matches.

Use it to confirm two things before enabling a rule on live traffic:

  • Your pattern matches the values you expect.
  • It does not match values you want to keep, such as order IDs or timestamps.

3. Action on match

Choose what part of the event to scan

The first selector decides the scope:

Option Behavior
Entire event Scans the whole event. You can then list attributes to leave out under Add attribute(s) to exclude from scanning, up to 20.
Specific event Scans only the attributes you list under Add attribute(s) to include from scanning. Everything else is left alone.

Use Specific event when you know exactly which field carries the sensitive value, for example user_email. It is faster and far less likely to mask something unexpected. Use Entire event when sensitive values could turn up anywhere in the payload.

Choose the match action

Action What it does Extra settings
Hash Replaces values with hashed tokens. The same input always produces the same token, so you can still group and count events by it. None
Redact Replaces values with text of your choice. Replacement text, for example [sensitive_value]. Required.
Partially Redact Obscures only part of each value. Direction (Left or Right) and a character count from 1 to 16.
No Action Leaves values unchanged, but still tags the event. None

Partial redaction keeps the rest of the value readable. Masking 12 characters from the left of a card number gives you this:

1234 1234 1234 1234   ->   **** **** **** 1234

The form shows a live example of the mask as you change the direction and count.

Warning:

Hash, Redact, and Partially Redact permanently mask the matched value. Atatus never stores the original, so there is no way to reveal it later. Test with the evaluator first.

Tags

Every rule carries tags, and Atatus attaches them to any event the rule matched. Tags are how you find sensitive data later without ever seeing the value.

Tags must be key:value pairs, and both halves may contain only letters, numbers, and underscores. The form shows Invalid tag format if a tag does not fit.

Atatus uses two conventions, and it is worth following them so your custom rules line up with the library rules:

Tag Purpose
sensitive_data:<type> What was found, for example sensitive_data:visa_credit_card.
sensitive_data_category:<category> The broad grouping, for example sensitive_data_category:pii.

These become the Sensitive Data and SDC Category facets in Logs. See Investigate Sensitive Data.

Enabling a rule

New rules are created disabled. Turn on the rule toggle, and make sure the group toggle is on too. A group with no enabled rules is skipped entirely.

Editing and deleting

You can edit any rule's action, keywords, scope, priority, and tags. For custom rules you can also edit the pattern. Library rule patterns are managed by Atatus and are not editable, so if you need a variation, copy the idea into a custom rule.

Deleting a rule removes it from its group. Deleting the group deletes all of its rules.

Next steps

  • Library Rules lists all 35 built-in rules with their tags and default priorities.
  • Custom Rules covers writing your own patterns.