Set Up the Sensitive Data Classifier

This page walks through setting up the Sensitive Data Classifier from scratch. By the end you will have a scanning group that masks credit card numbers and email addresses in your logs, and you will know how to confirm it is working.

If you have not read Sensitive Data Classifier Overview yet, start there for the concepts.

Before you begin

You need:

• An Atatus account with log data already flowing. See Logs Monitoring if you have not set up log collection yet.
• Admin or Owner access to the account, since scanning rules apply to everyone's data.

Step 1: Create a scanning group

A scanning group decides which traffic gets scanned. Rules only run inside a group, so this comes first.

1. Go to Security and open Sensitive Data Classifier.
2. Select Add Scanning Group.
3. Give the group a Name and an optional Description. Pick something that describes the traffic, for example Payment service logs.
4. Under Filters, add a query to narrow what the group sees. Leave it empty to scan all of your logs.
5. Set the Scanning Method for Logs to 100% or Sample. Leaving it on None means the group scans nothing.
6. Save the group.

See Scanning Groups for what each field does in detail.

Step 2: Add rules to the group

A group with no rules does nothing. Add rules from the built-in library, write your own, or both.

To add library rules:

1. Open the group and select Add Rule.
2. Choose Library Rules.
3. Select the rules you want. For a first pass, the credit card and email rules give quick, obvious results.
4. Choose a Priority. This is a label you set for triage, from Info through Critical. It does not change how matching works.
5. Choose a Match Action. Start with No Action if you want to see what matches before you mask anything.
6. Save the rules.

To write your own rule, choose Custom Rule instead and follow Custom Rules.

Step 3: Enable the rules and the group

This is the step people miss. New scanning groups and new rules are both created in a disabled state, and nothing is scanned until both are turned on.

1. Turn on the toggle for each rule you want active.
2. Turn on the toggle for the group itself.

Step 4: Confirm it is working

Send some traffic that should match, then check that it was scanned.

1. Open Logs and search for events carrying the sensitive data tags:

   @sensitive_data:*
   

2. Narrow to a category to confirm a specific rule fired:

   @sensitive_data_category:credit_card
   

3. Open a matching event and check that the value shows your replacement text, a hash, or a partial mask, depending on the action you chose.

You can also use the Sensitive Data and SDC Category facets in the logs sidebar instead of typing a query. See Investigate Sensitive Data for the full search reference, and Logs Search Syntax for how queries are built.

Roll out to production safely

A staged rollout avoids masking something you needed:

1. Create the group with No Action rules and a Sample scanning method.
2. Watch the @sensitive_data tags for a day and check what matched. Look for false positives, such as an order ID that looks like a card number.
3. Tighten the rules with included and excluded keywords. See Keywords and proximity.
4. Switch the action to Redact, Partially Redact, or Hash.
5. Raise the scanning method to 100%.

Turn scanning off

To stop scanning without losing your configuration, turn off the group toggle. The rules and their settings are kept.