Create and manage identification rules

Limitations

By default, automatic scans that use identification rules do not scan views. You can enable view scanning in the rule run configuration. Alternatively, you can manually add or batch import identification results for views.

Permissions

• A security administrator or a user with a custom global role that includes the Identification Rule-Manage permission can create and manage identification rules.

• You can only manage the rules that you own. Management tasks include editing, deleting, resetting, testing, transferring, and manually running identification rules, as well as enabling or disabling them.

Notes

By default, MaxCompute tables use MaxCompute Tunnel to accelerate scans, which improves identification speed and reduces costs. In scenarios where Tunnel is not supported, standard SQL is used for security identification.

Create an identification rule

1. In the top navigation bar of the Dataphin homepage, choose Governance > Data Security.

2. In the left-side navigation pane, choose Data Discovery > Identification Rule. On the Identification Rule page, click Create Identification Rule.

3. In the Create Identification Rule dialog box, configure the parameters.

   Parameter	Description
   Basic Settings
   Rule name	The name of the identification rule. Naming conventions: Can contain Chinese characters, letters, digits, and underscores (_). Must be 12 characters or less.
   Rule description	A custom description for the rule, up to 128 characters long.
   Data Classification and Security Level
   Data category	Select data categories from the data classification catalog. You can choose from the following options: All Categories: All active data categories in the current tenant. All Categories in a Specified Directory: All active data categories within the specified directory and its subdirectories. Specified Data Categories: Filters active data categories within the current directory and its subdirectories based on the parent directory. To add more categories, click Add a Category Group. Note Content-based identification is not supported when the compute engine is Aliyun EMR Serverless Spark and the field type is HyperLogLog (HLL).
   Scan Scope
   Data source	Select the asset scope for the identification rule scan. You can choose Compute Engine or Data Source. Compute Engine: Select Dataphin tables under a data domain or project. Data Source: Select only data sources that have a configured metadata collection task. For a list of supported data sources, see Supported data sources in Dataphin.
   Compute engine table scan scope	This option is available when Data Source is set to Compute Engine. The logical operators AND and OR are supported. Discovery types include Data Domain, Project, and Data Table. Conditions include All, Belongs to, Does not belong to, Contains, Does not contain, Regex (Case-Insensitive), and Regular Expression. All: Selects the entire scope within the current Dataphin instance. Belongs to/Does not belong to: Select multiple specific resources. Contains/Does not contain: Matches keywords. For example, to match user information tables, enter user_info. Regex (Case-Insensitive): Enter a regular expression. For example, to match all names containing "test", use the expression .*test.*. Regular Expression: Enter a regular expression. For example, to match all names containing "test", use the expression .*test.*. Note You can configure a maximum of 5 scan scope rules, with a nesting depth of up to 2 levels. You can select up to 100 objects for Data Domain and Project.
   Data source table scan scope	This option is available when Data Source is set to Data Source. Data Source: Select one or more data sources to scan. Data Scope: Choose between All Tables and Specified Tables. If you select Specified Tables, you can configure filter conditions based on Full Table Name, Asset Inventory Tag, Table Description, or DB/Schema to refine the asset selection. You can configure up to 10 filter conditions with AND/OR logic. Full Table Name/Table Description/DB/Schema: Supported filter conditions are Prefix Match, Suffix Match, Contains (only for Table Description), and Belongs to (only for DB/Schema). Prefix Match, Suffix Match, Contains: Supports up to 256 characters. Belongs to: Select asset objects of the corresponding type from the current asset source. You can select up to 500 assets. Asset Inventory Tag: Supported filter conditions are Contains Any and Contains All. Contains Any: The asset must have at least one of the selected tag values. Contains All: The asset must have all of the selected tag values.

4. Click OK to create the identification rule.

   After the rule is created, a new identification rule appears in the identification rule list. The rule is enabled by default. Starting the next day, Dataphin automatically scans data at the scheduled time in the rule run configuration.

Identification rule list

1. The identification rule list displays the Rule Name, Data Category, Owner, Update Time, and Enabled status for each identification rule. You can click the Description button to view information about identification rules, data sampling, identification results, and result management.

2. You can perform a quick search by keyword in the rule name or use filters such as Data Category, Owner, and Owned by Me for precise filtering.

3. You can perform the following operations on an identification rule.

   Actions	Description
   Enabled	Turn on the switch in the Enabled column to have the identification rule automatically run and generate execution records based on its configured schedule and real-time scan settings. If the switch is off, you can manually trigger the rule for a specific scope based on your business needs. Note Previously generated identification results are not affected when a rule is disabled.
   Reset	Click Reset in the Actions column or at the bottom of the page. Resetting a rule clears all existing labels from data within its scan scope and then reruns the identification process to generate new results.
   View Details	Click View Details in the Actions column to see the configuration details of the identification rule.
   Edit	Click Edit in the Actions column to modify the identification rule.
   Run Manually	Click the More icon in the Actions column and select Run Manually, or click Run Manually at the bottom of the page to run the selected rule. If the auto-inheritance configuration for data lineage is enabled, identification results can be automatically inherited. For more details, see Description of data lineage-based inheritance. When you manually run multiple identification rules in a batch, you can run them regardless of their enabled status. The supported execution scopes are All Rules (Including Inactive Rules) and Active Rules Only.
   Copy	Click Copy in the Actions column to quickly duplicate an identification rule, which is equivalent to cloning it.
   Transfer	Click the More icon in the Actions column and select Transfer, or click Transfer at the bottom of the page, to transfer ownership of an identification rule. Select the new owner and click OK. Identification rules can only be transferred to a security administrator.
   Delete	Click the More icon in the Actions column and select Delete, or click Delete at the bottom of the page. Deleting a rule does not remove its run history. However, it removes all data classification labels that the rule had applied to the data. This change takes effect the next day.
   Test	When testing, you can specify a project, data source, or table. The selected identification rule is then applied to classify and label assets only within that specified scope. In a default test without a specified scope, the rule is applied to a sample of data extracted from its configured scan scope. Click Test at the bottom of the page and select the projects, data sources, or data tables to test. You can select up to 10 projects or 10 tables. After the test is complete, click View Test Results to see the details. Note A test only displays results from sample data; it does not apply actual labels. Test runs consume computing resources because they scan and compute data. Execution time depends on the number and complexity of the rules in the selected scope. A test evaluates only a single rule. An actual scan, however, evaluates multiple rules and uses priority to determine the final result. Therefore, test results may differ from actual scan results.

Manual rule scans

1. On the Identification Rule page, click Manual Rule Scan to open the Manual Rule Scan dialog box.

2. In the Manual Rule Scan dialog box, configure the parameters.

   Parameter	Description
   Scan scope	Select the scan scope for identification rules by using Full Database Scan, Specified Project Scan, Specified Data Source Scan, or Specified Table Scan. Full Database Scan: Use this option when you need to immediately run all identification rules in Dataphin to scan data. Specified Project Scan: Select the projects to scan. Use this option when you need to immediately run all identification rules within specific projects to scan data. Specified Data Source Scan: Select the data sources to scan. Use this option when you need to immediately run all identification rules within specific data sources to scan data. Specified Table Scan: Select the data tables to scan within a project or data source, up to a maximum of 10 tables. Use this option when you need to immediately run all identification rules on specific tables.
   Rule execution scope	Select the execution scope for the rules. Options include Active Rules Only and All Rules (Including Inactive Rules). Active Rules Only: Includes all identification rules in Dataphin that are currently enabled. All Rules (Including Inactive Rules): Includes all identification rules in Dataphin, regardless of their enabled status.

   Note

   • You must first enable auto-inheritance in the Auto-inheritance Configuration and select the Triggered by Rule Execution scenario. For more information, see Auto-inheritance Configuration.

   • If enabled, a manual scan causes downstream fields to automatically inherit the sensitivity level from their direct upstream fields via data lineage. This improves scan coverage and consistency. If disabled, this automatic inheritance does not occur.

   • Enabling auto-inheritance expands the scan scope and may consume additional computing resources. Configure this feature based on your actual business needs.

3. Click OK to trigger the scan on the selected assets.

   You can go to the Run History page to view the progress. The scan time varies depending on the size of the selected data, so the process may take some time to complete.

Next steps

• After you create an identification rule, you can adjust its scan method based on your business needs. For more information, see Identification Rule Run Configuration and Manually trigger identification rules. You can also enable auto-inheritance. For more information, see Auto-inheritance Configuration.

• You can view the sensitive data discovered by the identification rule scan in the run history list. For more information, see Manage Identification Results.