Identification rules and scan methods

Prerequisites

You have created identification rules. For more information, see Create and manage identification rules.

Limitations

By default, automated scans do not include views. You can enable scanning for views in the rule run configuration. You can also manually add or bulk import identification results for views.

Permissions

Users with the security administrator role can create and manage identification rules, modify rule run configurations, and enable auto-inheritance configurations.

Rule run configuration

1. On the Dataphin homepage, choose Governance > Data Security from the top navigation bar.

2. In the left-side navigation pane, choose Data Identification > Identification Rules. On the Identification Rules page, click the drop-down arrow next to New Identification Rule and select Rule Run Configuration.

3. In the Rule run configuration dialog box, configure the parameters.

   Parameter		Description
   Effective mode	Automatic application of identification results	This feature is Enabled by default. When Enabled, identification results generated by identification rules and results automatically inherited based on data lineage take effect immediately without manual intervention. This is suitable for high-trust scenarios to improve efficiency. When Disabled, if an identification result is inconsistent with an existing result, the system adds the discrepancy to the Pending list on the Identification Result page. The result takes effect only after you manually confirm and apply it. This is suitable for sensitive scenarios that require high data accuracy. For more information, see Add and manage identification results. If a new identification result is identical to an existing one (same field source, data classification, and data sensitivity level), it is applied automatically, regardless of this setting.
   Scan configuration	Scheduling cycle	By default, identification rules are scheduled to run once per day. You can adjust the scheduling cycle based on your business needs. A longer cycle can reduce resource consumption but may delay the identification of sensitive data. You can set the scheduling cycle to Day, Week, or Month. If the system time zone (the time zone in your user center) differs from the scheduling time zone (configured in Management Center > System Settings > Basic Settings), the rules run based on the system time zone.
   	Real-time scan for compute source tables	By default, this feature is Disabled. When Enabled, a scan is triggered whenever a new table is created, a table's structure changes (field added, field renamed, or table renamed), or table data is modified through insert, delete, or update operations in Dataphin. The scan identifies and tags sensitive fields. Note Enabling real-time scanning enables quicker discovery and protection of sensitive data but may increase computing resource consumption. Evaluate your needs before enabling it. Real-time scanning is not supported for data source tables.
   	Scan scope	Select the scan scope for the identification rules. By default, Filter out views is selected. You can switch to Include views. Note This setting does not affect identification results that are added manually or through bulk import. You can still add results for views directly. If you select to include views, both rule-based automatic scanning and data lineage-based auto-inheritance will apply data classification and data sensitivity level tags to views. Views include physical views, logical views, data source views, data source materialized views, and materialized views.
   	Concurrency limit	Controls the total number of identification tasks that can run simultaneously across the platform. The default is 16, and you can set it to any integer from 1 to 100. This limit applies to tasks from both the Data Standard and asset security modules. These include mapping tasks that use intelligent matching, as well as scheduled, manual, real-time, and data lineage-triggered scans. Note This setting applies only when automatically triggered sampling queries are disabled. A higher concurrency limit speeds up scanning but will consume more cluster computing resources. Configure this setting carefully based on your business needs to ensure system stability.
   Sampling configuration Note These settings apply to both automatic sampling and temporary sampling queries that are triggered for content-based identification when automatic sampling is disabled.	Automatic sampling	This is enabled if data sampling is turned on in Governance > Metadata > Sampling Configuration and the trigger scenario is set to security identification rule execution or standard mapping rule execution. Otherwise, it is disabled. When enabled, Dataphin performs automatic data sampling based on the settings in Metadata-Sampling Configuration. When an identification rule runs, the system first checks for existing sample values. If none exist, it performs data sampling according to the automatic sampling update policy. Note Enable this setting when security identification rules require content-based identification or when the Data Standard module is configured for intelligent mapping based on identification features. This helps prevent data staleness and avoids the extra resource consumption caused by temporary data queries. When automatic sampling is enabled, data sampling tasks are automatically triggered for data source tables.
   	Query space for compute source tables	When sample data is unavailable and a temporary query is needed for content-based identification, you must select a compute source to run the query. You can change this setting in Governance > Metadata > Sampling Configuration > Compute Source. Note Temporary data queries consume computing resources. Typically, you can select the project where the data table resides. To reduce resource pressure and query costs on your primary project, for example, by using a separate subscription project, you can allocate a dedicated project or queue for these queries. This helps avoid interference with your regular business tasks. Ensure that the account configured for the selected compute source has read permissions for the relevant data tables. Temporary query tasks for data source tables can only run within their respective data source.
   	Scan disablement period	During the specified time period, the system prevents automatically triggered data sampling queries from running and marks them as failed. This prevents these queries from consuming excessive computing resources that could affect your production environment, ensuring the stability of online data tasks. You can change this setting in Governance > Metadata > Sampling Configuration > Compute Source.

   Note

   • The concurrency limit, scan disablement period, sampling configuration, and resource configuration settings here are shared with the feature scan settings in the Data Standard module. Any change you make here also applies to the other location.

   • Global feature identification tasks include those from both the Data Standard and asset security modules:

     • Data Standard: Mapping rule tasks that use intelligent matching based on identification features (both manual and scheduled rules).

     • Asset Security: All scan tasks, including scheduled, manual, real-time, and data lineage-based inheritance tasks.

4. Click OK to save the rule run configuration.

Auto-inheritance configuration

1. On the Identification Rules page, click the Auto-inheritance Configuration button.

2. In the Auto-inheritance configuration based on data lineage dialog box, configure the parameters.

   Parameter	Description
   Auto-inheritance	Disabled by default. When enabled, you can configure scenarios and rules for data lineage-based auto-inheritance. Note When auto-inheritance is enabled, it inherits only from direct data lineage. Downstream fields automatically inherit the sensitivity level of their direct upstream fields based on field-level data lineage. Dataphin also applies data masking based on the default data masking policy. This automatically protects new data, reduces manual configuration, and improves consistency across related identification results.
   Inheritance rules	If a field has a single upstream source, you can choose Inherit Classification + Level or Inherit Only Level, Not Classification. Inherit Classification + Level: Enables more precise application of data masking rules to the field. Inherit Only Level, Not Classification: Inherits the data sensitivity level from the direct upstream field. You can manually specify the data classification later in the identification results. If a field has multiple upstream sources, you can choose Inherit Only the Highest Level, Not Classification or Inherit the Highest Level + Classification from the Field with the Highest Level. Inherit Only the Highest Level, Not Classification: Inherits the highest data sensitivity level among all direct upstream fields. You can manually specify the data classification later. Inherit the Highest Level + Classification from the Field with the Highest Level: If multiple fields have the same highest data sensitivity level but different classifications, the final data classification is determined by the following priority: classification priority > update time of the identification result > modification time of the classification.
   Trigger scenarios	You can select Identification Rule Execution or Data Lineage Update. Identification Rule Execution: For the direct downstream fields of the scanned items, Dataphin calculates inheritance results based on the scan results of the current run. Note Each time an identification rule runs, it queries the downstream fields of the targeted objects based on field-level data lineage and generates auto-inheritance results according to the configured rules. If the upstream field changes but the resulting data classification and data sensitivity level remain the same, the source field for the inherited result is updated. If a new classification and level are generated, a new result is created. Data Lineage Update: For each output field whose lineage is updated, Dataphin calculates the inheritance result based on its input fields. Note Each time a task is submitted to the development environment or published to the production environment, the system queries the input tables of the output table to get the field-level data lineage and generates auto-inheritance results according to the configured rules. If the upstream field changes but the resulting data classification and data sensitivity level remain the same, the source field for the inherited result is updated. If a new classification and level are generated, a new result is created. You must select at least one trigger scenario.

   Note

   • For identification results without a specified data classification, you can manually select the appropriate one based on the inheritance source. Configure a default data masking policy to ensure that data with an inherited data sensitivity level is properly masked, enhancing data security.

   • The final identification result is determined by the following order of precedence (highest to lowest): Manual Action > Automated Identification > Automated Lineage Inheritance.

3. Click OK to save the auto-inheritance configuration.