Add and manage identification results-Dataphin(Dataphin)-阿里云帮助中心

Dataphin automatically generates identification results based on the configured identification rules and data lineage-based inheritance settings. You can also manually specify identification results or batch import them from an Excel file.

Limitations

Data source tables do not support automatic identification through rule-based scans or data lineage-based inheritance. Therefore, you must add or batch import their identification results manually.

Permissions

A security administrator or custom global roles with the Manage permission for identification results can add and manage all identification results.
A project administrator can manage identification results for tables in the projects they own. This includes creating and editing identification results, enabling or disabling the masking status, and locking identification rules.
A data table owner can manage identification results for the tables they own. This includes editing identification results, enabling or disabling the masking status, and locking identification rules.

Identification methods

Automatic scanning: Generates identification results based on the scheduled scan time and real-time scan settings in the rule execution configuration.
Manual addition: Allows you to batch import identification results into Dataphin.
Data lineage-based inheritance: Downstream fields automatically inherit identification results from their direct upstream fields based on specific inheritance scenarios and rules.

Manually add an identification result

In the top navigation bar of the Dataphin homepage, choose Governance > Data Security.
In the left-side navigation pane, choose Data Discovery > Identification Result. On the Identification Result page, click Manual Add.

On the Manual Add page, configure the parameters.

Parameter

Description

Adding policy

Deduplication policy

Specifies the policy for handling conflicts between the current upload and existing online identification records. The following options are available: Overwrite existing identification results, Overwrite existing automatic identification results only, and Retain existing identification results and do not update.

Overwrite existing identification results: If a new field matches an existing online field, the system uses the identification result from this upload and marks it as manually specified.
Overwrite existing automatic identification results only: If a new field matches an existing online field and the online identification result is not locked, the system uses the identification result from this upload and marks it as manually specified.
Retain existing identification results and do not update: If a new field matches an existing online field, the system retains the existing online identification result, and the new identification result does not take effect.

Added records

Add by table: Click Add by Table. In the Add by Table dialog box, configure the parameters and click OK.
- Table: Select up to 200 data tables. A project administrator can select all data tables within their projects. A domain architect can select all tables within their domains. A data table owner can select tables they own.
  Filtering is available only in the Intelligent R&D Edition. You can click the Filter icon to filter data tables by domain, project, data source, or table type.
- Table field: Select up to 200 fields from the chosen data tables.
- Configure unified category: Disabled by default. If enabled, you can apply a single data category to all selected fields. You can modify this setting later in the added records list.
Search: Quickly search for added data tables by name or description. The description field is available for data source tables only.
Added records list: Displays information about the data table, table fields, data category, data sensitivity level, and masking status. You can modify the data table, table fields, data category, and masking status. In the Actions column, you can select Continue to Configure Field Identification Rules in This Table or Delete.
- Masking status: Changes to the masking status take effect immediately. When enabled, the identification result enters downstream workflows such as display, statistics, and data masking. When disabled, the identification result for the field is not applied.
- Continue to configure field identification rules in this table: Allows you to add new fields and configure their data categories within the current table.
- Delete: Deletes the currently added data table.
Batch operations: Allows you to perform batch operations on the added data tables, such as Change data category, modify Masking Status, and Delete.

After you confirm that the information is correct, click Upload.

Manage identification results

The identification results page contains effective identification results, which are generated by running identification rules or through data lineage-based inheritance, and pending identification results, which require manual confirmation because they differ from existing online results.

Effective

The list of effective identification results displays details for each added result, including table name, field, asset source, data category, data sensitivity level, masking status, and identification method.
Asset source: For a Dataphin table, this section shows its project and domain. For a data source table, it shows its Database/Schema and data source.
You can find assets by using different criteria. You can also search for identification results by data category keyword.
- Dataphin table: You can perform a quick search by using keywords for the table, field, or its associated project or domain. You can also perform a precise search by data category (or unspecified category), data sensitivity level, data domain, project, masking status, lock status, or identification method.
- Data source table: You can perform a quick search by using keywords for the table, Database/Schema, or table description. You can also perform a precise search by data category (or unspecified category), data sensitivity level, data source, masking status, lock status, or identification method.

You can perform the following operations on a target identification result.

Actions	Description
Enable or disable masking status	The masking status controls whether the current identification result is subject to a masking policy. You can toggle the switch in the masking status column or click More > Enable Masking or Disable Masking to change the status. The change takes effect immediately. When enabled, the system applies data masking to the field based on masking rules and the default masking policy. When disabled, the field is not masked even if it is matched by a masking rule. However, a corresponding identification record is still generated, and a permission approval workflow is routed based on match score arbitration.
Identification result recommendation prompts	If an identification record for the current field has a higher match score than the currently effective result, a Recommended tag appears. You can click the Recommended tag next to the data category name or click View Identification Details in the Actions column. This opens a dialog box where you can review the recommended result and decide whether to apply it.
View identification details	Displays the basic information, effective result, and identification records for the field. Basic information: Displays the table name, field name, and sample data. To view sample data, the data sampling switch must be enabled. Effective result: Displays the effective data category for the field and its corresponding data sensitivity level, identification method, priority, actual match score, category modification time, and update time. You can perform the Specify data category action (if no data category is configured) or the Edit identification result action (if a data category is already configured). Data sensitivity level: Displays the latest sensitivity level configuration. You can review the level that was set at the time of arbitration to decide if a change is needed. Priority: Displays the latest priority configuration. You can review the priority that was set at the time of arbitration to decide if a change is needed. Priority 1 is the highest. For rules with the same priority, the one with the more recent update time takes precedence. Specify data category: An effective result might not have a specified data category if it was inherited and the inheritance policy was set to inherit only the sensitivity level, not the category. In this case, you should specify a data category; otherwise, the field may not be matched by masking rules. In the Specify Data Category dialog box, select a data category. You can also use the system-recommended data category. Note The data sensitivity level of the specified category must be the same as the currently effective data sensitivity level. If they are different, you cannot specify the category directly. You must use the Edit identification result action to change the data category. Edit identification result: Allows you to modify the effective identification result. For more information, see Edit an identification result. Identification records: Displays the data category, data sensitivity level, identification method, priority, actual match score, category modification time, and update time. If an identification record for the current field has a higher match score than the currently effective result, a recommendation icon appears in the upper-left corner of the data category name. You can click One-click Modification in the upper-right corner to set it as the effective identification result. Priority of identification results: For automatically identified results, the scan rule priority is ordered as follows: data category priority > data sensitivity level > update time > match score > data category modification time. If a more suitable data category is detected, the system displays a prompt. For automatically inherited results, the rule with the highest data sensitivity level has the highest priority. If multiple results have the same data sensitivity level but different data categories, the priority is ordered as follows: data category priority > identification record update time > category modification time. If a more suitable data category is detected, the system displays a prompt. Data sensitivity level: Displays the latest sensitivity level configuration. You can review the level that was set at the time of arbitration to decide if a change is needed. Priority: Displays the latest priority configuration. You can review the priority that was set at the time of arbitration to decide if a change is needed. Priority 1 is the highest. For rules with the same priority, the one with the more recent update time takes precedence. Set as effective result: If you set a data category from the identification records as the effective result, the identification method changes to manual specification. This result is no longer affected by subsequent automatic identification results.
Edit identification result	Click Edit in the Actions column or click Edit at the bottom of the page to modify an identification result. You can choose between Automatic identification/inheritance and Manual specification. Automatic identification/inheritance: If you select this option, any existing manually specified identification result for the field is deleted. The identification result is changed to an automatically identified or inherited result with a higher match score. If a result with an even higher match score appears later, the identification result for the field will change. Note When you batch modify results to use automatic identification, the system automatically skips data source tables because they do not support this feature. Manual specification: If you select this option, the selected data category is locked, and a lock icon automatically appears in the list. The result is no longer affected by other automatic identification or inheritance results. You can also use the system-recommended data category. Sync and enable masking status: If you select this checkbox, the current identification result is set as the effective result, and its masking status is enabled.
Lock the current identification result	Click Lock in the Actions column or click Lock at the bottom of the page to lock the identification result. You can only lock results that are effective, use an automatic identification or automatic inheritance method, and have a specified category. After locking, the system generates a manually specified identification record that matches the current result and sets it as the effective result. This result is no longer affected by subsequent automatic identification or automatic inheritance results.
Delete the identification result	Click Delete in the Actions column or click More > Delete at the bottom of the page to delete the identification result. This action also deletes all associated identification records. To generate new results, you can either modify the incorrect ones or adjust the identification rules and rescan.

Pending

Note

Identification results from rule execution or data lineage-based inheritance are added to the Pending list only if the Automatically Apply Identification Results option is disabled in the rule execution configuration.
If a newly generated identification result is identical to an existing online result (meaning the field source, data category, and data sensitivity level are all the same), the system automatically applies it, and it does not appear in the Pending list.
If a field has both an automatically identified result and an automatically inherited result, the Pending list prioritizes and displays the automatically identified result.

The Pending list displays information such as table, field, asset source, data category, data sensitivity level, and identification method.
Asset source: For a Dataphin table, this section shows its project and domain. For a data source table, it shows its Database/Schema and data source.
You can find asset objects by using different criteria. You can also click Refresh Identification to sync the latest pending identification results.
- Dataphin table: You can perform a quick search by using keywords for the table, field, or its associated project or domain. You can also search for all identification results associated with a specific data category by using keywords. In addition, you can perform a precise search by data category (or unspecified category), data sensitivity level, data domain, project, or identification method.
- Data source table: You can perform a quick search by using keywords for the table, Database/Schema, or table description. You can also search for all identification results associated with a specific data category by using keywords. In addition, you can perform a precise search by data category (or unspecified category), data sensitivity level, data source, or identification method.

You can perform the following operations on a target pending identification result.

Actions	Description
View identification details	Click View Identification Details in the Actions column to view the basic information, pending result, effective result, and expired identification records for the field. Basic information: Displays the table name, field name, and sample data. To view sample data, the data sampling switch must be enabled. Pending result: Displays the pending data category, data sensitivity level, and identification method for the current field. Effective result: Displays the effective data category for the field and its corresponding data sensitivity level, identification method, priority, actual match score, category modification time, and update time. Expired identification records: Displays the expired identification records for the current field. If multiple identification results are generated for the same field, only the most recent one appears in the Pending list. Previous results are marked as expired. If a field has both an automatically identified result and an automatically inherited result, only the automatically identified result appears in the Pending list due to its higher priority. The automatically inherited result is marked as expired.
Apply	Click Apply in the Actions column or select multiple records and click Apply at the bottom of the page to apply the pending identification results. If the selected identification result does not have any pending data lineage-based inheritance results for downstream fields, click OK in the Prompt dialog box to complete the action. If the selected identification result has pending data lineage-based inheritance results for downstream fields, the Prompt dialog box displays these results, including table, field, asset source, inherited field, inherited category, and inherited sensitivity level. Cancel: Cancels the apply operation. Apply to selected fields only: Applies the identification result only to the selected fields. The data lineage-based inheritance results in the dialog box will not be applied. Apply all: Applies the results for the selected fields and all their data lineage-based inheritance results shown in the dialog box. Note When you apply changes in a batch, if all selected identification results have downstream data lineage-based inheritance results, the dialog box displays all of them. The inherited field column helps distinguish the source of each result.
Discard	Click Discard in the Actions column or select multiple records and click Discard at the bottom of the page. In the Prompt dialog box, click OK to discard the selected identification results. Discarded results will not be applied and will not be moved to the Effective list. To help you confirm the scope of this action, the dialog box also displays any pending, inherited results for direct downstream fields.
Modify	Click Modify in the Actions column or select multiple records and click Modify at the bottom of the page to change the data category of a pending identification result. Modify single record: In the Modify Identification Result dialog box, change the data category and click OK. Batch modify: In the Batch Modify Identification Result dialog box, you can view the selected identification results, including table, field, data source, and category information. Select a data category and click OK to apply the specified data category to all selected fields.

Batch import identification results

On the Identification Result page, click Batch Import to open the Batch Import Identification Results dialog box.

In the Batch Import Identification Results dialog box, configure the parameters.

Parameter

Description

Download template

Click the file name to download the appropriate .xlsx template for your asset type. If you already have a template, you can proceed to upload it.

Configuration file

Upload the appropriate template based on the asset type. For data source tables, you must collect the relevant assets first. You can upload only one file at a time.

Only .xlsx files are supported. A single Excel file cannot exceed 1,000 rows.
The file size cannot exceed 10 MB.
Follow the instructions in the template.
- Dataphin table full name: For a physical table, enter ProjectName.TableName. For a logical table, enter DomainName.TableName.
- Data source table full name: Enter db/schema.TableName under the specified data source.
You can only add or modify identification results for which you have management permissions.
A security administrator or a custom global role with the Manage permission for identification results can upload all tables. A project administrator can upload only tables in the projects they own. A data table owner can upload only the tables they own.

After uploading the file, it undergoes an initial format validation. After it passes, click Start Validation to perform a detailed validation based on the asset type.
- Dataphin table: Verifies that the table full name, field name, and category directory/data category fields are not empty, and checks if the column order is correct.
- Data source table: Verifies that the data source name, data source environment, table full name, field name, and category directory/data category fields are not empty, and checks if the column order is correct.
- Verifies that the current operator has management permissions for the identification results.

After the validation passes, the import results page appears automatically.

Parameter

Description

Compatibility policy

Specifies the policy for handling conflicts between the current upload and existing online records. You can configure a duplicate record handling policy and a masking status policy.

Duplicate record handling: Specifies the policy for handling duplicate identification results for the same field. The options are to overwrite all online identification results, overwrite only unlocked online identification results, or retain existing online identification results and skip the update.
- Overwrite all online identification results: When a new field matches an existing online field, the system uses the new identification result to overwrite the existing one (including both automatically identified and manually specified results) and marks it as manually specified.
- Overwrite all unlocked online identification results: When a new field matches an existing online field and the online identification method is automatic, the system uses the new identification result to overwrite the existing one and marks it as manually specified. Manually specified results are not overwritten.
- Retain existing online identification results and skip the update: When a new field matches an existing online field, the system retains the existing online identification result, and the new one does not take effect.
Masking status: Specifies the policy for handling the masking status when the uploaded result or the existing online result has a disabled status. You can choose to retain the existing configuration for updated results and set the status to effective for new results, or you can set the status to effective for all new and updated results.
Note
The system does not apply data masking based on data category or sensitivity level to fields with a disabled status. However, a corresponding identification record is still generated, and a permission approval workflow is routed based on match score arbitration.

Validation result

Displays information about records that passed validation, failed validation, or are duplicates.

Passed validation: Displays the records that passed validation, including their row numbers in the original file, table, field, data category, and data sensitivity level.
Validation failed: Displays the records that failed validation. An Error Prompt column is added, which provides details to help you correct the errors and re-import the file.
Duplicate records: Displays records that are duplicates within the uploaded file or that conflict with existing successful identification results. Information includes the original row number, table, field, imported data category, online data category, and a conflict prompt.
You can click Download Validation Records to download the validation records as an Excel file.

Click Start Import to import the identification results.
After the import starts, you can close the file upload dialog box without interrupting the import task. To quickly view the import results, go to the identification result list and click Batch Operation Records to view the import history.

View import history

On the Identification Result page, click the arrow next to the Batch Import button and select Batch Operation Records to open the Import History panel.
In the Import History panel, you can view the import history of identification results.