Risk identification uses multi-dimensional association analysis and intelligent algorithms to discover risky operations, trigger alerts, and perform visualized audits. DataWorks provides built-in risk identification rules for various scenarios, and you can create custom rules based on your business needs.
Background
Data Security Guard filters data ingested into DataWorks. To help identify sensitive data across scenarios, DataWorks provides enhanced risk identification with the following benefits:
-
Ease of use
The rules cover four risk types: data access risk, data export risk, data operation risk, and other risk types. You can also combine multiple dimensions, such as Accessed At, sensitive data type, and Visits, to identify different risks.
-
High accuracy
This method compares event occurrences against a threshold within a time window to improve accuracy and reduce false positives. For example, a risk is triggered only if the same event occurs more than three times within 10 minutes.
-
Fine-grained management
You can configure risk levels as High, Medium, and Low.
-
Flexible rules
Built-in rules cover common scenarios, and you can create custom risk identification rules for your specific requirements. For more information, see Built-in risk identification rules and Create a risk identification rule.
Limitations
-
Edition requirements
-
Risk identification management is available only in DataWorks Professional Edition or later.
-
Built-in risk identification rules are available only in DataWorks Enterprise Edition.
-
-
Alerting methods
DataWorks supports only email and WebHook alerting methods.
NoteDataWorks supports WebHook URLs for DingTalk groups, WeCom, and Lark. Pushing alerts to WeCom or Lark requires Enterprise Edition.
Risk identification management
-
Go to Data Security Guard.
Log on to the DataWorks console. In the target region, click in the left-side navigation pane. On the page that appears, click Go to Security Center.
In the left-side navigation pane, click and then click Try Now to access Data Security Guard.
NoteIf your Alibaba Cloud account is already authorized, you are directed to the Data Security Guard homepage.
If your Alibaba Cloud account is not authorized, you are redirected to the Data Security Guard authorization page. To use Data Security Guard features for the first time, go to , select Data Security Guard in the pop-up dialog, and then complete the authorization.
-
Go to Risk Identification.
In the left-side navigation pane of the Data Security Guard page, click to open the risk identification page, where you can create and manage risk identification rules.
Risk identification includes built-in rules for common scenarios. You can also create custom risk identification rules. For more information, see Built-in risk identification rules and Create a risk identification rule.
Built-in risk identification rules
The following built-in rules are available.
|
Name |
Type |
Level |
Description |
|
Query large volumes of sensitive data during non-working hours |
Data access risk |
Low |
This rule triggers when the data volume queried exceeds 10,000 during the following time periods.
|
|
Similar SQL queries |
Data access risk |
Low |
This rule triggers when five or more similar SQL queries run within 10 minutes. |
|
Batch query of large volumes of sensitive data |
Data access risk |
Medium |
This rule triggers when the data volume queried in a single operation exceeds 10,000. |
|
Batch export of large volumes of sensitive data |
Data export risk |
High |
This rule triggers when the data volume exported in a single operation exceeds 10,000. |
|
Export large volumes of sensitive data during non-working hours |
Data export risk |
High |
This rule triggers when the data volume exported exceeds 10,000 during the following time periods.
|
Create a risk identification rule
-
Plan your rule and complete the prerequisites.
You can identify risky data by dimensions such as data location, data property, View User Information, and Operation Time to create more granular rules. If you plan to use subcategories of data property and View User Information to configure risk identification conditions, you must first complete the following preparations.
Risk identification dimension
Subcategory
Description
Data property
Data classification
To identify risky data at a specific level, you must define data classification levels first. For more information, see Configure sensitive data classification and levels.
Data classification
To identify risky data of a specific category, you must define data categories first. For more information, see Configure data identification rules and run identification tasks.
Sensitive column type
To identify risky data in specific sensitive columns, you must define sensitive column types first. For more information, see Configure data identification rules and run identification tasks.
View User Information
User Group
To identify risky data for a specific user group in the current Alibaba Cloud account, you must configure user groups first. For more information, see Configure user groups.
RAM Role
To identify risks related to RAM users, you must create them first. For more information, see Create a RAM user.
-
In the upper-right corner of the Risk Identification Management page, click +Risk Identification Rule.
-
In the Create Risk Identification Rule dialog box, configure the rule parameters.
NoteCurrently, you can only create Statistical Association Rules. A Statistical Association Rule performs aggregate statistics and threshold comparison for a single event. The rule is triggered when the number of events exceeds the configured threshold. For example, a rule can be triggered if a low-privilege user accesses more than 10,000 sensitive data records outside of working hours.
-
Configure the basic information for the rule.
Set the rule type to Statistical Association Rule. The configuration process has three steps: Basic Information, Rule Definition, and Alert Settings. For the Operation Result parameter, select Success.
Parameter
Description
(Required) Rule Name
The name of the risk identification rule. The name must be 1 to 30 characters long and cannot contain special characters.
(Required) Rule Type
The type of risk to identify. Valid values:
-
Data Access Risk: Identifies potential risks related to data access.
-
Data Export Risk: Identifies potential risks related to data export.
-
Data Deletion Risk: Identifies potential risks related to data deletion.
-
Data Update Risk: Identifies potential risks related to data updates.
-
Database/Table Operation Risk: Identifies potential risks related to database or table operations.
-
Data Authorization Risk: Identifies potential risks related to data authorization.
(Required) Rule Level
The severity level of the rule. Valid values are Low, Medium, and High. You can set the rule level to High for rules that identify critical data.
(Optional) Description
The description of the risk identification rule. The description can be 1 to 100 characters long.
-
-
Click Next Step.
-
Configure risk identification conditions and thresholds.
-
Configure risk identification conditions.
DataWorks lets you identify risky data by dimensions such as data location, data property, View User Information, and Operation Time. This helps you create granular, scenario-specific rules.
NoteYou can add a maximum of 10 conditions. To add multiple conditions for a dimension, click +Add Comparison. All conditions are combined with an And operator.
-
Data location
Specifies the scope of data locations to scan for risks.
Parameter
Description
Required
Filter selected location
Specifies whether to include or exclude the selected location. Valid values:
-
≠: Excludes the specified location from the risk scan.
-
=: Includes only the specified location in the risk scan.
Yes
Data engine name
Select the engine to which the rule applies.
Note-
Currently, only risks in MaxCompute can be identified.
-
Each comparison can specify only one engine. To specify multiple engines, click +Add Comparison to add more conditions.
Yes
Workspace Name
Select the target workspace to which the rule applies. The Workspace Name must correspond to a workspace within the selected engine. You can select a workspace from the drop-down list or enter a name to search for one.
Note-
The drop-down list displays a maximum of 100 workspaces.
-
Name search supports fuzzy matching. You can enter a keyword to search for workspaces whose names contain the keyword.
-
Each comparison can specify only one workspace. To specify multiple workspaces, click +Add Comparison to add more conditions.
Yes
Data Table Name
Enter the target tables for the rule. You can enter one or more table names, separated by commas (,). Note the following:
-
A single table name can be up to 30 characters long. The total length of all table names cannot exceed 100 characters.
-
The asterisk (
*) wildcard is supported. For example,*namematches data in all tables whose names end withname.
No. If you leave this parameter empty, the rule applies to all tables in the selected workspace.
-
-
Data property
Filters the data to be scanned based on its properties. If you add multiple comparisons, a risk is triggered only when all conditions are met.
Parameter
Description
Property
Select a property category to identify risky data. The following property categories are supported:
-
Data classification: Specifies the classification level of risky data to identify. You must define data classification levels first. For more information, see Configure sensitive data classification and levels.
-
Data classification: Specifies the category of risky data to identify. You must define these categories first. For more information, see Configure data identification rules and run identification tasks.
-
Sensitive column type: Specifies the type of sensitive columns to scan for risky data. You must define sensitive column types first. For more information, see Configure data identification rules and run identification tasks.
Filter selected property
Specifies whether to include or exclude the selected property. Valid values:
-
≠: Excludes the specified property from the risk scan.
-
=: Includes only the specified property in the risk scan.
-
-
View User Information
Filters the scope of user information for identifying risky data. If you add multiple comparisons, a risk is triggered only when all conditions are met. You can click +Add Information Configuration to add multiple items. To remove an item, click the delete icon next to it.
Parameter
Description
Information category
Select the user information category to use for identifying risky data. Valid values:
-
User Group: The name of a user group under your Alibaba Cloud account. You must configure user groups first. For more information, see Configure user groups.
-
RAM Role: Specifies the RAM users in your Alibaba Cloud account. You must create the RAM users first. For more information, see Create a RAM user.
-
User name: The current logged-in user.
Filter selected user information
-
≠: Excludes the specified user information from the risk scan.
-
=: Includes only the specified user information in the risk scan.
-
-
Operation Time
Filters the time range of operations to identify risky data.
Parameter
Description
Select time range
Click a day of the week and an hour to select a time range. You can select any time from Monday to Sunday, with hourly precision. You can add multiple time ranges. The added time ranges are mutually exclusive. For example, you cannot select Monday in more than one condition.
Filter selected time
-
≠: Excludes the specified time from the risk scan.
-
=: Includes only the specified time in the risk scan.
-
-
-
Configure the threshold.
DataWorks supports event aggregation. You can identify risks by comparing event occurrences against a threshold within a time window. Click +Add Threshold Comparison to configure multiple threshold conditions. If you add multiple comparisons, a risk is triggered only when all conditions are met.
Parameter
Description
Threshold category
-
Single Data Volume: Identifies risks based on the volume of data in a single operation. A risk is triggered if the data volume exceeds the specified threshold. The value must be an integer from 1 to 10,000,000. Unit: rows. Default value: 1.
-
Cumulative Occurrences: Identifies risks based on the frequency of a single event within a time window. A risk is triggered if the number of occurrences exceeds the specified threshold. The value must be an integer from 1 to 10,000. Unit: times. Default value: 10.
-
Cumulative Data Volume: Identifies risks based on the total volume of data operated on within a specified time window. A risk is triggered if the data volume exceeds the specified threshold. The value must be an integer from 1 to 10,000,000. Unit: rows. Default value: 1.
NoteDataWorks automatically categorizes and identifies single events.
Time window
The time window for counting event occurrences. The default value is 10 minutes. Valid values:
-
Minutes: A value from
1to59. -
hours: A value from
1to23. -
Day: A value from
1to7.
NoteThis parameter is required only when Threshold category is set to Cumulative Occurrences.
-
-
-
Click Next Step.
-
Configure alerting methods.
When a risk is detected, you receive notifications through the configured methods. You can select Mail and Webhook as the alerting methods.
NoteBefore you select an alerting method, make sure that you have configured the email and Webhook settings in System Configuration.
-
Click Save to complete the rule creation.
By default, a custom rule is disabled after it is created. On the Risk identification rules page, find the rule and click Re-enable to activate it.
-
Manage risk identification rules
On the Risk Identification page, you can view and edit your rules.
|
Area |
Description |
|
1 |
In this area, you can filter the rule list by criteria such as Type of Risk, Risk Level, built-in, and rule name. Note
You can search for rules by name using fuzzy matching. Enter a keyword to find rules whose names contain that keyword. |
|
2 |
In this area, you can perform the following operations:
|
|
3 |
In this area, you can perform batch operations on selected rules. The available actions include batch enable, batch disable, and Batch delete. Click the Note
DataWorks does not support deleting built-in risk identification rules. You can only delete custom rules that are in an Failure state. |
icon to re-enable an inactive rule.
icon to switch between batch operation types.Next steps
After you create and enable a risk identification rule, go to the Data Risks page to view the risk details and handle them. For more information, see View and handle data risks.