Manage data classification templates

Usage notes

• Different instances can be associated with different templates, but each instance can be associated with only one classification and grading template. For more information, see Associate a classification and grading template with an instance.

• If sensitive data protection is enabled for an instance, DMS automatically associates the instance with a built-in classification and grading template. For more information about sensitive data protection, see Enable sensitive data protection.

• A classification and grading template can be associated with multiple instances.

• Built-in templates can only be viewed, not edited.

Create a classification and grading template

1. Log in to DMS 5.0.

2. Move the pointer over the icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Sensitive Data > Rule Configurations.

   Note

   If you use the DMS console in normal mode, choose Security and disaster recovery (DBS) > Sensitive Data > Rule Configurations in the top navigation bar.

3. Select the Template Management tab.

4. Create a classification and grading template.

   You can create a template in either of the following ways.

   • Copy a template

     Note

     You can also directly click Copy for a built-in or custom template to copy it.

     1. In the Custom Template section, click the icon.

     2. In the dialog box, click Copy Existing Template and select a built-in template or an existing template.

     3. In the Copy Template dialog box, use the default Template Name or change it to a Template Name that meets your business needs, and then click OK.

        The copied template then appears in the Custom Template section.

   • Create a template

     1. In the Custom Template section, click the icon.

     2. In the dialog box, click Create Empty Template.

     3. In the Add Template dialog box, enter a Template Name and click OK.

        The new template then appears in the Custom Template section.

Edit a classification and grading template

1. Log in to DMS 5.0.

2. Move the pointer over the icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Sensitive Data > Rule Configurations.

   Note

   If you use the DMS console in normal mode, choose Security and disaster recovery (DBS) > Sensitive Data > Rule Configurations in the top navigation bar.

3. Click the name of the target template block or Edit to go to the Template Rule Details page.

4. You can perform the following operations on this page.

   • Set security levels

     Click Security level settings to add data grades and modify the current sensitivity level sequence identifiers (L, S, P). In the Security level settings dialog box, you can view and modify the current sequence identifiers. The dialog box displays the security levels in a table with the Security Level, Description, and Actions columns. Three levels are provided by default: S1 (plaintext zone, low sensitivity), S2 (ciphertext zone, moderate sensitivity), and S3 (ciphertext zone, high sensitivity). You can click Modify or Delete to manage existing levels, or click + Add Grade to add a security level.

   • Add a category

     1. In the Data Category section, click the icon.

     2. In the Add Category dialog box, enter a Category Name and select a Parent Node (if you do not select a parent node, the category is added at the root node by default).

     3. Click OK.

     Note

     You can also select a target parent category to add a category. In the Data Category list, select the target category, click the icon, select and click Add Category, enter a category name, and click the icon.

   • Add a rule

     1. In the Data Category section, click the icon.

        Note

        You can also select the target category in the data category list and click the icon to add a rule.

     2. Select and click Add Rule.

     3. In the Add Custom Identification Rule panel, configure the Rule Name, Data Category, Security Level, Identification Model (multiple selections supported), Identification Scope, and other parameters.

        Note

        When both built-in and custom identification models are added to a classification and grading template, the built-in models do not override the custom models, and the custom models do not override the built-in models. For more information about identification models, see Manage detection models.

     4. Click Submit.

   • View rule details

     Select the target rule and click View in the Actions column to view the basic information and identification scope of the rule.

   • Delete a single rule

     Select the target rule and click Delete in the Actions column. In the Delete dialog box, click OK.

     Note

     To delete multiple rules, you can use the Batch Delete feature.

   • Modify a rule

     Select the target rule and click Modify in the Actions column. After you modify the information, click Submit.

   • Edit a category name

     In the Data Category list, select the target category, click the icon, and then click Edit. After you modify the name, click the icon.

   • Delete a category

     In the Data Category list, select the target category, click the icon, and then click Delete. In the delete dialog box, click OK.

     Important

     Deleting a category deletes all rules configured under its main path and sub-paths. To delete only the category but keep its rules, migrate the rules to another category before you delete the category.

   • Batch migrate rules

     Select the names of the rules that you want to migrate and click Batch Migrate. In the Batch Migrate dialog box, select the target category and click OK.

Other operations

• View template details: Click Preview on a template block to view the security levels, classifications, and grades of the data.

• Delete a template: Select the target custom template, click the icon, and then click Delete. In the Delete Template dialog box, click OK.

  Note

  • If the template is already associated with instances, you must first switch the template that is bound to the instances to another template before you delete it. You can switch the template by editing the instance or in the sensitive data dashboard. For more information about how to switch a template, see Associate a classification and grading template with an instance.

  • If the template to be deleted has already identified and tagged the sensitive fields of the associated instances, deleting the template does not affect the fields that have been tagged with classification and grading labels. That is, the associated instances are not affected.

• Modify a template name: Select the target custom template, click the icon, and then click Modify. Edit the template name, and then click OK.

Associate a classification and grading template with an instance

The following are two methods to manually associate a classification and grading template with an instance. You can use either method.

Method 1: Associate a template by editing the instance

1. Log in to DMS 5.0.

2. In the instance list on the left side of the homepage, right-click the target database instance.

3. Click Edit Instance.

4. In the Edit Instance dialog box, select the target Classification and Grading Template.

   Note

   You must enable the sensitive data protection feature for the instance before you can select a classification and grading template. For more information about sensitive data protection, see Enable sensitive data protection.

5. Click Submit.

6. A Prompt dialog box appears, asking whether to perform a full metadata scan. Click Scan Now.

   Note

   If you click Cancel, the existing sensitive data may not match the template rules because the metadata is not fully scanned. You must manually configure a scan task by choosing Security and Specifications > Sensitive Data Management > Sensitive Data Assets in the top navigation bar of the console. For more information, see Configure a scan task.

7. View the status and execution result of the scan task.

   In the top navigation bar, choose Security and Specifications > Sensitive Data Management > Sensitive Data Assets. In the Data Overview section, view the number of scan task statuses, and click Scan Succeeded to view the number of newly added sensitive fields.

Method 2: Associate a template from the top navigation bar of the console

1. Log in to DMS 5.0.

2. Move the pointer over the icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Sensitive Data > Sensitive Data Assets.

   Note

   If you use the DMS console in normal mode, choose Security and disaster recovery (DBS) > Sensitive Data > Sensitive Data Assets in the top navigation bar.

3. In the instance list section, click the Enabled tab.

4. Configure a classification and grading template.

   1. Select the target Instance and click Configure Identification Template above the instance.

   2. In the Configure Identification Template dialog box, select a Classification and Grading Template.

   3. Click OK.

5. Configure a scan task.

   1. Select the target Instance and click Configure Scan Task above the instance.

   2. In the Configure Scan Task dialog box, configure the following parameters.

      Parameter	Description
      Scan Method	Specifies when to start the scan task. Valid values: Immediate Task (takes effect once immediately): Immediately starts scanning the databases of the selected instances. Scheduled Task (takes effect once at a specified time): Starts scanning the databases of the selected instances at a specified time. Periodic Task: Scans the databases of the selected instances multiple times on an hourly, daily, or monthly cycle.
      Scan Scope	Scans All Databases or Specified Databases (multiple selections supported) of the selected instances.
      Whether Scan Results Take Effect Immediately	Taking effect immediately means that the identified fields are immediately tagged with classification and grading labels. Yes: The results take effect immediately. No: The results do not take effect immediately. You must go to the Identification Result page and manually apply the identification results.

   3. Click OK.

   4. View the identification results.

      In the Data Overview section, click the number under Scan Succeeded to go to the Identification Task Log page. Then, click the number in the Execution Result column of the target scan task row to view the identification results in the Identification Result panel. On the Data Overview page, the Task Information section displays the execution status of scan tasks, including the number of tasks that succeeded, are in progress, and failed.

      Note

      You can also click Task Details in the Actions column of the target instance row in the Instance List section to view the details of the scan task and the identification results.

   5. Manually apply the identification results. If you selected to make the scan results take effect immediately when you configured the scan task, the system automatically applies the identification results for you. In this case, skip this step.

      1. Go to the Identification Task Log page.

      2. Click the number in the Execution Result column of the target scan task row.

      3. In the Identification Result panel, click Take Effect in the Actions column to manually apply the identification results.

API reference

ListClassificationTemplates