Library rules are the built-in patterns that Atatus maintains for you. They cover formats that are the same for everyone, such as payment card numbers and email addresses, so you do not have to write and maintain the regular expressions yourself. To use one, open a scanning group, select Add Rule, choose Library Rules, and pick the rules you want. You then choose the match action and any extra tags.
Library rule patterns are managed by Atatus and cannot be edited. If you need a variation on one, create a custom rule instead.

​
What is included

There are 35 library rules across four categories:

​
Why there are several rules per card brand

Card numbers appear in different groupings depending on how the application formatted them. A Visa number might arrive as 4111111111111111, 4111 1111 1111 1111, or 41111111 11111111. Each grouping needs its own pattern, which is why you see rules such as Visa Card Scanner (4x4 digits) and Visa Card Scanner (2x8 digits). Enable every variant for a brand you care about. Enabling only one leaves the other formats unmasked.
Card rules use keyword proximity by default, with keywords such as credit, card, cvv, and the brand names. That keeps them from matching every long number in your logs. See Keywords and proximity if you need to adjust the behavior.

​
Rule catalog

The Priority column is the default triage label Atatus assigns to each rule. You can change it when you add the rule to a group.

​
Personally identifiable information

​
Credit card and banking

​
Secrets and credentials

​
Network and device information

The Digest Authentication Scanner rule matches the Digest scheme prefix at the start of an Authorization header value, not the credentials that follow it. Enable it to find where digest authentication is being logged. To mask the credentials themselves, pair it with a custom rule.

​
Tags applied by library rules

Every library rule attaches two tags to a matched event:
  • sensitive_data:<type> records what was found, for example sensitive_data:visa_credit_card.
  • sensitive_data_category:<category> records the broad grouping, for example sensitive_data_category:credit_card.
You can add your own tags on top when you add the rule, which is useful for routing findings to a team or a compliance program. These tags become the Sensitive Data and SDC Category facets in Logs. See Investigate Sensitive Data for how to search and alert on them.

​
Next steps