A scanning rule defines what the Sensitive Data Classifier looks for and what it does when it finds a match. Rules live inside a scanning group, which decides which logs the rule sees. This page is the reference for every rule setting. To write your own pattern, see Custom Rules.

​
Library rules and custom rules

There are two kinds of rule:
  • Library rules are maintained by Atatus and cover common formats such as payment cards, email addresses, and authentication tokens. You pick them from a list and choose an action. The regular expression is managed for you and is not editable. See Library Rules for the full catalog.
  • Custom rules use a regular expression you supply, for patterns that are specific to your business such as an internal account number.
You select which kind you are adding at the top of the rule form.

​
1. Rule settings

​
2. Match conditions

​
Pattern

Custom rules take a regular expression in the Define Regex Pattern field. The form validates the expression as you type and shows Invalid regex pattern if it will not compile. See Custom Rules for syntax guidance and worked examples. Library rules already carry their pattern, so this field is not shown for them.

​
Keywords and proximity

Keyword proximity is the single most effective way to cut false positives. A nine digit number on its own could be anything. A nine digit number sitting next to the word passport is much more likely to be a passport number. Under Cross-check matches with nearby keywords to prevent false alerts, add the keywords that should appear near a genuine match. You can add up to 30. Characters before match controls how far back the classifier looks for those keywords. The default is 30 characters and the maximum is 50. Given this log line and an included keyword of card:
The word card appears within 30 characters before the number, so the match is kept. A bare number with no nearby keyword is skipped.
If you add no keywords, the pattern matches on its own with no proximity check. That is the right choice for formats that are unambiguous by themselves, such as a JSON Web Token.

​
Test a rule before you enable it

When you edit an existing rule, the form includes an evaluator. Paste a sample message into it and Atatus runs your rule against that text and highlights each match, along with a count such as 2 matches. Use it to confirm two things before enabling a rule on live traffic:
  • Your pattern matches the values you expect.
  • It does not match values you want to keep, such as order IDs or timestamps.

​
3. Action on match

​
Choose what part of the event to scan

The first selector decides the scope: Use Specific event when you know exactly which field carries the sensitive value, for example user_email. It is faster and far less likely to mask something unexpected. Use Entire event when sensitive values could turn up anywhere in the payload.

​
Choose the match action

Partial redaction keeps the rest of the value readable. Masking 12 characters from the left of a card number gives you this:
The form shows a live example of the mask as you change the direction and count.
Hash, Redact, and Partially Redact permanently mask the matched value. Atatus never stores the original, so there is no way to reveal it later. Test with the evaluator first.

​
Tags

Every rule carries tags, and Atatus attaches them to any event the rule matched. Tags are how you find sensitive data later without ever seeing the value. Tags must be key:value pairs, and both halves may contain only letters, numbers, and underscores. The form shows Invalid tag format if a tag does not fit. Atatus uses two conventions, and it is worth following them so your custom rules line up with the library rules: These become the Sensitive Data and SDC Category facets in Logs. See Investigate Sensitive Data.

​
Enabling a rule

New rules are created disabled. Turn on the rule toggle, and make sure the group toggle is on too. A group with no enabled rules is skipped entirely.

​
Editing and deleting

You can edit any rule’s action, keywords, scope, priority, and tags. For custom rules you can also edit the pattern. Library rule patterns are managed by Atatus and are not editable, so if you need a variation, copy the idea into a custom rule. Deleting a rule removes it from its group. Deleting the group deletes all of its rules.

​
Next steps

  • Library Rules lists all 35 built-in rules with their tags and default priorities.
  • Custom Rules covers writing your own patterns.