DataWorks:Create a sensitive data detection task

Start a detection task

1. On the sensitive data detection rule page, click the Detection Task tab.

2. Click Enable Sensitive Data Detection Task and configure the task.

3. Click Enable.

After you click Enable, Task Status changes based on the task type:

• Real-time task: Status changes to Enabling. Data Security Guard monitors ODPS metadata and starts detection automatically when changes occur.

• Scheduled task: Status changes to Enabling. Detection runs at the configured scan time.

• One-time task: Status shows a progress bar. Progress is calculated as: _(tables scanned / total tables to scan) x 100%_. When progress reaches 100%, Task Status returns to No Task.

A modified detection rule takes effect in the next scheduled task. To apply a rule change immediately, create a one-time detection task.

Detection task parameters

The parameters available depend on the task type.

Real-time task

Parameter	Description
Detection Account	The Alibaba Cloud account or RAM user used to sample and scan data. The account's permissions determine which data can be sampled. To use a RAM user, first grant the RAM user permissions on the MaxCompute project.
Real-time Detection	Only ODPS supports real-time detection. When ODPS metadata changes—such as adding a table or field, or modifying a field—Data Security Guard starts a detection task automatically. If the change involves a new table or field with no content yet, detection uses metadata only.

Scheduled task

Parameter	Description
Task Execution	Enable task execution manually.
Subsequent Detection Task Scan and Update Policy	Two options: (1) Rescan and update results only for changed rules, data affected by changed rules, and data with no results. (2) Rescan all data and overwrite all results. In either case, you can choose not to overwrite manually corrected results.
Detection Account	The Alibaba Cloud account or RAM user used to sample and scan data. To use a RAM user, first grant the RAM user permissions on the MaxCompute project.
Content Detection	Select Content Detection, Metadata Detection, or both. Rules take effect only for the detection types you select. If Content Detection is not selected, Data Security Guard skips data sampling; content detection rules have no effect, but rules based on field names and field comments remain active.
Sample Size	The number of data rows to sample for content detection. A value greater than 100 is recommended. Required when Content Detection is selected.
Scan Frequency and Scan Time	The schedule for the task. Set the frequency to Once a week or Once a day. For weekly scans, select any day from Monday to Friday. The time range is 0:00–23:59.
Scan Scope	The data to scan. Select All to scan all data under the authorized account of the current tenant, or Partial Data to scan specific projects. See Scan scope details.

One-time task

Parameter	Description
Detection Task Scan and Update Policy	Two options: (1) Rescan and update results only for changed rules, data affected by changed rules, and data with no results. (2) Rescan all data and overwrite all results. In either case, you can choose not to overwrite manually corrected results.
Detection Account	The Alibaba Cloud account or RAM user used to sample and scan data. To use a RAM user, first grant the RAM user permissions on the MaxCompute project.
Content Detection	Select Content Detection, Metadata Detection, or both. Rules take effect only for the detection types you select. If Content Detection is not selected, Data Security Guard skips data sampling; content detection rules have no effect, but rules based on field names and field comments remain active.
Sample Size	The number of data rows to sample for content detection. A value greater than 100 is recommended. Required when Content Detection is selected.
Scan Scope	The data to scan. Select All to scan all data under the authorized account of the current tenant, or Partial Data to scan specific projects. See Scan scope details.

Scan scope details

When you select Partial Data, the following rules apply:

• The default scope includes all projects of all DPI engines.

• You can specify individual tables within ODPS, EMR, and HOLO projects.

• Select a project on the left side of the page. The data tables in that project appear on the right. Select individual tables, or select all tables at once. By default, all tables in the project are selected.

• Keyword search is available for projects, databases, and tables. To search for a table, first select the project, then search within it.

• You can add multiple project or database scopes. The final scan scope is the union of all specified scopes.

Table name rules for ODPS, EMR, and HOLO:

• Length: 0–100 characters. All character types are supported. Leave blank to scan all tables.

• Wildcard .* is supported. For example, .*name matches table names ending in name, and private.* matches names starting with private.

• Use commas (,) to separate multiple table names or field names.

Navigate to detection results

1. On the sensitive data detection rule page, click the Detection Results tab.

2. Use the filters in area ① and area ② to locate the fields to correct. The results list (area ③) displays the following fields by default: Project, Table Name, Field Name, Classification, Categorization, Sensitive Field Type, Manually Corrected, and Last Updated. Click Displayed Fields Settings to customize the columns.

   • Area ①: Select a DPI engine from the drop-down list to filter results by engine type.

   • Area ②: Filter by Project, Table Name, or Field Name. Click Expand for additional filters: Classification, Categorization, and Sensitive Field Type.

   

Correct a single field

1. In the results list, find the field with an incorrect Sensitive Field Type.

2. Click the drop-down arrow in the Sensitive Field Type column. The list shows all published sensitive field types from the default classification and categorization template for the current tenant.

3. Choose one of the following actions:

   • If an existing sensitive field type fits: Select it. Then click the icon on the right to go to the Data Detection Rule page and update the detection rules for both the original and the new sensitive field types. This improves detection accuracy for future scans.

   • If no existing type fits: Click the icon on the right to go to the Data Detection Rule page, or scroll to the bottom of the drop-down list and click Manage Sensitive Field Types. You are redirected to the Data Detection Rule page, and the Create Sensitive Field Type dialog box appears. Add a new sensitive field type and configure its detection rules. For more information, see Configure data detection rules and execute detection tasks.

Batch correct fields

1. In the results list, select the fields to correct.

2. Click Batch Correct (area ④). The Batch Correct Recognition Results dialog box appears.

3. In the Sensitive Field Type drop-down list, select the correct type. The list shows all published sensitive field types from the default classification and categorization template for the current tenant.

4. Click Save.