Data Security Center:Use identification tasks to identify sensitive data

Task types

DSC supports two types of identification tasks: default tasks and custom identification tasks.

Default tasks

Once you authorize an asset, DSC automatically creates a scan task for that asset instance using the main identification templates. These are referred to as default tasks.

The following table describes the logic and behavior of default tasks.

Setting	Description
Identification template	Default tasks always use the main identification template configured for DSC. This cannot be changed for individual tasks. Main identification template: The global main template configured in DSC. It can be either a built‑in industry template (for example, Internet Industry Classification, Vehicle Internet Classification) or a custom template. Common identification template: When the main identification template is a built‑in industry template, DSC also applies the common identification template, which is based on the Personal Information Security Specification (GB/T 35273‑2020) standard.
Scan trigger and cycle (default)	One-click connection (Databases/OSS/SLS): If you select Scan assets and identify sensitive data now. during connection, the default task runs immediately. If you did not select Scan assets and identify sensitive data now. during connection, you must manually trigger the scan. Go to Classification and Grading > Tasks > Identification Tasks, select the Default Tasks list and click Rescan. Account/Password Connection (Databases): When you connect a database with an account and password, the system creates a default task upon connection. Periodic scans then run automatically every day starting from the next day (usually during early morning hours). Note: The minimum interval between two scans is 24 hours.
Scan scope	For all authorized assets, the scan scope is applied as follows: Databases and OSS: Performs a full scan of all data initially, and scans only incremental data in subsequent runs. SLS: Each scan covers data stored between 00:00 and 24:00 on the previous day relative to the scan execution time. To scan specific historical data in SLS, you must create a custom identification task. Changes to the main identification template do not trigger an immediate scan. The new rules apply only to the next scheduled run.

Custom identification tasks

Create a custom identification task when you need to scan specific data assets by using one or more enabled identification templates. If a template is currently disabled, you must enable it before it can be selected for a custom task. For more information, see Enable an identification template.

Scan mechanism and limits

Recommendations

View default tasks

1. Log on to the Data Security Center console.

2. In the navigation pane on the left, select Classification and Grading > Tasks.

3. On the Tasks page, click the Identification Tasks tab, and then click Default Tasks.

4. On the Discovery Task Monitoring page, view the list of default tasks.

5. You can perform the following operations on a default identification task:

   • Rescan: Triggers an immediate scan to update results. Use this if you have updated the main identification template, upgraded the identification model, or if significant data changes occurred.

   • Pause: Temporarily halts a running default task (e.g., if you detect database performance issues).

   • Terminate: Stops the execution of the current task and prevents the default task from running in future cycles.

   • Enable: Re-activate a terminated task.

   Note

   Default tasks cannot be deleted.

Configure scan settings

You can customize the schedule for default tasks. We recommend aligning the scan cycle with your data update frequency (minimum: Daily).

1. On the Discovery Task Monitoring page, select the check box of the task for which you want to configure the scan cycle, and then click Scan Settings above the task list.

   

2. In the Scan Settings dialog box, configure the scan cycle and automatic scan start time, and then click OK.

   Important

   • Set the start time to off-peak hours to minimize database impact.

   • Monitor CPU/Memory usage during scans. If abnormalities occur, pause or terminate the task immediately.

Create a custom identification task

1. In the navigation pane on the left, select Classification and Grading > Tasks.

2. On the Identification Tasks tab, select the Asset Type for which you want to create an identification task, and then click Create.

   

3. In the Create panel, configure the parameters and click OK.

   Category	Parameter	Description
   Basic Information	Asset Type	Displays the asset type selected in the previous step. It cannot be modified.
   	Task Name	Enter a task name.
   	Task notes	Enter the task notes.
   	Task and Plan	Select a task start time. Valid values: Immediate Scan: Runs the task immediately upon creation. Periodic Scan: Runs the task on a scheduled frequency. You must configure the Scan Frequency and Scan Time (Structured Data Only). To trigger an immediate run alongside the schedule, select Scan Once Now. Note The Scan Time setting applies only to structured data assets. Unstructured data scans run according to system resource availability.
   	Identification Template	Select up to two enabled identification templates to apply to this scan. For For details on enabling templates, see Use identification templates.
   Identification Scope	Identification Scope of Structured Data	Select the scope for structured assets (e.g., RDS, PolarDB): Global Scan: Scans all authorized structured assets. Specify Scan Scope: Allows granular selection of specific Instances and Databases. Instance Name and Database name: To add multiple instances, click Add Identification Scope. Scan Limit: Defines the number of rows sampled per table. Defaults to the first 200 rows. Maximum value is 1,000 rows.
   	Unstructured Data OSS Identification Scope	Select Object, Sampling Method, Scan Depth, and Scan Limit for unstructured data (OSS). Valid values of Object: Global Scan: Scans all authorized OSS buckets. Specify Scan Scope: Select specific buckets. You can apply filters (Prefix, Directory, Suffix) to include or exclude specific files. After you specify the objects to scan, you can configure filters for fine‑grained scanning. You can set Prefix, Directory, and Suffix to include or exclude specific values to filter the scan scope. Sampling Method: Retrieves data from OSS by using the ListObjects API and scans data based on the configuration. Global Scan: Scans all data. Custom Depth: Sampling Rate. Scans data based on the sampling ratio. Note For example, if you set Sampling Rate to 1/10, the system scans the 1st file, skips 9, and scans the 11th. Valid values of Scan Depth: Global Scan: Scans the full directory path. Specify Scan Scope: Limits the directory depth (Levels 1–10). For example, "5" scans only the top 5 directory levels. Scan Limit: Limits the scanned size per file. Default: 200 MB. Max: 1,000 MB. Excess data beyond the limit is skipped. Synchronize All Identification Results to SLS: Select this option to send full logs to Simple Log Service.
   	Unstructured Data SLS Identification Scope	Set Asset Scope and Time Range for SLS. Valid values of Asset Scope: Global Scan: Scans all authorized SLS Projects. Specify Scan Scope: Select specific Projects and Logstores. Valid values of Time Range: Last 15 Minutes, Last 1 hour, Yesterday, Last 1 Day, Last 7 Days, or Last 30 Days. Custom: The unit of the time range is minute, and the step size is 5 minutes.
   Other Settings	Tagging Result Overwriting	Determines how to handle conflicts with previously manually corrected data: Skip Manual Tagging Result: Preserves your manual corrections. The system will not overwrite them. Overwrite Manual Tagging Result: Replaces manual corrections with the new system scan results.

Modify or delete a custom identification task

• Edit: Reconfigures the custom identification task. You can modify all parameters.

• > Delete: Deletes redundant custom identification tasks.

Rescan a task

If the identification model is upgraded or your database data has changed, you can perform a rescan to update the results immediately. A Rescan triggers an immediate full scan of the specified asset. Perform this operation during off-peak hours to minimize the impact on system performance.

Before performing a Rescan, ensure that the relevant identification templates are enabled.

1. On the Identification Tasks tab, perform the rescan operation:

   • Rescan a custom identification task: In the task list, click Rescan in the Actions column of the custom identification task.

   • Rescan a default task: Click Default Tasks, find the target asset, and then click Rescan in the Actions column.

2. You can view the scan progress in the Scan Status column of the identification task.

Pause or Terminate a task

• Pause: Temporarily halts a running task. Useful during service anomalies. Click Pause in the Actions column of the custom identification task.

• Terminate: Stops the execution of the current and subsequent identification tasks (custom identification tasks and default tasks).

Create an export task

Follow this prodecure to create an export task and download the results:

1. On the Tasks page, click the Export Tasks tab.

2. On the Export Tasks tab, click Create.

3. Configure the export task and click OK.

   1. In the Basic Information section, enter a task name and select an identification template that is used by the identification task.

      You can select only an enabled identification template.

   2. In the Export Dimension section, select Asset Type or Asset Instance.

      • Asset Type: Select the asset types that you want to export.

      • Asset Instance: Select the asset instances that you want to export.

   After you create the export task, its status is displayed in the export task list. A larger amount of data requires a longer export period.

Download exported results

After the Export Status becomes Finished, click Download in the Actions column of the target export task.