Edit masking rules in a rule set

Masking rules define how sensitive data in a Rule Set is protected. Each rule maps a column to a Data Class and optionally a Masking Algorithm. These rules determine how data is transformed when compliance jobs run.

A Data Class identifies the type of sensitive data stored in a column (for example, email address, phone number, or credit card number). A Masking Algorithm defines how the data will be transformed during masking.

For more information, see:

Use this task to assign or update the Data Class and Masking Algorithm for a column in a Rule Set.

Document Store Type

For eligible database columns, you can configure a Document Store Type to mask structured content stored inside a single column. Supported document store types are JSON and XML.

When a column is configured as a document store, DCT decomposes the column into named sub-fields so you can assign masking algorithms at the inner-field level instead of masking the entire column as one value.

The Masking Rules grid shows the current setting in the Document Store Type column.

  • Eligible column types: The Document Store Type selector is available for supported database column types such as CLOB or native JSON-typed columns.

  • Unsupported column types: For unsupported types such as VARCHAR or NUMBER, the selector is disabled and the dialog explains why the setting is unavailable.

  • After changes: If you update the document store type for a column, refresh the rule set before running a masking job so the latest column metadata is available.

Enable Automatic Updates

The Enable Automatic Updates option controls whether discovery jobs can update masking assignments for a column.

Enabled (default)

When this option is enabled, discovery policies can automatically determine or update whether a column should be masked based on the detected data class.

Disabled

When this option is disabled, masking assignments are controlled manually. The user's selection overrides any assignments that would normally be made by the discovery policy.

Typically, you can disable Enable Automatic Updates when you want to manually assign masking rules and prevent discovery policies from changing those assignments.

You can temporarily disable Enable Automatic Updates, update the masking assignments, and then re-enable it if you want discovery policies to continue updating data class and algorithm assignments.

Steps

  1. In the left navigation pane, click Compliance > Rule Sets.

  2. Click View next to the rule set you want to modify.

  3. Open the Masking Rules tab.

  4. Locate the table and column you want to update.

  5. Click Actions next to the column.

  6. Click Edit.

  7. In the Edit Properties dialog:

    1. Select a Data Class.

    2. Select a Masking Algorithm (optional).

    3. If the column supports it, select a Document Store Type of None, JSON, or XML.

    4. If you selected JSON or XML, review the generated sub-fields and assign masking algorithms as needed.

    5. Configure Enable Automatic Updates if needed.

  8. Click Save.

  9. If you changed the Document Store Type, refresh the rule set before running a masking job.

Edit table-level attributes

In addition to column-level masking rules, each data table in a rule set supports three optional attributes that control how data is selected during compliance job execution: Custom SQL, Filter, and Logical Key. These are set at the table level, not the column level, and appear as row actions on each table entry in the Masking Rules tab.

Bulk edit actions for Filter and Logical Key are also available at the top of the Masking Rules tab, allowing you to apply a value across all tables in the rule set at once.

For full instructions, see Edit table attributes in a rule set.