Requirements:

• SDD enabled and turned on

• Frameworks enabled

  • To use the classification frameworks UI, enable the

• Registered

• Immuta permission GOVERNANCE

To activate a classification framework,

1. Navigate to Discover and select the Classification tab.

2. Click the more actions icon in the Actions column for the framework you want to activate.

3. Select Activate.

Repeat this process for all frameworks relevant to your data. See the for information on Immuta's built-in frameworks.

1. Navigate to Discover and select the Classification tab.

2. Click the more actions icon in the Actions column for the framework you want to activate.

3. Select Deactivate.

To activate a framework using the Immuta API, see the .

Requirements:

• SDD enabled

• Frameworks enabled

  • To use the classification frameworks UI, enable the

• Registered

• Immuta permission GOVERNANCE

Immuta Discover provides identification frameworks out-of-the-box to recognize and tag data, and Discover also provides classification frameworks out-of-the-box to categorize and classify data. These frameworks are all generic to industry practices and should be customized to each organization's specific needs.

Tune SDD frameworks and identifiers first to adjust where Discovered tags are applied. Because classification frameworks apply classification tags from the Discovered tags, tuning SDD should come first and will have trickle-down effects on classification. Customizing SDD requires some initial work but will automate data tagging for all data sources in the future.

Follow the steps below to tune SDD from the Default Framework:

2. .

3. .

4. : This will remove the tags from any previous identification frameworks and re-run identification with your new framework. From here, either continue to edit identifiers to reconfigure the applied tags, or if you are happy with the results, proceed to the next step.

After SDD has applied entity tags, classification frameworks will automatically reapply their tags to account for any changes to Discovered tags. It may be necessary to adjust the classification tags based on your organization's data, security, and compliance needs.

Requirements:

• Immuta permission AUDIT

• Snowflake integration (If you are using Databricks, use the how-to below.)

Use the Detect dashboards to review queries at different sensitivity levels and review the tags that have been applied to your data source columns to understand the tags that Immuta applied there:

1. Have an Immuta user subscribed to a data source make multiple queries to a data source in Snowflake. The user should query both non-sensitive and sensitive data.

2. Navigate to the Audit page and click ↻Load Audit Events to pull in queries made in Snowflake.

3. Navigate to the Events (Beta) page. Note that Snowflake has a 15-minute data latency for all audit events.

Requirement: Immuta permission GOVERNANCE or data owner

Target some data sources to manually review tags:

1. Navigate to the data dictionary for the data source by opening the Data Sources page and selecting a data source. Click the Data Dictionary tab to open the data dictionary.

2. The data dictionary lists the data source columns, with details about the name, data type, and a list of the tags on each column. Assess whether the tags are accurate to your data.

Tags may be unexpected but still accurate to your data. Additionally, they may have been applied because they were found to be the best match from the identifiers in the framework.

If you want to improve SDD and personalize it to your data,

1. Assess why the tag was applied to your data.

2. Is the identifier incorrectly matching your data and irrelevant to your organization? .

3. Is the identifier incorrectly matching this specific column, but correct in other places? It must have been the most correct match found by identification. Create a better match by completing the following steps:

If you want to remove the unexpected tags, use one of the following how-to guides:

1. .

2. Ensure the Discovered tags are applied properly by adjusting SDD.

3. . Note that classification tags build off of other tags, so removing a single classification or Discovered tag can have trickle-down effects on the data source.

If you were expecting some sensitive data to be tagged and it is not, enable additional tags using one of the following how-to guides:

1. .

2. Ensure the Discovered tags are applied properly by adjusting SDD.

3. . Note that classification tags build off of other tags, so adding a single classification or Discovered tag can have trickle-down effects on the data source.

Requirement: Immuta permissions GOVERNANCE and AUDIT

Tags can be edited on an individual basis for each data source. If broad changes to the classification framework are necessary to re-tag your data, use the .

1. Navigate to the Data Sources page and select the data sources that you assessed and noted issues.

2. Click the Data Dictionary tab.

3. Delete unnecessary tags by clicking on the tag you want to remove from the column, and select Disable from the tag side sheet.

The built-in classification frameworks in Immuta provide a quick way to leverage your own catalog or data platform tags to establish classifications tags. These classification tags can then be used in the Immuta Data Platform for query activity visualizations, monitors, reports, and policies. After you have configured a data catalog integration and registered data sources in Immuta, you can start automating data classification of a column based on its context by considering the combination of its associated tags, its neighboring columns' tags, or its table tag. Classification frameworks also provide query event context. To use classification frameworks with your current tags from an external catalog, use one of the following options:

1. Follow the tutorial below: This starter framework is built to map a classification scale of restricted, confidential, internal, and public to Immuta's three level scale. It requires an external catalog, but all other steps are described below.

2. : This minimal framework allows you to map your own classification tags to Immuta classification tags. Then, your users' queries will have a sensitivity score on the Detect dashboard and in audit logs based on the classification tags on the data columns they queried. Use this option if you have already classified your organization’s data in an external catalog and want that metadata reflected in Immuta as Sensitive and Highly Sensitive.

3. : This option allows you to map your own tags describing your data to Immuta's predefined classification tags in the context of a specific compliance framework. Immuta provides built-in frameworks for GDPR, CCPA, and HIPAA. Map your tags to the most comparable Data Security Framework (DSF) tag, and Immuta will apply the classification tag based on the framework. Use this option if you have descriptive tags on your data and want that metadata mapped to a specific compliance framework.

Follow this guide to map your external catalog tags to the example framework, or consult the for more information about the framework schema.

Using the example framework below, customize the framework for your organization's classification tags.

For more information about these parameters see the .

1. tags: These tags are automatically created in Immuta with the sensitivity you assign. All tags used in the classificationTag parameter should be defined here.

2. tags.sensitivities: This is metadata for the sensitivity of the new tag. Use confidentiality for dimension. Options for sensitivity are 1

Follow the example below to map your external tags to the rules in the example framework.

The Immuta built-in framework, Risk Assessment Framework has a rule where columns tagged DSF.Interpretation.Credentials.Secret by sensitive data discovery will be tagged RAF.Confidentiality.High:

To translate this to your tags, replace the name and source value of the columnTags, neighborColumnTags, or tableTags with your own. This new example is for a Collibra tag that an organization uses for confidential data. This rule now states: Apply the classification tag RAF.Confidentiality.High to a column if it has the collibra tag Confidential. Repeat this for your organization's remaining classification levels.

If you do not know the name or source for your tags, you can list your tags using the Immuta API:

This request will list all the tags in your Immuta environment, similar to this example response:

Requirement: Immuta permission GOVERNANCE

Once you have made all the customizations to the example framework, make the following request using the Immuta API, with your full customized framework as the payload.

Your new framework will now be visible in the Immuta UI by navigating the Classification section under Discover.