Prerequisite

Sensitive data discovery must be enabled.

Command Overview: immuta sdd run

This command allows you to run SDD on specific data sources or all data sources in your instance of Immuta.

Options

Use these options to get more details about the sdd run command or any of its subcommands:

• -h

• --help

$ immuta sdd -h
Run Sensitive Data Discovery with provided options

Usage:
  immuta sdd run [datasourceName(s)] [flags]

Examples:
# run SDD as a dry run on the specified data sources
$ immuta sdd run "Datasource One" "Datasource Two" --dryRun --template "someFramework"
# run SDD on ALL data sources in immuta
$ immuta sdd run


Flags:
  -d, --dryRun                  No updates will actually be made
  -f, --force                   Do not prompt for confirmation when attempting to run sdd on all data sources
  -h, --help                    Help for run
  -o, --output json | yaml      Output format
      --outputTemplate string   Format the response using a Go template
  -t, --template string   Run SDD with this template, can only be used with the dryRun flag
  -w, --wait int                The number of seconds to wait for the SDD job(s) to finish. Default is until the SDD job(s) finish (default -1)

Global Flags:
      --config string    Config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   Specifies the profile for what instance/api the cli will use (default "default")

Run SDD on Specific Data Sources

Run immuta sdd run <dataSourceName> [flags], naming the data source you want to run SDD on. The options you can specify include

• -d, --dryRun: No updates will actually be made.

• -f, --force: Do not prompt for confirmation when attempting to run SDD on all data sources.

• -h or --help: Get more information about the command.

• -o or --output json | yaml: Specify the output format.

• --outputTemplate string: Format the response using a Go template.

• -t, --outputTemplate string: Run SDD with this framework. This flag can only be used with the dryRun flag.

• -w, --wait int: The number of seconds to wait for the SDD job(s) to finish. Default is until the SDD job(s) finish (default -1).

Example

The example below illustrates a user running SDD on a single data source.

$ immuta sdd run "Credit Accounts"
Running SDD
Credit Accounts  06b71830-aebc-11ec-970b-51ffefcbfd0c  completed

Run SDD on All Data Sources

1. Run immuta sdd run. The options you can specify include

   • -d, --dryRun: No updates will actually be made.

   • -f, --force: Do not prompt for confirmation when attempting to run SDD on all data sources.

   • -h or --help: Get more information about the command.

   • -o or --output json | yaml: Specify the output format.

   • --outputTemplate string: Format the response using a Go template.

   • -t, --outputTemplate string: Run SDD with this framework. This flag can only be used with the dryRun flag.

   • -w, --wait int: The number of seconds to wait for the SDD job(s) to finish. Default is until the SDD job(s) finish (default -1).

2. Confirm that you want to run SDD on all data sources.

Example

$ immuta sdd run
Running SDD
Started 8 SDD jobs

Command overview: immuta sdd

This command allows you to customize and run SDD in your instance of Immuta. The table below illustrates subcommands and arguments.

Options

Use these options to get more details about the sdd command or any of its subcommands:

• -h

• --help

$ immuta sdd -h
Manage Sensitive Data Discovery

Usage:
  immuta sdd [command]

Available Commands:
  classifier  Manage Sensitive Data Discovery Classifiers
  run         Run Sensitive Data Discovery with provided options
  template    Manage Sensitive Data Discovery Templates

Flags:
  -h, --help   Help for sdd

Global Flags:
      --config string    Config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   Specifies the profile for what instance/api the cli will use (default "default")

Use "immuta sdd [command] --help" for more information about a command.

SDD workflow

Two common workflows for using SDD are outlined below. The first illustrates how to apply a global framework to all data sources, while the second outlines how users can create and apply frameworks to data sources they own.

The tutorials linked below show how to use the CLI to complete this workflow. For an overview of how sensitive data discovery works, see this overview.

Workflow 1: Apply the global framework to all data sources

1. Data governor creates a framework using one or more identifiers.

2. System administrator adds this framework as the global framework so that it applies to all data sources.

3. Users trigger SDD on data sources.

Workflow 2: Apply a framework to a specific data source

1. Data governor creates one or more identifiers.

2. Data owner creates a framework containing one or more identifiers.

3. Data owner triggers SDD on one or more data sources and resulting tags are applied to columns where criteria were met.

Prerequisite

Sensitive data discovery must be enabled.

Command overview: immuta sdd classifier

This command allows you to manage identifiers that will apply tags to data that matches the criteria you specify during SDD. The table below illustrates subcommands and arguments.

Options

Use these options to get more details about the sdd classifier command or any of its subcommands:

• -h

• --help

$ immuta sdd classifier -h
Manage Sensitive Data Discovery Classifiers

Usage:
  immuta sdd classifier [command]

Available Commands:
  create      Create an SDD classifier
  delete      Delete the passed SDD classifier
  get         Get an SDD classifier
  search      Search all classifiers
  update      Update an SDD classifier

Flags:
  -h, --help   Help for classifier

Global Flags:
      --config string    Config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   Specifies the profile for what instance/api the cli will use (default "default")

Use "immuta sdd classifier [command] --help" for more information about a command.

Create an identifier

1. Save your identifier to a valid YAML or JSON file using these attributes.

   Attribute

   Description

   Required

   name

   string Unique, request-friendly identifier name.

   Yes

   displayName

   string Unique, human-readable identifier name.

   Yes

   description

   string The identifier description.

   Yes

   type

   string The type of criteria: regex, dictionary, columnNameRegex, or builtIn.

   Yes

   config

   object The configuration of the identifier, which may include config.values, config.caseSensitive, config.regex, config.columnNameRegex, and config.tags.

   Yes

   config.tags

   array[string] The name of the tags to apply to the data source.

   Yes

   config.regex

   string A case-insensitive regular expression to match against column values.

   No

   config.columnNameRegex

   string A case-insensitive regular expression to match against column names.

   No

   config.values

   array[string] The list of words to include in the dictionary.

   No

   config.caseSensitive

   boolean Indicates whether or not values are case sensitive. Defaults to false.

   No

   Examples are provided below.

2. Run immuta sdd classifier create <filepath> [flags], referencing the file you just created. The options you can specify include

   • -h or --help: Get more information about the command.

   • -o or --output json | yaml: Specify the output format.

   • --outputTemplate string: Format the response using a Go template.

{
  "name": "MY_REGEX_IDENTIFIER",
  "displayName": "My Regex Identifier",
  "description": "A regex identifier",
  "type": "regex",
  "config": {
    "regex": "^[A-Z][a-z]+",
    "tags": ["Discovered.regex-example"]
  }
}

{
  "name": "MY_DICTIONARY_IDENTIFIER",
  "displayName": "My Dictionary Identifier",
  "description": "A dictionary identifier",
  "type": "dictionary",
  "config": {
    "values": ["Bob", "Eve"],
    "caseSensitive": true,
    "tags": ["Discovered.dictionary-example", "Discovered.dictionary-example"]
  }
}

{
  "name": "MY_COLUMN_NAME_REGEX_IDENTIFIER",
  "displayName": "My Column Name Regex Identifier",
  "description": "A column name regex identifier",
  "type": "columnNameRegex",
  "config": {
    "columnNameRegex": "ssn|social ?security",
    "tags": ["Discovered.column-name-regex-example"]
  }
}

Example

$ immuta sdd classifier create ./account-classifier.json
Creating classifier from ./account-classifier...
Create successful.

Get an identifier

Run immuta sdd classifier get <classifierName> [flags], specifying the name of the identifier you would like to get. Options you can specify include

• -h or --help: Get more information about the command.

• -o or --output json | yaml: Specify the output format.

• --outputTemplate string: Format the response using a Go template.

Example

The example below illustrates a user getting an identifier called ACCOUNT_NUMBER_IDENTIFIER.

$ immuta sdd classifier get ACCOUNT_NUMBER_IDENTIFIER
Getting classifier ACCOUNT_NUMBER_IDENTIFIER...
{
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "user@example.com"
  },
  "name": "ACCOUNT_NUMBER_IDENTIFIER",
  "displayName": "Account Number Identifier",
  "description": "This identifier recognizes account numbers using a regex critiera",
  "type": "regex",
  "config": {
    "tags": [
      "Discovered.account-number"
    ],
    "regex": "^[0-9]{9}-[0-9]{3}-[0-9]{1}$"
  },
  "id": 69,
  "createdAt": "2022-03-28T14:52:14.004Z",
  "updatedAt": "2022-03-28T14:52:14.004Z"
}

Search identifiers

Run immuta sdd classifier search [string] [flags] to list all identifiers or search identifiers by name. Options you can specify include

• -h, --help: Help for search.

• --limit int The search limit for pagination (default 25).

• --offset int: The search offset for pagination.

• --order asc | desc: The sort order.

• -o, --output json | yaml: The output format.

• --outputTemplate string: Format the response using a Go template.

• -s, --sort id | name | displayName | type | createdAt | updatedAt: Field to sort by.

• --type regex | columnNameRegex | dictionary | builtIn: Limit results to the specified criteria type.

Example

The example below illustrates a user searching all identifiers containing account.

$ immuta sdd classifier search account
Searching all classifiers...
ACCOUNT_NUMBER_IDENTIFIER This identifier recognizes account numbers using a regex criteria.

Update an identifier

1. Update your identifier in a valid YAML or JSON file using these attributes:

   Attribute

   Description

   Required

   name

   string Unique, request-friendly identifier name.

   Yes

   displayName

   string Unique, human-readable identifier name.

   Yes

   description

   string The identifier description.

   Yes

   type

   string The type of criteria: regex, dictionary, columnNameRegex, or builtIn.

   Yes

   config

   object The configuration of the identifier, which may include config.values, config.caseSensitive, config.regex, config.columnNameRegex, and config.tags.

   Yes

   config.tags

   array[string] The name of the tags to apply to the data source.

   Yes

   config.regex

   string A case-insensitive regular expression to match against column values.

   No

   config.columnNameRegex

   string A case-insensitive regular expression to match against column names.

   No

   config.values

   array[string] The list of words to include in the dictionary.

   No

   config.caseSensitive

   boolean Indicates whether or not values are case sensitive. Defaults to false.

   No

2. Run immuta sdd classifier update <classifierName> <filepath> [flags], referencing the file you just updated. The options you can specify include

   • -h or --help: Get more information about the command.

   • -o or --output json | yaml: Specify the output format.

   • --outputTemplate string: Format the response using a Go template.

Example

The example below illustrates a user updating an identifier named ACCOUNT_NUMBER_IDENTIFIER.

$ immuta sdd classifier update ACCOUNT_NUMBER_IDENTIFIER ./account-classifier -o json
{
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "user@example.com"
  },
  "name": "ACCOUNT_NUMBER_IDENTIFIER",
  "displayName": "Account Number Identifier",
  "description": "This identifier recognizes account numbers using a regex criteria.",
  "type": "regex",
  "config": {
    "tags": [
      "Discovered.account-number"
    ],
    "regex": "^[0-9]{9}-[0-9]{3}-[0-9]{1}$"
  },
  "id": 69,
  "createdAt": "2022-03-28T14:52:14.004Z",
  "updatedAt": "2022-03-28T15:25:28.575Z"
}

Delete an identifier

Run immuta sdd classifier delete <classifierName> [flags] to delete the identifier. The options you can specify include

• -h or --help: Get more information about the command.

• -o or --output json | yaml: Specify the output format.

• --outputTemplate string: Format the response using a Go template.

Example

$ immuta sdd classifier delete ACCOUNT_NUMBER_IDENTIFIER -o json
{
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "user@example.com"
  },
  "name": "ACCOUNT_NUMBER_IDENTIFIER",
  "displayName": "Account Number Identifier",
  "description": "This identifier recognizes account numbers using a regex criteria.",
  "type": "regex",
  "config": {
    "tags": [
      "Discovered.account-number"
    ],
    "regex": "^[0-9]{9}-[0-9]{3}-[0-9]{1}$"
  },
  "id": 69,
  "createdAt": "2022-03-28T14:52:14.004Z",
  "updatedAt": "2022-03-28T15:25:28.575Z"
}

Prerequisite

.

Command overview: immuta sdd template

This command allows you to manage identification frameworks, which are a collection of identifiers and settings used to drive the configuration of SDD runs. The table below illustrates subcommands and arguments.

Options

Use these options to get more details about the sdd template command or any of its subcommands:

• -h

• --help

Create an identification framework

1. Save your framework to a valid YAML or JSON file using these attributes:

   An example is provided below.
2. Run immuta sdd template create <filepath> [flags], referencing the file you just created. The options you can specify include

   • -h or --help: Get more information about the command.

   • -o or --output json | yaml: Specify the output format.

   • --outputTemplate string: Format the response using a Go template.

Example

Get an identification framework

Run immuta sdd template get <frameworkName> [flags], specifying the name of the framework you would like to get. Options you can specify include

• -h or --help: Get more information about the command.

• -o or --output json | yaml: Specify the output format.

• --outputTemplate string: Format the response using a Go template.

Example

The example below illustrates a user getting a framework named ACCOUNT_NUMBERS_FRAMEWORK.

Get the global framework

Run immuta sdd template global [flags], to get the global framework that has been configured for sensitive data discovery. Options you can specify include

• -h or --help: Get more information about the command.

• -o or --output json | yaml: Specify the output format.

• --outputTemplate string: Format the response using a Go template.

Example

The example below illustrates a user getting the global framework that had been configured in the Immuta UI by an administrator.

Search identification frameworks

Run immuta sdd template search [string] [flags] to list all identification frameworks or search identification frameworks by name. Options you can specify include

• --classifiers strings: Limit results to only frameworks that contain the specified identifiers.

• -h, --help: Help for search.

• --limit int The search limit for pagination (default 25).

• --offset int: The search offset for pagination.

• --order asc | desc: The sort order.

• -o, --output json | yaml: The output format.

• --outputTemplate string: Format the response using a Go template.

• -s, --sort id | name | displayName | type | createdAt | updatedAt: Field to sort by.

Example

The example below illustrates a user searching all frameworks containing the ACCOUNT_NUMBER_IDENTIFIER.

Update an identification framework

1. Update your framework in a valid YAML or JSON file using these attributes:
2. Run immuta sdd template update <frameworkName> <filepath> [flags], referencing the file you just updated. The options you can specify include

   • -h or --help: Get more information about the command.

   • -o or --output json | yaml: Specify the output format.

   • --outputTemplate string: Format the response using a Go template.

Example

The example below illustrates a user updating a framework named ACCOUNT_NUMBERS_FRAMEWORK.

Delete an identification framework

Run immuta sdd template delete <frameworkName> [flags] to delete the framework. The options you can specify include

• -h or --help: Get more information about the command.

• -o or --output json | yaml: Specify the output format.

• --outputTemplate string: Format the response using a Go template.

Example