Data Classification

Data classification identifies types of sensitive data — such as personal, financial, or regulated information — across your connected data sources. ALTR runs classification through ALTR Native, which evaluates classifier rules you define or import against a data source.

ALTR Native identifies data by running a collection — a reusable group of classifiers — against a data source. Each classifier is one or more classifier rules combined with AND/OR/NOT logic. Beyond regex and metadata matching, a classifier rule can also call an external, ML-based detection service — Google DLP, Amazon Comprehend, or Snowflake’s own classification engine as a Snowflake Native condition. Amazon Comprehend and Snowflake Native run only as conditions within an ALTR Native classifier; Google DLP can also run as its own standalone classification method on Snowflake and Databricks, separate from ALTR Native — see the classification method step below. On OLTP, Google DLP runs only as a condition within an ALTR Native classifier, not as a standalone method.

In this section

• Classifiers & Collections — Build classifiers from rules and organize them into collections you run against a data source.
• Classifier Rules — Reference for every rule type a classifier can use, and how AND/OR/NOT logic combines them.
• Classification Processing Location — Where a classification job executes, and which rules evaluate at each location.
• Classification Reports — What a classification report contains, and how Match Confidence and decision lineage explain each result.
• Automatic Tagging — Apply Snowflake Object Tags to columns based on classification results.
• OLTP Classification Agent — Run classification against OLTP databases from an agent in your own environment.

Classification Process

Classifying data in ALTR moves through 5 stages: connect a data source, build or import a collection, classify the data, review the report, and protect the sensitive data it finds. Classifying data in ALTR follows these steps:

1. Connect a data source — connect a Snowflake data source, connect a Databricks data source, or an OLTP database via the OLTP Classification Agent.
2. Build or import a collection with at least one classifier.
3. Classify the data source (below).
4. View the classification report (below).
5. Protect sensitive data using the results.

Note

Classifying a Snowflake data source activates a Snowflake warehouse; classifying a Databricks Metastore activates Databricks compute. More compute is required for larger or more complicated classification jobs. Classifying an OLTP data source runs on the OLTP Classification Agent in your own environment, not ALTR’s compute.

To classify data:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Click Classify Data. ALTR displays a dialog to configure the job.
3. Select a connection type and data source.
4. Select a classification method: ALTR Native Classification runs a collection you choose, or Google DLP Classification runs Google’s infoTypes as a standalone method under ALTR’s own Google Cloud credentials, optionally scoped to a collection’s infoTypes — omit the collection to check all of Google’s built-in infoTypes. Google DLP Classification is available for Snowflake and Databricks connections only; for OLTP, add a Google DLP condition to an ALTR Native collection instead.
5. For ALTR Native, select a collection — the classifiers it contains determine which conditions run, including any Google DLP, Amazon Comprehend, or Snowflake Native conditions. For Google DLP Classification, optionally select a collection to limit which infoTypes are checked.
6. For a Snowflake ALTR Native job, select a processing location — ALTR Hosted (default) or In-Warehouse. OLTP jobs always run on the classification agent. See Classification Processing Location.
7. Configure the sample size and click Classify Data. ALTR runs the job and sets the report’s status to Success when it’s ready.

Pause, Resume, or Cancel a Classification Job

Note

Only ALTR Native classification jobs can be paused, resumed, or canceled.

Pausing a running job temporarily stops it — for example, to address a performance issue — without losing progress; resuming continues it from where it paused. Canceling a job permanently stops it and discards any report data generated so far; a canceled job can’t be resumed.

If you update a collection while a job that uses it is paused, the eventual report reflects the collection as it existed when the job started, not your changes.

To pause or resume a running job:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Locate the job (Status is In Progress or Paused).
3. Click the job’s ellipsis menu.
4. Select Pause Scan or Resume Scan.

To cancel a job:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Locate the job (Status is In Progress or Paused).
3. Click the job’s ellipsis menu.
4. Select Cancel Scan. A confirmation dialog displays.
5. Click Cancel Scan to confirm.

View the Classification Report

Once a classification job’s status is Success, its classification report is available. See Classification Reports for what the report contains and how to interpret Match Confidence and decision lineage.

To view a classification report:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Click a report to view its details.

Note

If a column you expect doesn’t appear in a report, adjust the classification settings for the classifier involved and classify the data again.

Protect Sensitive Data

Classification results identify where sensitive data exists so you can apply Data Access Controls policies to protect it.

• Assign tags to columns based on classification results using Automatic Tagging.
• Apply masking, access, or other Data Access Controls policies to those tagged or connected columns.
• A policy attached to a tag continues to apply as new data is tagged, without further configuration. Reclassifying a data source to catch new or changed data is a separate, manual step.