Help Center/ Database Security Service/ User Guide/ Database Audit/ Managing Audit Rules/ Configuring Privacy Data Protection Rules
Updated on 2026-07-07 GMT+08:00
View PDF
Share

Configuring Privacy Data Protection Rules

To mask sensitive information in entered SQL statements, you can enable the function of masking privacy data and configure masking rules to prevent sensitive information leakage.

Prerequisites

  • The database audit instance is in the Running state.
  • For details about how to enable database audit, see Enable Database Audit.

Constraints and Limitations

Only user-defined rules can be edited and deleted. Default rules can only be enabled and disabled.

Managing Privacy Data Protection Rules

  1. Log in to the DBSS console.
  2. Click in the upper left corner on the displayed page and select a region.
  3. In the navigation tree on the left, choose Rules.
  4. In the Instance drop-down list, select an instance.
  5. Click the Privacy Data Protection tab.

Viewing Privacy Data Protection Rules

Check privacy data protection rules. For details, see Table 1.
Figure 1 Masking rule information
Table 1 Masking rule parameters

Parameter

Description

Store Result Set

You are advised to disable it. After this function is disabled, database audit will not store the result sets of user SQL statements.

Do not enable this function if you want to prepare for PCI DSS/PCI 3DS CSS certification.

NOTE:

The result set storage supports only the database audit in agent mode.

Mask Privacy Data

You are advised to enable it. After this function is enabled, you can configure masking rules to prevent privacy data leakage.

Rule Name

Rule name.

Rule Type

Rule type.

  • Default
  • Custom

Regular Expression

Regular expression that specifies the sensitive data pattern

Substitution Value

Value used to replace sensitive data specified by the regular expression

Status

Status of a rule.

  • Enabled
  • Disabled

Disabling a Privacy Data Protection Rule

  1. In the Operation column of a rule, click Disable.

    Figure 2 Disabling a masking rule

  2. In the displayed dialog box, click OK.

    A disabled rule cannot be used.

Editing a Privacy Data Protection Rule

Default rules cannot be edited. Only custom rules can be edited.

  1. In the Operation column of a rule, click Edit.

    Figure 3 Editing a custom masking rule

  2. In the displayed dialog box, modify the rule information and click OK.

Deleting a Privacy Data Protection Rule

  1. In the Operation column of a rule, click Delete.

    Figure 4 Deleting a masking rule

  2. In the displayed dialog box, enter DELETE and click OK.

    After the rule is deleted, if you need to configure privacy protection for the instance, add a privacy data protection rule again.

Adding a Custom Privacy Data Rule

  1. Enable or disable Store Result Set and Mask Privacy Data.

    • Store Result Set

      You are advised to disable it. After this function is disabled, database audit will not store the result sets of user SQL statements.

      Do not enable this function if you want to prepare for PCI DSS/PCI 3DS CSS certification.

      Note: The result set storage supports only the database audit in agent mode.

    • Mask Privacy Data

      You are advised to enable it. After this function is enabled, you can configure masking rules to prevent privacy data leakage.

  2. Click Add Rule. In the displayed Add Rule dialog box, set the data masking rule, as shown in Figure 5. For details about related parameters, see Table 2.

    Figure 5 Adding a user-defined rule
    Table 2 Rule parameters

    Parameter

    Description

    Example Value

    Rule Name

    Name of a rule

    test

    Regular Expression

    Regular expression that specifies the sensitive data pattern

    -

    Substitution Value

    Value used to replace sensitive data specified by the regular expression

    ###

  3. Click OK.

    A masking rule in the Enabled status is added to the rule list.

Verifying a Rule

Perform the following steps to check whether a rule takes effect. The audit information about passport No. in a MySQL database is used as an example.

  1. Enable Mask Privacy Data, and ensure the "Passport NO." masking rule is enabled, as shown in Figure 6.

    Figure 6 Enabled rule

  2. Log in to the database as user root through the MySQL database client.
  3. On the database client, enter an SQL statement.

    select * from db where HOST="Passport NO.";

  4. In the navigation pane, choose Dashboard.
  5. In the navigation tree on the left, choose Data Reports. The Data Reports page is displayed.
  6. In the Instance drop-down list, select the instance whose SQL statement information you want to view. Click the Statements tab.
  7. Set filtering conditions to find the entered SQL statement.
  8. Click the SQL statement. On the Statement Details page, view the SQL statement information. The privacy data masking function is normal, and the masked information is displayed in SQL Statement.

References

  • You can add trusted SQL statements to the whitelist. Database audit will ignore whitelisted SQL statements. For details, see Configuring SQL Whitelist.
Parent Topic: Managing Audit Rules