立即与支持人员聊天
与支持团队交流

Classification Module 6.1.1 - User Guide

Introduction Deploying Classification in Identity Manager Configuring Classification: Taxonomies, Categories, and Rules
An Overview of Classification Configuration Steps Required to Implement Classification Creating Taxonomies Setting Up Manual Categorization Implementing Rules for Automated Categorization Classifying Resources When Do Categorization and Classification Occur? Importing and Exporting Taxonomies Working with a Taxonomy XML File Managing the Life Cycle of Taxonomies and Categories Advanced Rule Applications
Working with Categorized Resources Appendix A: PowerShell cmdlets Appendix B: Oracle Configuration Appendix C: Classifying Data with Data Governance Templates Glossary

How Categories Work Together: Mutual Exclusivity, Strict Ordering and Inheritance

Categorization occurs based on a number of factors, including the associated rules and category thresholds. For a full explanation of this, see How Rules Affect Categorization. After the rules have been processed against a resource, potential categorizations result. However, before a category can be applied, the settings on the category must be considered. If there is more than one potential categorization within a taxonomy, the following may occur:

  • If there are no categories set to mutually exclusive, all potential categories will be applied
  • If all potential categorizations share the same parent, and that parent is mutually exclusive, only one potential category will be applied. The category that will “win” is the one with the highest combined rule score. This means that if you are planning a mutually exclusive taxonomy or branch of a taxonomy, it is important that you ensure the relative weighting of all subcategories makes sense for your needs. For more information, see How Rules Affect Categorization and Advanced Rule Applications
  • If some of the potential categorizations share the same parent and others do not, more than one category from the taxonomy may be applied, but the mutual exclusive settings of each branch will be respected. For example, the system may have to assign only one of the potential categories within a mutually exclusive branch, but be able to assign other categories within the taxonomy where mutual exclusivity has not been set.
  • If strictly ordered has been applied to a parent category, only one potential subcategory can be applied. In this case, however, instead of using combined rule scores to determine what category, the category closest to the parent on the tree will “win”.

The following diagram shows the difference between mutually exclusive and strictly ordered:

Mutually exclusive and strictly ordered

Inheritance does not directly affect categorization, however it is important to understand how inherited categories are applied when evaluating why particular categorizations were made. Inheritance refers to categorizations that are inherited from a parent container. For example, a folder can be manually categorized, and all documents in the folder inherit that categorization. The following can occur with inherited categories:

  • If no other categorization exists on a resource, the inherited category remains, and is identified as such in all views
  • If a resource is subsequently manually or automatically categorized, and only one potential category can be applied due to mutual exclusivity settings, the new category overrides the inherited one, and the inherited category is no longer associated with the resource
  • If a resource is subsequently manually or automatically categorized, and both the new and inherited categories can exist without violating any mutual exclusivity settings, both are associated with the resource
  • Inheritance only works on resources that are regularly scanned for classification. If you manually categorize a container that you own that is not scanned, child resources do not inherit the categorization unless they are scanned at some point.
  • If categorizations are removed from a resource for any reason, and there is a potential inherited category, the inherited category is reapplied to the resource.

Finding a Taxonomy or Category ID using PowerShell

Many of the PowerShell cmdlets you can use to manipulate your taxonomies require that you know the ID of a category. You must know the parent taxonomy of the category.

To determine a taxonomy ID using PowerShell

  • To determine the taxonomy ID, run the Get-QTaxonomies cmdlet and provide the ServerAddress.
    Provide the name of the computer hosting the Data Governance server, and the port. Enter in the form computername:port number. The default port is 8723.
    You can also use the Get-TaxonomyByName cmdlet to retrieve the taxonomy ID if you know the taxomomy name.

To determine a category ID using PowerShell

  1. Determine the ID of the parent taxonomy.

  2. The taxonomy ID has the same properties as a category. You can use a category ID and a taxonomy ID interchangeably in the cmdlets. For example, you can manage the properties of the taxonomy root when it is used as a category, or use the taxonomy root as a parent category when adding new categories to a taxonomy.
  3. Run the Get-QTaxonomyTree cmdlet with the following parameters:
    1. ServerAddress
      Provide the name of the computer hosting the Data Governance server, and the port. Enter in the form computername:port number. The default port is 8723.
    2. TaxonomyID.
  4. Locate the desired category and note or copy the ID.

Editing a Category

When you edit a category, some changes can have significant impact on the way resources are categorized. The following table outlines the impact of your changes on categorization:

Category Parameters (PowerShell/XML equivalent in brackets)
Setting Implications
Risk
(Risk)		 May change the way resources are classified if the change moves the category to a different classification threshold. For more information, see Classifying Resources.
Publish this category
(IsPublished)		 If you unpublish a category, the category will no longer appear in the taxonomy tree when a business owner is applying a category manually or overriding automated categorization; it will also prevent automatic classification by this category. A business owner will no longer be able to see categorizations with the unpublished category, however classification analysts can still view categorizations in the View Categorized Resources view, and unpublished categories continue to be included in the analysis cmldets. Note that business owners may perform attestations and be unaware that an unpublished category is associated with a resource.

Once a category has been published, it is not recommended that you unpublish a category to do further development work on it, as this will likely cause confusion for business owners when categorizations are not shown. Once a category is unpublished, you should either leave it that way or delete it. Instead, use your test environment for category development. For more information, see Managing the Life Cycle of Taxonomies and Categories.

Changing the setting on a parent category to unpublished also unpublishes any subcategory. Each subcategory must be published individually if you choose to republish the parent. If you want the automated system to use the category, you must also turn on that setting for each subcategory.
Allow this category to be used by the automated system
(IsAutomaticClassificationEnabled)		 The category will be included in the next scheduled classification scan. Scan schedules vary depending on the computer hosting the resources. See your Data Governance administrator or Enable and Disable Automatic Classification on Specific Managed Hosts for more information. New resources or changed resources can potentially be categorized with this category immediately.
If you disable this, no more resources will be categorized with this category through the automated system, but it will still be available for manual categorization.
Govern using this category
(CausesGovernance)		 If you stop governing with a category, any resources that were previously governed will remain so. New categorizations will not result in governance.
If you change to causing governance, all resources categorized with this category once you apply the change will be governed.
Mutually Exclusive
(IsMutuallyExclusive)		 If you make a category mutually exclusive, and a resource is categorized in a way that is now invalid (i.e. categorized with two subcategories of the mutually exclusive parent), the resource will have all but one category removed to respect the new mutual exclusive setting. The category that remains will be the one with the highest combined rule scores. For more information, see How Rules Affect Categorization.
If a category was mutually exclusive, and you remove that setting, additional categories may be applied to resources the next time they are processed.
Strictly Ordered
(IsStrictlyOrdered)		 Similarly to changing the mutual exclusivity setting, changing this setting has the potential to change the existing categorization on a resource.
There is no way to change the order of subcategories once they are created. You must delete and recreate the categories, including assigning the rules. Use care when doing this to ensure the desired results.
Threshold Changing the threshold affects categorization directly, along with the rules attached and their weights. When making changes to the threshold value, you may want to test your changes to ensure desired results. For more information, see Testing and Reviewing Automated Classification. Note: The threshold can only be modified through PowerShell commands.

To edit a category

  1. Select Governed Data | Taxonomy Manager | Categorizations.
  2. Locate the row containing the taxonomy with the desired category, and click Edit.
  3. Select the category to edit.
  4. Click Edit.
  5. Make any changes, and click Apply Changes.
  6. In the confirmation dialog box, click OK.

To edit a category using PowerShell

  1. Make sure you know the ID of the desired category. For more information, see Finding a Taxonomy or Category ID using PowerShell.
  2. Run the Set-QCategory cmdlet with the following required parameters:
    1. ServerAddress
      Provide the name of the computer hosting the Data Governance server, and the port. Enter in the form computername:port number. The default port is 8723.
    2. CategoryID.
  3. Adjust any of the optional parameters: Name, Description, Risk, IsPublished, IsAutomaticClassificationEnabled, CausesGovernance, IsMutuallyExclusive, IsStrictlyOrdered, Threshold.

Moving a Category

You can move a category within a taxonomy or to a different taxonomy. When you move a category:

  • its settings are maintained except for the published/unpublished setting. (If you move a published category to a taxonomy or category that is unpublished, it will become unpublished.)
  • it will be subject to the mutual exclusivity setting on the new parent category.all rule associations are maintained.all child categories will be moved with the parent.
  • resources will keep the categorization, and the category path will be updated to display the new location.

To move a category using PowerShell

  1. Determine the ID of the category you want to move, and the ID of the parent category.
    See Finding a Taxonomy or Category ID using PowerShell for details.
  2. Run the Move-QCategory cmdlet, using the following mandatory parameters:
    1. ServerAddress
      Provide the name of the computer hosting the Data Governance server, and the port. Enter in the form computername:port number. The default port is 8723.
    2. CategoryId
      The ID of the category you want to move.
    3. ParentCategoryId
      The ID of the category under which you want the category to appear.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级