Introduction to sensitive data classification¶

About classification categories¶

With sensitive data classification, every column that is identified as containing sensitive data is assigned two categories: a semantic category and a privacy category.

• A semantic category identifies the type of personal attribute. Snowflake provides native categories for common attributes such as names and addresses. If your sensitive data doesn’t fit into a native category, you can create a custom category for it.

• A privacy category identifies the sensitivity of a personal attribute. It can be either IDENTIFIER, QUASI_IDENTIFIER, or SENSITIVE (a generic, non-identifier category for things such as salary).

About classification tags¶

A tag is a Snowflake object that can be assigned to a column. Snowflake uses the following system-defined tags to identify columns that it has classified as containing sensitive data.

• SNOWFLAKE.CORE.SEMANTIC_CATEGORY: Tag used to identify the native or custom category of the data in a column.

• SNOWFLAKE.CORE.PRIVACY_CATEGORY: Tag used to identify the privacy category of the data in a column.

You can map user-defined tags to system-defined classification tags. For example, you can set up a tag map so that every time the system tag SNOWFLAKE.CORE.SEMANTIC_CATEGORY = 'NAME' is applied to a column, the user-defined tag tag_db.sch.pii = 'Highly confidential' is also applied.

About classification profiles¶

When you use the Trust Center web interface to specify classification settings, those settings are saved as a classification profile. This classification profile can be edited later to change the settings that control how data is classified. In the web interface, the classification profile also controls which databases are being classified with the profile’s settings.

You can also use SQL commands to create and modify a classification profile. If you are using SQL, associating the classification profile with a database to start the classification process is a separate step.

View costs in Snowsight¶

To explore the cost of sensitive data classification:

1. Sign in to Snowsight.

2. Switch to a role with access to cost and usage data.

3. In the navigation menu, select Admin » Cost management.

4. Select a warehouse to use to view the usage data. Snowflake recommends using an XS warehouse for this purpose.

5. Select Consumption.

6. From the Usage Type drop-down, select Compute.

7. From the Service Type drop-down, select Sensitive Data Classification.

Use SQL to query costs¶

You can query views in the ACCOUNT_USAGE and ORGANIZATION_USAGE schemas to determine how much was spent on automatically classifying sensitive data. To monitor credit consumption, query the following views:

METERING_HISTORY view (ACCOUNT_USAGE)

Lets you retrieve the hourly cost of automatic classification by focusing on SENSITIVE_DATA_CLASSIFICATION in the SERVICE_TYPE column. For example:

SELECT
  service_type,
  start_time,
  end_time,
  entity_id,
  name,
  credits_used_compute,
  credits_used_cloud_services,
  credits_used,
  budget_id
  FROM SNOWFLAKE.ACCOUNT_USAGE.METERING_HISTORY
  WHERE service_type = 'SENSITIVE_DATA_CLASSIFICATION';

Copy

METERING_DAILY_HISTORY view (ACCOUNT_USAGE and ORGANIZATION_USAGE)

Lets you retrieve the daily cost of automatic classification by focusing on SENSITIVE_DATA_CLASSIFICATION in the SERVICE_TYPE column. For example:

SELECT
  service_type,
  usage_date,
  credits_used_compute,
  credits_used_cloud_services,
  credits_used
  FROM SNOWFLAKE.ACCOUNT_USAGE.METERING_DAILY_HISTORY
  WHERE service_type = 'SENSITIVE_DATA_CLASSIFICATION';

Copy

USAGE_IN_CURRENCY_DAILY (ORGANIZATION_USAGE)

Lets you retrieve the daily cost of automatic classification by focusing on SENSITIVE_DATA_CLASSIFICATION in the SERVICE_TYPE column. Use this view to determine the cost in currency, not credits.