Setting Up Scan Profiles

Used to determine the type of scan and limits around the scan job. This allows for more advanced configurations which can include limiting the number of schema/tables/rows for structured data sources, or shares/sites/folders/files for unstructured, inclusion/exclusion of a certain path, file types, or limit file sizes, which can result in more target scans and ensuring a consistent approach to your organization's discovery needs and goals.

OneTrust provides seeded scan profiles for select data sources that are preconfigured with suggested settings for getting started implementations.

Note:

Some features and fields in this article may only be available as a preview feature. Please reach out to your OneTrust Team or OneTrust Support to learn how you can get early access to the complete suite of features.

Viewing Scan Profiles

  1. On the Data Discovery module menu, select Setup > Scan Profiles. The Scan Profiles screen appears.

    Any existing scan profiles will be populated in this screen with their accompanying details:

    • Name

    • Scan Type

    • System

    • Created By

    • Created Date

  2. Click the Filter icon to sort and surface scan profiles by the following values:

    • Scan Type

    • System

    • Created By

    • Created Date

To add a new scan profile

Important:

This article uses Amazon S3 as the example system type to demonstrate the general flow and approach to scan profile configuration. For this reason, you may notice slight variances in setting names and populated fields between file systems, native compute, web, etc.

Every system will be unique and may require prescriptive customization based on the given data source and your organization's discovery needs. For more guidance on this process, please reference your system's official documentation and work closely with your OneTrust Team as you set up scan profiles for Data Discovery.

  1. On the Data Discovery module menu, select Setup > Scan Profiles. The Scan Profiles screen appears.

  2. Click the Add New Scan Profile button. The Select Scan Profile Type screen appears.

  3. Select from the field your desired system to set up a scan profile.
    Note:

    For a list of all currently supported systems, please reference Data Discovery Deployment Options.



  4. Click the Next button. The Enter Scan Profile Details screen appears.

To configure a scan profile

Note:

Default limits for scans have been set up for data sources to minimize resource use.

  1. On the Enter Scan Profile Details screen, start by providing a name for the profile.
  2. Complete the fields, then click the Save button. For more information, see Possible Fields for Scan Profile Configuration .


  3. Click the Save button.

Possible Fields for Scan Profile Configuration

Field
Description
Scan Type

Choose the type of scan you want to perform:

Catalog

: This scan type will collect the metadata for the objects.

Catalog & Scan

: Metadata will be collected for the required services and then data extraction will be performed. It will return the personally identifiable information/data elements and terms as per the classification label identified.

Note:

Each specific system will have unique collection needs and options for the chosen scan type. Please reference the available connector guides in the Data Discovery Knowledge Base for more details.

Enable OCR for Images

This setting will only appear if the scan type is set to Catalog & Scan.

Enable Indexing

This setting will only appear if the scan type is set Catalog & Scan.

This informs OneTrust to enable the indexing of data so whatever is collected can be used to automate the service of data subject requests.

Clear Indexing

This setting will only appear if the scan type is set to Catalog & Scan.

This informs OneTrust to clear the indexing of data so whatever data was used to service a data subject request will be cleared.

Minimum File Size

Enter a minimum file size limit. Any files smaller than this limit will be excluded from any type of scan.

File size increment options:

  • Bytes

  • KB

  • MB

  • GB

Maximum File Size

Enter a maximum file size limit. Any files larger than this limit will be excluded from any type of scan.

File size increment options:

  • Bytes

  • KB

  • MB

  • GB

Incremental Scan

Limit scans to only files modified or created since the last scan, or in a user-designated window of days.

Choose the incremental scan limitation from the last scan date or during a window ranging from the last 24 hours or up to 1 year. All generally available connectors also include a free text field for their scan profile's incremental scan setting in order to create a custom interval rate.

Incremental Scan Behavior

baseline

The first successful scan is considered a full scan. This becomes the baseline. Canceled or In Progress scans cannot become the.

incremental scan

After this, the next scan only looks for new or changed data based on last modified date. This becomes the.

Note:

This is currently only available for the following data sources:

  • Amazon S3

  • Box

  • Databricks

  • Exchange Online

  • Google Cloud Storage

  • Google Workspace Drive

  • Google Workspace Gmail

  • NFS

  • OneDrive

  • sFTP

  • SharePoint

  • SharePoint 2019 (On-Premises)

  • SMB

  • Snowflake

Intelligent Sampling Scan

A more efficient and unbiased sampling approach to maintain accuracy and representation across an entire dataset.

Note:

Available for Snowflake and RDBMS data sources for customers with solution packaging only. Available for Catalog & Scan type scan profiles only.

Limit Number of Objects/Records to Scan

Enable this setting to populate the following additional fields to enter the maximum number of objects, records, tables, rows, etc.

Select Limitation Method for Scanning Rows per Table
Representative dataset scanning offers limitation methods to only scan a certain percentage of the total objects, a specific object count, or a combination of both. This functionality gives users a better understanding of the data held in the data source without having to run full scans so that their scan is tailored to their exact specifications.

Supported for structured (RDBMS) data sources only. Available for Catalog & Scan type scan profiles only.

  • First with Limit: selects top N rows from the database. N defined as a configuration in the scan profile.

  • Random Percentage: selects rows randomly, based on the specified percentage, and retrieves that proportion of rows from the table.

  • Random Percentage with Limit: selects rows randomly, based on the specified percentage, and retrieves that proportion of rows from the table.

Scan Tables or Views

Appears for select data sources and systems. Allows user to choose whether the scan profile is applicable for scanning tables or views.

File Types to Scan

Appears for select data sources and systems. Allows user to select only the files that should be included or excluded regardless of any specified inclusion paths.

Exclude File Types from Scan

Enable this to exclude any of the specified file types from your scan regardless of any inclusion path you may have specified.

Note:

Enter a list of file extensions, separated by commas. e.g. "pdf, pptx"

Include Paths

Fill out each field below to add them to the list. Select the Add button to add a new row, and the Remove button to remove a row.

Note:

The include path can be used to share Amazon S3 scans across accounts. Use * as wildcard, \ as escape character. Fields also are case sensitive.

Exclude Paths

Fill out each field below to add them to the list. Select the Add button to add a new row, and the Remove button to remove a row.

Note:

Use * as wildcard, \ as escape character. Fields also are case sensitive.

Tip:

Previously cataloged schemas are not excluded or deleted from the Data Catalog if the scan profile is updated. You must create, configure, and scan a new data source to remove said schemas from the Data Catalog.

Browse Data Dictionary

Browse the Data Dictionary for included/excluded objects when setting up scan profile paths for data sources. For more information, see To browse the data dictionary.

To browse the data dictionary

When selecting inclusion and exclusion paths for the scan profile, you can browse the data dictionary and select from a generated list (based on system selection) of available data sources. This allows users to select specific objects in the Data Dictionary after an initial catalog-only scan has been completed.

Note:

Not currently supported for Sharepoint 2019 (On-Premises).

  1. Under the Include Paths or Exclude Paths section, click the Browse Data Dictionary button. The Browse Data Dictionary for [System-Type] appears.

  2. Navigate through the available cataloged data sources to choose which objects to include or exclude from the scan.
    Tip:

    Use the search function to locate child objects within the current level. The results will also surface objects that contain metadata matching your search query.



  3. Click the Confirm button. The selected data source > object path will be listed.


To copy an existing scan profile configuration

You can create a custom scan profile by copying one of the available seeded options. This allows you to configure the scan settings and preferences as necessary for unique scan use cases.

  1. On the Data Discovery menu, click Setup > Scan Profiles. The Scan Profiles screen appears.

  2. Locate your desired scan profile, then hover over the row to reveal the Context Menu icon.
  3. Click the icon, then select Copy. The Scan Profile Details screen appears.

  4. The default name for the copied scan profile will have "copy" appended to the given name. Customize this name as necessary.
  5. Configure settings and preferences for this new scan profile. For more information on the available fields, see To configure a scan profile.
  6. Click the Save button. Your new coped scan profile will be added to the Scan Profiles list screen.

To migrate scan profile configurations

Things to Know

  • Seeded scan profiles can be exported, however, you'll need to rename before importing to avoid a duplicate naming error.

  • All configurations will be retained in the JSON file and properly applied when imported.

  • The JSON file "owner" will default to the top level organization name.

  • Max JSON file size is 32MB.

Import Scan Profiles

  1. On the Data Discovery menu, click Setup > Scan Profiles. The Scan Profiles screen appears.

  2. Click the Import button. The Import modal appears.

  3. Click the Select File button to upload the local JSON file.
  4. Click the Import button. A new scan profile will be added to the Scan Profiles list screen.

Export Scan Profiles

  1. On the Data Discovery menu, click Setup > Scan Profiles. The Scan Profiles screen appears.

  2. Locate your desired scan profile, then hover over the row to reveal the Context Menu icon.
  3. Click the icon, then select Export. A JSON file will be downloaded locally.

Connectors With Quick Scan Profiles

All generally available connectors come with a seeded scan profile called Quick Scan. This option is a simple configuration with limits on sample data to avoid full scans.

Note:

These scan profiles are read-only and cannot be modified.



Connectors with Quick Catalog Profiles

All generally available connectors come with a seeded scan profile called Quick Catalog. This option is a simple configuration with limits on sample data to avoid full catalogs.

Note:

These scan profiles are read-only and cannot be modified.



Deny Lists for Scanners

Storage Scanner

The file extensions listed below are excluded from scan jobs by default either because of irrelevance or to improve scan job health.

Note:

You can override the default functionality by including these in the scan profile configuration's Include setting.

CODE 
*.adadownload, *.adm, *.aso, *.bak, *.bc, *.bdm, *.bdi, *.blf, *.bk?, *.bmb, *.bmc, *.box, *.bridgecache, *.bridgecachet, *.bsd, *.bu, *.buf, *.cache, *.cache-3 *.cah, *.cdc, *.cfa *.chk, *.chkn, *.ci, *.clp, *.Cos2, *.crc, *.crdownload, *.csd, *.csi, *.css, *.csstore, *.cpp, *.cpy, *.cvr, *.dap, *.dat, *.db-shm, *.db-wal, *.db$, *.dca, *.dia, *.dll, *.dmp, *.download, *.dmp, *.dtapart *.dtf, *.egt, *.err, *.etl, *.ewc2, *.exe, *.exd, *.fic, *.filepart, *.fnd, *.fsf, *.fuse_hidden, *.ftg, *.fts, *.gid, *.glh, *.hax, *.hlp, *.heu, .hex, *.hrd, *.h64, *.idlk, *.imgcache, *.ims.tmd, *.indexpositions, .indexarrays, .init,*.installstate, *.inprogress, *.Isl, *.js, *.laccdb, *.lai, *.lck, *.little, *.lock, *.log, *.m_p, *.mbc, *.md0, *.meb, *.mex, *.mmsyscache, *.ms, *.msj, *.mxdl, *.nb2, *.nov, *.objectcache, *.onecache, *.part, *.partial, *.peb *.pft, , *.phc, *.pkc, *.pkf, *.pm$, *.pnf, *.prmdc, *.ptn2 *.qbt, *.rdn, *.reapeaks, *.rec, *.regtrans-ms, *.rld, *.rra, *.rsc_tmp, *.rsx, *.sav, *.sfk, *.snapdoc, *.steamstart, *.swn, *.swo, *.tec, *.temp, *.temporaryitems, *.thumbdata, *.thumbdata3, *.thumbdata4, *.thumbdata5, *.tic, *.tmt, *.tmp, *.tof, *.tt2, *.tv5, *.utpartv.bom, *.waf, *.wcc, *.wfm, *.wov, *.xp, *.ytf, *.00a, *.dinfo, *.$$$, *.---

RDBMS Scanner

This scanner type uniquely excludes the following schemas per connector for both catalog and scan classification.

Note:

If you wish to override this default exclusion, please contact your implementation consultant to assist with your business needs.

Connector

Denied Schemas

Amazon Athena
CODE 
INFORMATION_SCHEMA

Amazon Redshift
CODE 
catalog_history
information_schema
pg_catalog
pg_catalog_history
pg_internal
pg_public
public

DB2
CODE 
nullid
sqlj
syscat
sysfun
sysibm
sysibmadm
sysibminternal
sysproc
syspublic
sysstat
systools
sysibmts

MySQL
CODE 
information_schema
model
msdb
performance_schema
sys
tempdb

Oracle
CODE 
apex_040000
anonymous
apex_050000
apex_public_user
appqossys
audsys
ctxsys
dbsfwuser
dbsnmp
dip
dvsys
dvf
flows_files
ggsys
gsmadmin_internal
gsmcatuser
gsmuser
lbacsys
mddata
mdsys
ordplugins
ordsys
orddata
outln
oracle_ocm
remote_scheduler_agent
si_informtn_schema
spatial_csw_admin_usr
sys
system
sysbackup
syskm
sysdg
sysrac
sys$umf
wmsys
xdb
xs$null
ojvmsys
olapsys

PostgreSQL
CODE 
information_schema
pg_catalog
pg_temp_1
pg_toast
pg_toast_temp_1

SAP Hana
CODE 
_SYS_AFL
_SYS_AUDIT
_SYS_BI
_SYS_DATA_ANONYMIZATION
_SYS_EPM
_SYS_EPM_DATA
_SYS_EPM_DATA
_SYS_LDB
_SYS_PLAN_STABILITY
_SYS_REPO
_SYS_RT
_SYS_SECURITY
_SYS_SQL_ANALYZER
_SYS_STATISTICS
_SYS_TABLE_REPLICAS
_SYS_TASK
_SYS_TELEMETRY
_SYS_WORKLOAD_REPLAY
_SYS_XS
HANA_XS_BASE
SAP_AUTHORIZATION
SAP_HANA_ADMIN
SAP_HANA_BACKUP
SAP_HANA_IM_DP
SAP_HDM
SAP_HDM_DDO
SAP_HDM_DLM
SAP_INA_FILELOADER
SAP_PA_APL
SAP_RE
SAP_REST_API
SAP_XS_LM
SAP_XS_LM_PE
SAP_XS_LM_PE_TMP
SAP_XS_USAGE
SYS
SYSTEM
T_API
UIS

Snowflake
CODE 
INFORMATION_SCHEMA
PUBLIC

SQL Server
CODE 
db_accessadmin
db_backupoperator
db_datareader
db_datawriter
db_ddladmin
db_denydatareader
db_denydatawriter
db_owner
db_securityadmin
sys
guest
INFORMATION_SCHEMA

Teradata
CODE 
Crashdumps
All
DBC
dbcmngr
Default
External_AP
EXTUSER
LockLogShredder
PUBLIC
Sys_Calendar
SysAdmin
SYSBAR
SYSJDBC
SYSLIB
SYSSPATIAL
SystemFe
SYSUDTLIB
SYSUIF
TD_SERVER_DB
TD_SYSFNLIB
TD_SYSGPL
TD_SYSXML
TDStats
TDMaps
TDPUSER
TDQCD
tdwm
SQLJ