<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: implementing-security-data-classification
name: implementing-security-data-classification
description: "Techniques and methodologies for implementing security data classification"
subdomain: security-data-engineering
title: "Implementing Security Data Classification"
description: "Techniques and methodologies for implementing security data classification"
tags:
  - data-classification
  - DLP
  - compliance
  - data-governance
  - sensitivity-labels
metadata:
  mitre-attack: ["T1083"]
---

# Implementing Security Data Classification

> Build automated data classification systems that tag, label, and categorize security data by sensitivity, compliance requirements, and retention policies.

## Overview

Security data classification ensures that logs, alerts, and forensic artifacts are properly labeled for access control, retention, and compliance. This technique covers automated classification pipelines, sensitivity taxonomies, and integration with DLP systems.

## Core Concepts

- **Sensitivity taxonomy**: Define classification levels (Public, Internal, Confidential, Restricted)
- **Content inspection**: Regex, NLP, and ML-based classifiers for PII/PHI/PCI detection
- **Metadata tagging**: Apply labels at ingestion time for downstream policy enforcement
- **Retention policies**: Map classification levels to storage tiers and TTL values
- **Access control integration**: Enforce RBAC/ABAC based on data classification labels

## Workflow

1. Define data classification taxonomy aligned with organizational policy
2. Inventory existing security data sources and current labeling state
3. Build content inspection rules for sensitive data patterns
4. Implement automated classification pipeline at ingestion
5. Apply metadata tags and sensitivity labels to data stores
6. Configure retention policies per classification level
7. Integrate with DLP and access control systems
8. Validate classification accuracy with labeled test datasets
9. Monitor classification drift and false positive rates
10. Report classification coverage metrics to stakeholders

## Implementation

```python
import re
from dataclasses import dataclass
from enum import Enum
from typing import Optional


class SensitivityLevel(Enum):
    PUBLIC = "public"
    INTERNAL = "internal"
    CONFIDENTIAL = "confidential"
    RESTRICTED = "restricted"


@dataclass
class ClassificationResult:
    level: SensitivityLevel
    reasons: list[str]
    confidence: float
    patterns_matched: list[str]


class SecurityDataClassifier:
    """Automated security data classification engine."""

    PATTERNS: dict[str, tuple[str, SensitivityLevel]] = {
        "ssn": (r"\b\d{3}-\d{2}-\d{4}\b", SensitivityLevel.RESTRICTED),
        "credit_card": (r"\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b", SensitivityLevel.RESTRICTED),
        "email": (r"\b[\w.+-]+@[\w-]+\.[\w.]+\b", SensitivityLevel.CONFIDENTIAL),
        "ip_address": (r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b", SensitivityLevel.INTERNAL),
    }

    def classify(self, content: str) -> ClassificationResult:
        matched = []
        highest = SensitivityLevel.PUBLIC
        for name, (pattern, level) in self.PATTERNS.items():
            if re.search(pattern, content):
                matched.append(name)
                if level.value > highest.value:
                    highest = level
        confidence = min(1.0, len(matched) * 0.3 + 0.4) if matched else 0.2
        return ClassificationResult(
            level=highest,
            reasons=[f"Pattern matched: {m}" for m in matched],
            confidence=confidence,
            patterns_matched=matched,
        )
```

## Best Practices

- Classify data at ingestion—retroactive classification is expensive and error-prone
- Use layered classification: rule-based first, ML-based for ambiguous content
- Audit classification decisions for compliance evidence
- Implement override workflows for analyst reclassification
- Test classifiers against adversarial evasion (encoded PII, split tokens)
- Align classification taxonomy with regulatory frameworks (GDPR Art. 9, HIPAA §164.514)

## Detection

```yaml
title: Security Data Classification Detection
id: 2ef476a5-9e95-4825-8a7d-b962fd86b811
status: experimental
description: Detects suspicious activity related to implementing security data classification techniques in security data engineering context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*security*"
  condition: selection
level: medium
tags:
  - attack.t1083
  - attack.collection
falsepositives:
  - Data pipeline ETL processes during scheduled batch windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Security Data Classification Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1083 |

## Related Techniques

- [Building Security Event Correlation Engine](../building-security-event-correlation-engine/SKILL.md)
- [Performing Security Data Migration](../performing-security-data-migration/SKILL.md)
