<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-discovery-classification
description: >-
  Discover and classify sensitive data across structured and unstructured
  storage including databases, file shares, cloud buckets, and SaaS platforms
  using automated scanning, pattern matching, and ML-based classification.
domain: cybersecurity
subdomain: data-security
tags:
  - data-discovery
  - data-classification
  - dspm
  - sensitive-data
  - compliance
  - data-inventory
  - cloud-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1083"]
---

# Performing Data Discovery & Classification

## Overview

Data discovery identifies where sensitive data resides across the environment.
Classification assigns sensitivity labels based on content, context, and
regulatory requirements. Together they form the foundation of data security —
you cannot protect what you cannot find. This skill covers automated discovery
scanning, classification taxonomy design, and continuous monitoring for
data sprawl.

Mode: `[MODE: BLUE]` — Data discovery and classification operations.

## Prerequisites

- Inventory of data storage locations (databases, file shares, cloud buckets)
- Classification taxonomy (Public, Internal, Confidential, Restricted)
- Scanner credentials with read-only access to target data stores
- DSPM tool or custom scanning capability

## Key Concepts

### Classification Taxonomy

| Level | Label | Examples | Controls |
|-------|-------|----------|----------|
| L0 | Public | Marketing materials, press releases | None |
| L1 | Internal | Policies, org charts, meeting notes | Access control |
| L2 | Confidential | Financial reports, strategy docs | Encryption + ACL |
| L3 | Restricted | PII, PHI, PCI, trade secrets | Encryption + DLP + audit |

### Discovery Targets

```
Data store inventory:
├── Structured
│   ├── Relational databases (PostgreSQL, MySQL, MSSQL)
│   ├── Data warehouses (Snowflake, BigQuery, Redshift)
│   └── NoSQL (MongoDB, DynamoDB, Cassandra)
├── Semi-structured
│   ├── JSON/XML files on file shares
│   ├── Log files and application output
│   └── Email archives (PST, MBOX)
├── Unstructured
│   ├── File shares (SMB, NFS)
│   ├── Cloud storage (S3, GCS, Azure Blob)
│   ├── Collaboration (SharePoint, Google Drive)
│   └── Code repositories
└── Shadow data
    ├── Developer local copies
    ├── Unsanctioned SaaS uploads
    └── Backup copies in non-production environments
```

### Scanning CLI

```bash
# Scan a directory for sensitive data
node scripts/agent.js --action discover --input /data/exports/ \
  --extensions ".csv,.json,.xml,.sql" --output /tmp/discovery.json

# Classify discovered data by sensitivity
node scripts/agent.js --action classify --input /tmp/discovery.json \
  --output /tmp/classified.json

# Generate data inventory report
node scripts/agent.js --action inventory --input /tmp/classified.json \
  --output /tmp/data_inventory.json
```

## Workflow

### Step 1: Enumerate Data Stores

Build a complete inventory of all storage locations.

### Step 2: Run Discovery Scans

```bash
node scripts/agent.js --action discover --input /data/exports/ \
  --extensions ".csv,.json,.xml" --output /tmp/discovery.json
```

### Step 3: Apply Classification Labels

```bash
node scripts/agent.js --action classify --input /tmp/discovery.json \
  --output /tmp/classified.json
```

### Step 4: Generate Inventory

```bash
node scripts/agent.js --action inventory --input /tmp/classified.json
```

## Detection

```yaml
title: Data Discovery Classification Detection
id: 73958205-fa11-4c8f-a178-548057388cef
status: experimental
description: Detects suspicious activity related to performing data discovery classification techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1083
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] All known data stores scanned for sensitive content
- [ ] Classification taxonomy applied consistently
- [ ] Shadow data locations identified and remediated
- [ ] Data inventory report generated with owner assignments
- [ ] Recurring discovery scans scheduled (weekly/monthly)
- [ ] Newly provisioned data stores auto-enrolled in scanning
- [ ] Classification accuracy validated with sample review

## References

- [NIST SP 800-60 — Mapping Information to Security Categories](https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final)
- [GDPR Article 30 — Records of Processing Activities](https://gdpr-info.eu/art-30-gdpr/)
- [PCI DSS Requirement 3.1 — Data Retention Policy](https://www.pcisecuritystandards.org/)
- [Cloud Security Alliance — Data Discovery and Classification](https://cloudsecurityalliance.org/)
