Data Masking

Data Masking hides sensitive information in investigation results and event data. Data masking is configured at the account level and, when enabled, masks sensitive fields in new data returned by IQL and Natural Language queries. Detection events are not affected by data masking and continue to display unmasked data.

Masking is applied at query execution time and persists with the saved results, supporting consistent auditing and data privacy compliance.

Access to unmasked data is controlled through the Sensitive Data Viewer user role. Results are determined by the role of the user who first runs the query:

• If created by a user without masking, all viewers see unmasked data;
• If created with masking, all viewers see masked data, including those with the Sensitive Data User role.

To enable Data Masking:

1. Go to Settings > Account Management > Settings.
2. Scroll down to Data Masking and enable it.
3. Click Confirm.

To assign the Sensitive Data Viewer user role:

1. Go to Settings > Account Management > Users.
2. Select a user and click Assign Role.
3. From the Assign role dropdown, select Sensitive Data Viewer.
4. From the On account dropdown, select the account.
5. Click Assign.