[jmperez127]

Summary

Access Analyzer 26.1 replaced sensitive data patterns and pattern groups with classifiers. A classifier combines patterns, word lists, and checksums with filters and severity rules, and reports each finding as Critical, High, Medium, or Low. The scan type that runs them is now called Classification, and scans pick classifiers directly or by label instead of pattern groups. This PR documents the new experience and retires the Sensitive Data Patterns section.

Product changes covered include netwrix-corp/access-analyzer#893 (Files tab and decision traces), #1261 (classifier filters and the pattern drawer), and #1378 (classifier library, lists, and checksums).

Changes

New section: configuration/classifiers/

• index.md: what a classifier is, the Classifiers page and its four tabs, row actions, publishing, built-in classifiers and your copy, how a scan picks its classifiers, the automatic conversion of pattern groups, and where findings appear.
• build-a-classifier.md: the builder's sections (Run if, Detectors, Severity variables, Severities), a worked Employee ID example, the detector kinds (pattern and System One), detector filters, System One questions and severity reviews, severity conditions, and the Test panel with its decision tree.
• patterns.md: the Patterns tab, creating regex and keyword list patterns, the RE2 dialect, testing, and copying a built-in pattern.
• lists.md: word lists, their limits, and binding a list to a pattern as labels, context words, or column headers.
• checksums.md: the 17 built-in checksums and the visual checksum builder with valid and invalid examples.
• 17 new screenshots in static/images/accessanalyzer/26.1/classifiers/.

Removed

• configuration/sensitive-data-patterns/ and its images, plus the two pattern group screenshots under scans/. The old addresses redirect to the new pages in src/config/redirects/accessanalyzer-26.1.js.

Updated

• admin/scans/scan-types.md: Sensitive Data Scan becomes Classification Scan, and the Pattern Groups section becomes Classifiers, describing the wizard's new Classifiers step.
• admin/scans/scan-executions.md: new Files tab section with the decision view, masked evidence, and file list retention settings.
• admin/scans/index.md and the SMB and SharePoint Online getting started guides: wizard steps now use the Classifiers step.
• The rest of the 26.1 pages: the scan type is renamed from Sensitive data to Classification, and links to the old section now point at Classifiers.

Notes for reviewers

• The Sensitive Data Overview report still filters by pattern group and pattern in the product, so admin/dashboards-reports/reports/data.md keeps that wording.
• UI labels, limits, and messages were checked against the webapp source and a current build.

Test plan

• DOCS_PRODUCT=accessanalyzer DOCS_PRODUCT_LATEST_ONLY=true npm run build passes. The only broken link it reports is the existing cross-product link on integrations/netwrix-activity-monitor.
• Pre-commit hooks pass on every changed file (Vale, Dale, anchors).
• New pages and screenshots reviewed in the Docusaurus dev server.

Update: tutorials and edits to existing pages

New: configuration/classifiers/tutorials/

Four tutorials in a new collapsed Tutorials category (configuration/classifiers/tutorials/_category_.json). In the sidebar it sits under Configuration > Classifiers, after Checksums. The tutorials appear in this order:

1. Build a VIN checksum: docs/accessanalyzer/26.1/configuration/classifiers/tutorials/build-a-vin-checksum.md
2. Build a VIN classifier: docs/accessanalyzer/26.1/configuration/classifiers/tutorials/build-a-vin-classifier.md
3. Build an MRZ checksum: docs/accessanalyzer/26.1/configuration/classifiers/tutorials/build-an-mrz-checksum.md
4. Build an MRZ classifier: docs/accessanalyzer/26.1/configuration/classifiers/tutorials/build-an-mrz-classifier.md

The 31 screenshots are in static/images/accessanalyzer/26.1/tutorials/. They were taken against Access Analyzer main.

Updated: existing pages

• Removed hard-coded counts, such as the number of built-in classifiers, from four pages: configuration/classifiers/index.md, configuration/classifiers/checksums.md, getting-started/index.md, and getting-started/key-concepts.md.
• Converted the headings and titles this branch adds or changes to sentence case on 9 pages. UI labels keep their capitals.
• Filled gaps in five places:
  • Classifiers are published when you save them.
  • Add filter takes two clicks.
  • Detectors that read the same pattern must use the same checksum.
  • How tables are detected.
  • A checksum validates a pattern's named capture group.
• Removed the OCR mentions. The docs assume text in images and scanned PDFs is read in the background.

Drafted-With: /doc-draft

[github-actions]

Auto-Fix Summary

1 issues fixed, 6 skipped across 33 files

Category	Fixes
OxfordComma (rewrite)	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/admin/scans/scan-types.md:103 — Dale: passive-voice | 'The labels are evaluated each time the scan runs' has no stated actor; an active rewrite would need to introduce one |
| docs/accessanalyzer/26.1/configuration/classifiers/index.md:78 — Dale: passive-voice | 'Only published classifiers are offered to scans' has no stated actor; an active rewrite would need to introduce one |
| docs/accessanalyzer/26.1/configuration/sensitive-data-patterns/built-in-patterns.md:0 — Dale: n/a | file deleted in this change; nothing to check |
| docs/accessanalyzer/26.1/configuration/sensitive-data-patterns/custom-patterns.md:0 — Dale: n/a | file deleted in this change; nothing to check |
| docs/accessanalyzer/26.1/configuration/sensitive-data-patterns/index.md:0 — Dale: n/a | file deleted in this change; nothing to check |
| docs/accessanalyzer/26.1/configuration/sensitive-data-patterns/pattern-groups.md:0 — Dale: n/a | file deleted in this change; nothing to check |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

3 issues fixed, 2 skipped across 33 files

Category	Fixes
Dale: idioms	1
Dale: wordiness	2

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/admin/scans/scan-types.md:103 — Dale: passive-voice | 'The labels are evaluated each time the scan runs' would need an actor (Access Analyzer) that the sentence doesn't state |
| docs/accessanalyzer/26.1/getting-started/guides/sharepoint-online.md:92 — Dale: idioms | 'takes a while' has no documented duration to replace it with; a specific time would invent a fact |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Code Review

No correctness issues found.

The only non-doc change is src/config/redirects/accessanalyzer-26.1.js. I checked it and the files around it:

• Redirects: The new configuration/sensitive-data-patterns/* entries and the updated sensitive-data-patterns/* and configurations/sensitive-data entries all point to pages that exist (configuration/classifiers/ and configuration/classifiers/patterns). configuration/classifiers is in SECTION_INDEXES, so it gets the trailing slash. The deleted paths aren't in CURRENT_PAGES, so they still get unversioned redirects, and dedupe() finds no conflicting from entries.
• Deleted pages and images: Nothing in the repo still references sensitive-data-patterns (outside the redirect map) or the deleted create-scan-sensitive-3-configure* images.
• New images: Every /images/accessanalyzer/26.1/classifiers/* and /tutorials/* image the 26.1 pages reference is added in this PR.
• Sidebar: The renamed classifiers/_category_.json and the new tutorials/_category_.json are valid JSON with the usual fields.

The PR doesn't change any workflows, scripts, products.js, or docusaurus.config.js.

Minor, not blocking: static/images/accessanalyzer/26.1/classifiers/builder-builtin.webp is added but no page references it.

[github-actions]

Auto-Fix Summary

0 issues fixed, 0 skipped across 37 files

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/accessanalyzer/26.1/admin/scans/scan-executions.md

• Clarity — Line 33: This line introduces a View details action and a detail page with Logs, Performance, and Files tabs. The rest of the page still describes View logs opening a logs dialog: the Actions column on line 25, the statuses table, and the "View the Logs" section. A reader can't tell whether View details replaces View logs or sits beside it. Suggested fix: update the Actions column to list View details. Then either say that View logs opens the Logs tab of the detail page, or explain how the two differ.
• Clarity — Line 176 (File list retention table): The Decision traces row says "When off, the run records findings without a decision view." The same setting on configuration/settings/application.md says "Turn it off to stop recording findings and traces." The two descriptions conflict on whether findings are still recorded. Suggested fix: confirm the behavior and make both pages say the same thing, for example: "When off, the run records findings without a decision view."
• Structure — Line 140: "## Files tab" and its subsections use sentence case, but every other heading on this page is title case ("View the Logs", "Run a Scan Again"). Suggested fix: match the page, for example "## Files Tab", "### Explain a Finding", and "### File List Retention", or convert the whole page in one pass.

docs/accessanalyzer/26.1/admin/scans/index.md

• Structure — Line 140 (step 6): A step inside "Configure Scan Settings" tells the reader to choose classifiers on a step that comes before Configure. By this point the reader has already gone past that step. The page also still says "Creating a scan takes five steps: Type, Target, Configure, Schedule, and Review" and "Step N of 5", so it never mentions the new Classifiers step. Suggested fix: add a "### Select the Classifiers" section between "Select the Target" and "Configure Scan Settings" that covers Specific classifiers and Classifiers matching labels. Drop step 6, and update the step count in the intro to include Classifiers for Classification scans.
• Completeness — Lines 87–90: The step now offers Classification, but the screenshot alt text under it still reads "Access, Sensitive data, and Identity sync cards". Suggested fix: update the alt text, and the screenshot if the card label changed, so they show Classification.

docs/accessanalyzer/26.1/admin/scans/scan-types.md

• Structure — Lines 53, 72, 87, 98, 109: The renamed headings use sentence case ("Classification scan", "File Server settings for Classification scans"), but the other sections on the page use title case ("Access Scan", "Identity Sync", "Reports Fed by Access Scans"). Suggested fix: "## Classification Scan", "### File Server Settings for Classification Scans", "### SharePoint Online Settings for Classification Scans", and "### Reports Fed by Classification Scans".

docs/accessanalyzer/26.1/configuration/classifiers/build-a-classifier.md

• Clarity — Line 20 (and lines 105–118, 141–150): The page introduces "System One" without saying what it is. It describes asking System One questions, setting a confidence level, and picking a Model. A reader new to the product can't tell whether System One is an AI model, a Netwrix service, or an external one, whether it sends file content anywhere, or whether it needs any setup or licensing. No other page in the PR defines it either. Suggested fix: when the term first appears, add a sentence that defines it, for example: "System One is the AI model that Access Analyzer uses to answer questions about a file's meaning." Also say where it runs and whether it needs configuration. The page could also link to an overview on the Classifiers index page.
• Clarity — Line 19: "CEL expression" appears in the Run if row before the acronym is spelled out, which doesn't happen until the Severity rules table. Suggested fix: spell it out on first use: "File, CEL expression (Common Expression Language), and Group conditions".

docs/accessanalyzer/26.1/configuration/classifiers/index.md

• Clarity — Line 72: Try it "stays unavailable for about two minutes after a save, until scans can run the new version." The save message on build-a-classifier.md says "scans use it within a minute". These two timings don't agree. Suggested fix: use the same timing on both pages, or explain why Try it takes longer than scans.
• Clarity — Line 15: The Credit Cards example says it reports a card number that "passes the Luhn check and sits near a card label". On build-a-classifier.md, the Credit Cards classifier reports Medium for any number that passes the Luhn check, with no label required. Suggested fix: make the two examples describe the same rule.
• Clarity — [idiom] Line 6: "Each classifier that fires records a finding" — "fires" is figurative. Suggested fix: "Each classifier that reports a match records a finding".

docs/accessanalyzer/26.1/configuration/classifiers/lists.md

• Completeness — Line 49: "Under Scores a pattern's matches, click Add a pattern" doesn't say where that section is. The Create list procedure above it doesn't mention the section. Suggested fix: name where it appears, for example: "In the Create list or Edit panel, under Scores a pattern's matches, click Add a pattern". You could also add it as an optional step in "Create a list".

docs/accessanalyzer/26.1/configuration/classifiers/tutorials/build-a-vin-classifier.md

• Clarity — Line 205: The two failing tests give the reader conflicting explanations. A failed checksum gives Not reported: nothing matched. A missing label gives Not reported: no level's conditions held, and the Found line "lists matches before the label filter runs". The reader can't tell why one filter empties the Found line and the other doesn't. Suggested fix: add one sentence that explains the difference, for example: "The Found line lists matches that passed the checksum; the label filter is applied when the severity rules test the detector, so a VIN with no label still appears there but doesn't count."

docs/accessanalyzer/26.1/configuration/settings/index.md

• Clarity — Line 14: "Deployment-wide defaults for the Home page, Classification scans, classification, and the audit log" now lists classification twice. Suggested fix: "Deployment-wide defaults for the Home page, Classification scans, and the audit log".

docs/accessanalyzer/26.1/configuration/sources/index.md

• Clarity — Lines 18 and 21: Both rows now list "Classification scan" but still describe the collected data as "file contents matched against sensitive data patterns", which is the old model. Suggested fix: "file contents checked by the classifiers the scan selects" (and "document contents…" for SharePoint Online).

docs/accessanalyzer/26.1/configuration/sources/microsoft-365.md

• Clarity — Line 7: "Classification scans open the documents and look for sensitive data patterns" uses the old terminology. Suggested fix: "Classification scans open the documents and run classifiers against them."
• Structure — Line 167: The section body now describes Classification scans, but the heading above it is still "## Sensitive Data Scans", and "### Sensitive Data Scan Attributes" (line 329) is unchanged. Suggested fix: rename them to "## Classification Scans" and "### Classification Scan Attributes". Update any links to #sensitive-data-scans too.

docs/accessanalyzer/26.1/configuration/sources/smb-file-servers.md

• Clarity — Line 7: "Classification scans open the files and look for sensitive data patterns" uses the old terminology. Suggested fix: "Classification scans open the files and run classifiers against them."
• Structure — Line 122: The body now describes Classification scans under the unchanged heading "## Sensitive Data Scans". Suggested fix: rename it to "## Classification Scans" and update any links to its anchor.

docs/accessanalyzer/26.1/getting-started/key-concepts.md

• Structure — Line 48: The paragraph now defines a classifier, but its heading (line 46) is still "## Sensitive Data Pattern and Pattern Group". Pattern groups no longer exist as a concept. Line 36 also still calls the scan a "Sensitive Data Scan" that "matches it against sensitive data patterns". Suggested fix: rename the heading to "## Classifier" (or "## Classifier and Pattern"). Also update the Scan paragraph to "A Classification Scan reads file content and runs classifiers against it."

docs/accessanalyzer/26.1/getting-started/known-limitations.md

• Structure — Lines 43–45: The items now cover classifiers, but the section heading above them is still "## Sensitive Data Patterns". Suggested fix: rename it to "## Classifiers".
• Completeness — Line 43: The item says you can't edit or delete built-in classifiers or built-in lists, but built-in patterns and checksums are read-only too (see patterns.md and checksums.md). Suggested fix: "You can't edit or delete built-in classifiers, patterns, lists, or checksums. To change a built-in classifier or pattern, make your copy, which runs in its place; to change a built-in checksum, duplicate it; to change a built-in list, bind your own list to the same pattern."

docs/accessanalyzer/26.1/getting-started/guides/smb-file-servers.md

• Completeness — Line 115 (step 4): "To run every classifier for a regulation, pick it in the regulation filter first" doesn't say whether filtering also selects the classifiers. The reader may filter the list and then click Next with nothing selected. Suggested fix: "To run every classifier for a regulation, pick it in the regulation filter, and then select each classifier in the filtered list." If the step has a select-all control, name it instead.

docs/accessanalyzer/26.1/getting-started/guides/sharepoint-online.md

• Clarity — Line 116 (note): "Select the ones you care about before putting the scan on a schedule" suggests you can skip selecting classifiers at first. Every Classification scan has to name its classifiers, and step 4 already selects them. Suggested fix: replace the note with the published-classifier note from the SMB guide: "The Classifiers step lists only published classifiers. Every built-in classifier is published on a fresh install; see Classifiers."

No issues found in the following files: admin/dashboards-reports/dashboards/active-directory.md, admin/dashboards-reports/dashboards/data-security.md, admin/dashboards-reports/index.md, admin/dashboards-reports/reports/compliance.md, admin/dashboards-reports/reports/data.md, configuration/classifiers/checksums.md, configuration/classifiers/patterns.md, configuration/classifiers/tutorials/build-a-vin-checksum.md, configuration/classifiers/tutorials/build-an-mrz-checksum.md, configuration/classifiers/tutorials/build-an-mrz-classifier.md, configuration/index.md, configuration/service-accounts/username-password.md, configuration/settings/application.md, configuration/settings/feature-flags.md, configuration/sources/labels.md, getting-started/coming-from-access-analyzer-classic.md, getting-started/guides/index.md, and getting-started/index.md. The sensitive-data-patterns/ pages are deletions and weren't reviewed.

Summary

24 editorial suggestions across 15 files. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.