Mask sensitive data in Live Debugger snapshots
- Latest Dynatrace
- How-to guide
- 4-min read
Live Debugger captures the full runtime state of a non-breaking breakpoint, including variable values that your application is processing at that moment. Some of those values—passwords, tokens, API keys, email addresses, or payment data—should never be exposed to the person debugging.
Sensitive data masking rules let you declare which values Live Debugger must not collect. Matching values are replaced before the snapshot is created.
Masking is performed by OneAgent on your own host. Values that match a masking rule never leave your server or network, so they are not transmitted to or stored by Dynatrace.
How masking rules work
A masking rule has three parts: what it matches, how it matches, and what it replaces the value with.
Rule types
| Rule type | What it matches |
|---|---|
Redact by variable name | The name of the variable. When a variable name matches, its entire value is redacted, whatever that value contains. |
Redact by regex | The variable value. Any part of a value that matches the regular expression is redacted. |
The two rule types identify data differently: a name-based rule redacts a value because of what the variable is called, and a regex rule redacts it because of what the value contains. Use a regex rule when the data you need to protect is recognizable by its format rather than by a variable name.
Variable name matching
For a Redact by variable name rule, choose how the name is compared:
- Equals—the name is exactly the input string.
foomatches onlyfoo. - Contains—the name includes the input string.
foomatchesmyfoobarandfoo123. - Starts with—the name begins with the input string.
foomatchesfoobarandfoo123. - Ends with—the name ends with the input string.
foomatchesmyfooandbarfoo.
Replacement values
Redacted data is replaced with \*\*\* by default.
You can set a different replacement for each rule:
- A custom string. A rule for the variable name
secretKeywith the replacementREDACTEDturnssecretKey:12345intosecretKey:REDACTED. - An SHA-256 hash of the original value. Use this when you need to tell two redacted values apart—for example, to confirm that the same token appeared in two different snapshots—without seeing either one.
Rule order
Rules are evaluated in the order they appear on the Sensitive data masking page, and the first matching rule wins. You can reorder them.
Define a masking rule
- Go to Settings > Observability for Developers > Sensitive data masking.
- Select Add rule.
- Set Name to a display name for the rule.
- Select the rule type, then enter the variable name and comparison type, or the regular expression.
- Set the replacement value.
- Save the rule, and reorder it if an earlier rule would match the same data first.
Masking and programmatic access
Because OneAgent applies masking, redacted data never leaves your network and is never ingested or stored in Dynatrace. A value that matches a rule is replaced in the snapshot itself rather than hidden when the snapshot is displayed.
Snapshot data that you retrieve with dtctl is redacted the same way it is in the Live Debugger app.
This matters when an AI agent or an automated workflow reads snapshot data on your behalf: the agent receives the masked value, not the original.
What masking does not do
- Masking is not access control. It removes values from the snapshot. To control who can read the snapshots you do collect, see Set up Grail permissions for Snapshots.
- Name-based rules do not inspect values. A credit card number stored in a variable named
payloadis not redacted by a rule matching the namecreditCard. Use a Redact by regex rule when the value format, not the name, is what identifies the data.
Live Debugger