A connection rule uses a matcher and a rule action to identify and route a connection. The matcher defines the criteria that the Rule Engine uses to identify a match. The rule action determines how the Rule Engine processes the matched connection.

When the Dynamic Data Masking service receives a connection request, the Rule Engine applies connection rules to the connection. If the connection request matches the criteria defined by the matcher, the Rule Engine applies the rule action to the connection. After the Rule Engine applies the rule action, the Rule Engine applies processing action. The processing action defines the next action that the Rule Engine applies to the request.