To use the WhiteList masking method, enable the WhiteList rule folder and disable the BlackList rule folder.

The WhiteList rule folder contains WhiteListGroups, WhiteListAttributeName, WhiteListAttributeValues, StopIfLDAPMatch, and MaskingRule rules.

If you want to define LDAP groups that do not receive masked data, enable the WhiteListGroups rule and disable the WhiteListAttributeName and WhiteListAttributeValues rules. In the WhiteListGroups rule, set the Groups symbol value to the list of LDAP groups that receive unmasked data. Enter the LDAP groups that receive unmasked data in the Symbol Value field. Separate groups with a pipe symbol ( | ).

If you want to define users that receive unmasked data based on the LDAP attribute values of the users, disable the WhiteListGroups rule and enable the WhiteListAttributeName and WhiteListAttributeValues rules. Define the attribute in the WhiteListAttributeName rule. Set the ATTR_NAME Symbol Value to the name of the attribute. In the WhiteListAttributeValues rule, define the attribute values of the attribute that you specified in the WhiteListAttributeName rule. Set the ATTR_VALUES Symbol Value to the attribute values that you use to identify a user that receives unmasked data.

The StopIfLDAPMatch rule uses a Stop rule action if the LDAP group or attribute value is a match. The Rule Engine does not apply the MaskingRule rule and the user receives unmasked data.

Configure the MaskingRule rule to define how to mask the data. The rule contains columns that commonly contain personally identifiable information. Modify the rule based on the data that you want to mask.

The following table describes the WhiteList rules:

Rule	Description
WhiteListGroups	Defines the value of the Groups symbol. Enter the LDAP groups that you want to receive unmasked data. You cannot use the WhiteListGroups rule with the WhiteListAttributeName and WhiteListAttribueValues rules.
WhiteListAttributeName	Defines the ATTR_NAME symbol. Enter the LDAP attribute that you use to identify users that receive unmasked data. You cannot use the WhiteListAttributeName rule with the WhiteListGroups rule.
WhiteListAttributeValues	Defines the ATTR_VALUES symbol. Enter the LDAP attribute values that you use to identify users that receive unmasked data. You cannot use the WhiteListAttributeName rule with the WhiteListGroups rule.
StopIfLDAPMatch	Stops the Rule Engine. The Rule Engine does not apply the MaskingRule rule if the StopIfLDAPMatch rule returns a match.
MaskingRule	Defines how to mask the sensitive data.