This section describes how to create new masking formats using Enterprise Manager. To create a masking format:

1. From the Targets menu, select Databases, then click the Security menu and navigate to Data Masking and Subsetting then Data Masking. You can also access the menu through the database home page by selecting Security then Data Masking and Subsetting then Data Masking.

   Go to Masking Formats under Data Masking. The Masking Format Library page appears with predefined formats that Oracle Enterprise Manager provides.

2. Click Create.

   The Create Masking Format page appears, where you can define a masking format.

3. Provide a required name for the new masking format, add a description, select Sensitive Type, and then select a Custom Format Entry type from the drop-down list.

   A section appears that enables you to provide input for the format entry you have selected. For instance, if you select Array List, the subsequent box enables you to enter a list of comma-separated values, such as New York, New Jersey, and New Hampshire.

4. Continue adding additional format entries as needed.
5. When done, provide an optional user-defined or post-processing function, then click Create to include this customized masking format in the library.

   The Masking Format page reappears with your newly created format displayed in the Format Library table. You can use this format later to mask a column of the same sensitive type.

After you have created at least one format, you can use this format as a template, where you can implement most of the masking format using a different name and changing the entries as needed, rather than needing to create a new format from scratch.

1. Navigate to the Masking Formats page and select the format you want to use as a template.
2. Click Actions and choose Create Like.
3. Enter a name for the new format and select a Sensitive Type.
4. Customize the format entries as needed and click Create.

Enterprise Manager provides several out-of-box predefined formats. All predefined formats and built-in formats are random.

Format entry options are as follows:

1. Array List

   Accepts a list of values as input and maps each value in the list to a value in the input column. The number of values in the list should be greater than or equal to the number of distinct values in the masked column. The values in the user-provided list are ordered randomly before mapping them to the original column values. For example, if the original column contains values [10,20,30,40,50] and the Array List specified by the user is [99,100,101,102,103], the first masking run could produce the mapping [10,101], [20,103], [30,100], [40,99], [50,102] and a different masking run can produce [10,100], [20,99], [30,101], [40,102], [50,103].

   A mapping table is created. The CTAS that creates the mapping table queries from:

   • The original table to fetch the column values being masked and a row number for each column value. The row number is derived from the Oracle-supplied ROW_NUMBER function.

   • The user-passed list of values — values in the user-passed array list are converted into a table-like record set using the SQL TABLE function. A row number is also retrieved corresponding to each value in the record set. The row number is derived from the ROWNUM pseudo column. The values in the record set are randomly ordered using DBMS_RANDOM.VALUE function.

   • The mapping table CTAS then joins the row numbers in both sub-queries to map the original value (from sub-query in step 1 above) and a value from the user-list (sub-query in step 2 above). Multiple executions of the CTAS will create a mapping table with different original-masked value mappings because of the random ordering of the user list in step 2.

     Note:

     If masking column is either Date or Timestamp, user can mask the column using Array List format. The Date/Timestamp formats supported are

     yyyy-MM-dd

     and

     yyyy-MM-DDTHH:mm:ssTZD

     For example: "2015-01-18" and "2015-01-18T03:25:46Z".

2. Delete

   Deletes a row based on a condition. If the condition matches, then the row is deleted on the target. A mapping table is created. The “DELETE_VAL” column in the mapping table is set to 1 for rows that are candidates to be deleted. For example, we are masking the SALARY column and the masking definition has conditions on the EMPID column and formats defined as:

   EMPID < 100 
         DELETE 
   EMPID < 200
   	    RANDOM NUMBERS [Start Value:1 End Value:100]
   DEFAULT
   	    PRESERVE ORIGINAL DATA
   

   The mapping table will have the DELETE_VAL column set to 1 for SALARY rows with EMPID < 100. DELETE_VAL for all other rows is set to 0. The final masking CTAS SQL which joins the original table and the mapping table to create the masked table filters out rows with DELETE_VAL set to 1. Therefore, the rows in the original table that match the join condition are effectively “deleted”.

3. Encrypt

   The Encrypt masking format encrypts column data using Triple DES (3DES). The format of the column data after encryption is similar to that of the original values. For example, if you mask nine-digit numbers, the encrypted values also have nine digits. Encrypt is a deterministic and the only reversible masking format. It is helpful when businesses need to mask and send their data to a third party for analysis, reporting, or any other business processing purpose. After the processed data is received from the third party, the original data can be recovered (decrypted) using the same seed value that was used to encrypt the data.

   You provide a regular expression to mask character or numeric type column. The specified regular expression must match all the original values in the column. If a value does not match the regular expression exactly, the masking format may no longer produce one-to-one mapping. Therefore, to ensure uniqueness, all the values must match the regular expression. The encrypted values also match the specified regular expression. Encrypt supports encryption of strings of fixed widths. It supports a subset of the regular expression language and does not support * or + syntax in regular expressions.

   Note:

   The maximum value of a user provided regular expression cannot exceed 64 bits.

   You also provide a seed value that is used to generate a key for encryption and decryption. The seed value has to be provided at the time of submitting a data masking job. It can be any string containing alphanumeric characters.

   If your masking definition has a sensitive column using Encrypt, you are shown the decrypt option while submitting a data masking job. Choosing this option, you can decrypt the encrypted column values by providing the same seed used to encrypt the sensitive column.

4. Fixed Number

   This format does not use a lookup or a mapping table. It assigns a fixed number value to a string/number column.

   The type of column applicable to this entry is a NUMBER column or a STRING column. For example, if you mask a column that has a social security number, one of the entries can be Fixed Number '900'. This format is combinable.

5. Fixed String

   This format does not use a lookup or a mapping table. It assigns a fixed string value to a string column. For example, if you mask a column that has a License Plate Number, one of the entries can be Fixed String 'CA'. This format is combinable.

6. Null Value

   Masks the column with a value of NULL. It does not use a lookup or a mapping table.

7. Preserve Original Data

   Preserves the original column value. Used in conditional masking with a combination of other formats where only a subset of values needs to be masked based on a condition.

8. Random Dates

   The format creates a mapping table. The mapping table CTAS contains code to generate random dates within a user specified date range. A random date is generated using the following logic:

   TO_DATE(start_date','YYYY-DD-MM HH24:MI:SS') + 
   mask_util.genrnd(0, <#of days between the specified date range>)

   This format is combinable at the end after data range.

9. Random Decimal Numbers

   If used as part of a mixed random string, these have limited usage for generating unique values. This masking format generates unique values within the specified range. For example, a starting value of 5.5 and ending value of 9.99 generates a decimal number ranging from 5.5 to 9.99, both inclusive. This masking format is combinable.

10. Random Digits

    This format generates unique values within the specified range. For example, for a random digit with a length of [5,5], an integer between [0, 99999] is randomly generated, left padded with '0's to satisfy the length and uniqueness requirement. This is a complementary type of random number, which will not be padded. When using random digits, the random digit pads to the appropriate length in a string. It does not pad when used for a number column. This format is combinable.

    Data masking ensures that the generated values are unique, but if you do not specify enough digits, you could run out of unique values in that range.

11. Random Numbers

    If used as part of a mixed random string, these have limited usage for generating unique values. This format generates unique values within the specified range. For example, a starting value of 100 and ending value of 200 generates an integer number ranging from 100 to 200, both inclusive. This format is combinable.

12. Random Strings

    This format generates unique values within the specified range. For example, a starting length of 2 and ending length of 6 generates a random string of 2 - 6 characters in length. This format is combinable.

13. Regular Expression

    The format uses a lookup table. No mapping table is created. The PL/SQL function that implements the format is invoked directly from the final CTAS which creates the masked table. The lookup table has two columns to store the regular expression and the replacement value specified by the user. The SQL REGEXP_REPLACE function is used to implement this format.

    The function has the signature:

    
    regexp_replace(column_value, regex, replacement_val);

    For example, phone numbers in the format

     nnn.nnn.nnnn

    can be masked using a regex

    [1-9]{3}[.][0-9]{3}[.][0-9]{4}

    with a replacement value

    ***.***.****

    The format invokes the regexp_replace for each regexp-replacement value pair. If the phone number column was masked using regular expression:

    EMPID < 100
      Regular Expression  	Regex: [1-9]{3}[.][0-9]{3}[.][0-9]{4}  Replacement Value: 999.444.5555
      Regular Expression  	Regex: [9]{3}[.][4]{3}[.][5]{4} 	  Replacement Value: ***.***.****
    

    Each column value matching the first regular expression is first replaced with 999.444.5555, this value then matches the second regular expression and is replaced with ***.***.****. The example is not a real world use case. The behavior probably is a side effect of how the format is implemented, the real use case of specifying multiple regular expression formats to mask a column is to handle cases when the data in the column could match multiple regular expressions. For example:

    EMPID < 100
      Regular Expression  	Regex: [1-9]{3}[.][0-9]{3}[.][0-9]{4}  Replacement Value: ***.***.****
      Regular Expression  	Regex: [1-9]{3}[.][0-9]{3}[.][0-9]{3}  Replacement Value: ***.***.***
    

    can be used to mask column values that store 10 digit - nnn.nnn.nnnn - or 9 digit - nnn.nnn.nnn - phone numbers.

14. Shuffle

    This format does not use a lookup or a mapping table. The final CTAS which creates the mapping table includes a sub query to order the column contents randomly using the DBMS_RANDOM.VALUE function. If shuffle is used with a grouping column, the PARTITION clause is used to partition by the grouping column and the column is ordered randomly within each partition. The implementation is similar to that of Array List and Table Column. The random ordering for the shuffle format occurs on the column being “shuffle masked”, whereas in Array List, it is on the user-passed list, and in Table Column, the ordering is on the user-specified column.

15. Substitute

    The format creates a mapping table. It uses a user specified “substitution” table as a source for masked values. The format uses the Oracle supplied hash based partitioning function ORA_HASH to map a column value to its mask value in a lookup (substitution) table. Processing involves querying the substitution table to get a count of distinct values in the mask column. This count - n - is then used as the max_bucket parameter of ORA_HASH to hash the original column values into n buckets. For example, if we are masking EMPLOYEE.SALARY and using SUBST.SUB_COL column as the substitution column, we first get the count of distinct values in SUB_COL. The mapping table CTAS then queries:

    1. The original column, EMPLOYEE.SALARY

    2. The user provided substitution table to fetch all the distinct values in SUBST.SUB_COL and also fetches the ROWNUM associated with each row

    The CTAS SQL then joins 1 and 2 using ORA_HASH and equating its output to the ROWNUM from step 2. The SELECT part of the CTAS SQL is listed below. max_bckt is the count of distinct values in the substitution column SUBST.SUB_COL:

    select s.orig_val,
           a0.new_val
    from ( select orig_val
           from (select "SALARY" orig_val
            	 from "TESTU"."EMPLOYEE") 
           group by orig_val) s,
         (select rownum rn, 
                 SUB_COL new_val 
          from (select distinct SUB_COL
                from TESTU.SUBST
                order by SUB_COL)) a0
     where ora_hash(s.orig_val, max_bckt, seed)+1 = a0.rn
    

16. SQL Expression

    The format does not create a mapping table. It allows a user to use a SQL Expression for masking a column. Data masking uses this expression to generate masked values to replace the original values. The expression is invoked directly from the masking CTAS SQL. The SQL Expression can consist of one or more values, operators, and SQL functions that evaluates to a value. It can also contain substitution columns (columns from the same table as the masked column). Some examples of valid expressions:

    1.	dbms_random.string('u', 8) || '@company.com'
    2.	%first_name% || '.' || %last_name% || '@company.com'

17. Substring

    The format creates a mapping table. The mapping table CTAS invokes the Oracle SUBSTR function on the input column. The format accepts a start position and length as input, extracts that data from the input column using SUBSTR, and uses that as a mask value.

18. Table Column

    The format creates a mapping table. The format maps original column values to column values in a user specified table. The processing is similar to the array list format. The values in the user specified table are randomly ordered using DBMS_RANDOM.VALUE before mapping each value to the original column. Unlike the Substitute format, the format is not deterministic since the substitution column is randomly ordered.

19. Truncate

    The format truncates all rows in a table. It does not create a mapping table. If one of the columns in a table is masked using this format, so no other mask formats can be specified for any of the other columns.

20. User Defined Function

    The format creates a mapping table. The return value of the user defined function is used to mask the column. The function is invoked as part of the mapping table CTAS. The function has a fixed signature:

     function userdef_func(rowid varchar2, col_name varchar2, orig_val varchar2) returns varchar2;

21. Post Processing Function

    Optionally, some formats can also include a post-processing function that takes the output after executing all the format entries, runs the function and produces the final masked value.

    The format allows users to use a custom function to process column values after they are masked using standard data masking formats. For example, the SALARY column can be masked with a SQL expression first, and a post processing function can be applied on the masked values to add a currency symbol, like ‘$’. The function has a fixed signature:

    
    function post_proc_func(rowid varchar2, column_name varchar2, mask_value varchar2) returns varchar2;

    The ROWID input allows a user to fetch column values from the masked table. The function could use these values to mask the input column value, basically to transform the column further after a standard format is applied on the column. This format creates a mapping table. The post processing function gets invoked as part of the mapping table CTAS SQL. The input to the mask_value argument of the function is the masked value of the original column. For example, say we are masking the SALARY column and the mask definition has conditions on the EMPID column and formats are defined this way:

    EMPID < 100 
          RANDOM NUMBERS [START:100000 END: 10000000]
          POST PROCESSING FUNCTION ppf 
    EMPID < 200
    	    FIXED NUMBER 100000
    DEFAULT
    	    PRESERVE ORIGINAL DATA
    

Deterministic Masking Using the Substitute Format

You may occasionally need to consistently mask multiple, distinct databases. For instance, if you run HR, payroll, and benefits that have an employee ID concept on three separate databases, the concept may be consistent for all of these databases, in that an employee's ID can be selected to retrieve the employee's HR, payroll, or benefits information. Based on this premise, if you were to mask the employee's ID because it actually contains his/her social security number, you would have to mask this consistently across all three databases.

Deterministic masking provides a solution for this problem. You can use the Substitute format to mask employee ID column(s) in all three databases. The Substitute format uses a table of values from which to substitute the original value with a mask value. As long as this table of values does not change, the mask is deterministic or consistent across the three databases.

Using the Shuffle Format

A shuffle format is available, but it does not keep the original data distribution if the column values are not unique or when conditional masking is used. For example, in an Original Table with two columns, EmpName and Salary, the Salary column might have distinct values like 10, 90, and 20.

Original Table

If you mask the Salary column with this format, each of the original values is replaced with one of the values from this set. Assume that the shuffle format replaces 10 with 20, 90 with 10, and 20 with 90.

Mapping Table (Non-preservation)

The result is a shuffled Salary column as shown in the Masked Table, but the data distribution is changed. While the value 10 occurs three times in the Salary column of the Original Table, it occurs only twice in the Masked Table.

Masked Table (Non-preservation)

If the salary values had been unique, the format would have maintained data distribution.

Using Group Shuffle

Group shuffle enables you to perform a shuffle within discrete units, or groups, where there is a relationship among the members of the group. Consider the case of shuffling the salaries of employees. This table illustrates the group shuffle mechanism, where employees are categorized as managers (M) or workers (W), and salaries are shuffled within job category.

Using Conditional Masking

To demonstrate how conditional masking can handle duplicate values, add another job category, assistant (A), where the employee in this category, George, earns the same as Frank. Assume the following conditions:

• If job category is M, replace salary with a random number between 1 and 10.

• If job category is W, set salary to a fixed number (01).

• Default is to preserve the existing value.

Applying these conditions results in the masked values shown in the following table:

Conditional masking works when there are duplicate values provided there are no dependent columns or foreign keys. If either of these is present, a "bleeding condition" results in the first of two duplicate values becoming the value of the second. So, in the example, Frank's salary is not preserved, but becomes 01.

If desired, you can provide user-defined and post-processing functions on the Create Masking Format page. A user-defined choice is available in the Custom Format Entry list, and a post-processing function field is available at the bottom of the page.

• User-defined functions

  To provide a user-defined function, select User Defined Function from the drop-down list to access the input fields.

  A user-defined function passes in the original value as input, and returns a mask value. The data type and uniqueness of the output values must be compatible with the original output values. Otherwise, a failure occurs when the job runs. Combinable, a user-defined function is a PL/SQL function that can be invoked in a SELECT statement. Its signature is returned as:

  Function udf_func (rowid varchar2, column_name varchar2, original_value varchar2) return varchar2;
  

  • rowid is the min (rowid) of the rows that contain the value original_value 3rd argument.

  • column_name is the name of the column being masked.

  • original_value is the value being masked.

  That is, it accepts the original value as an input string, and returns the mask value.

  Both the input and output values are varchar2. For instance, a user-defined function to mask a number could receive 100 as input, the string representation of the number 100, and return 99, the string representation of the number 99. Values are cast appropriately when inserting to the table. If the value is not castable, masking fails.

• Post-processing functions

  To provide a post-processing function, enter it in the Post Processing Function field.

  A post-processing function has the same signature as a user-defined function, but passes in the mask value the masking engine generates, and returns the mask value that should be used for masking, as shown in the following example:

  Function post_proc_udf_func (rowid varchar2, column_name varchar2, mask_value varchar2) return varchar2;
  

  • rowid is the min (rowid) of the rows that contain the value mask_value.

  • column_name is the name of the column being masked.

  • mask_value is the value being masked.

All of the predefined format definitions adhere to these typical patterns:

• Generate a random number or random digits.

• Perform post-processing on the above-generated value to ensure that the final result is a valid, realistic value.

For example, a valid credit card number must pass Luhn's check. That is, the last digit of any credit card number is a checksum digit, which is always computed. Also, the first few digits indicate the card type (MasterCard, Amex, Visa, and so forth). Consequently, the format definition of a credit card would be as follows:

• Generate random and unique 10-digit numbers.

• Using a post-processing function, transform the values above to a proper credit card number by adding well known card type prefixes and computing the checksum digit.

This format is capable of generating 10 billion unique credit card numbers.

1. From the Targets menu, select Databases, then click the Security menu and navigate to Data Masking and Subsetting then Data Masking. Alternatively, you can right-click on your specific database and go to Security then Data Masking and Subsetting then Data Masking.

   The Masking Definitions page appears, where you can create new or manage existing masking definitions.

2. Click Create to go to the Create Masking Definition page.

   A masking definition includes information regarding table columns and the format for each column. You can choose which columns to mask, leaving the remaining columns intact.

3. Provide required details, including Name, Application Data Models, Associated Database, and Database Named Credentials.

4. Click Next to go to the Sensitive Columns and Masking Formats page, where you can choose which sensitive columns in the ADM you want to mask.

   The sensitive columns appear in the first section whereas columns added to Masking Definition appear below in the next section.

5. Select the desired sensitive columns you want to mask.

   Either click Define Format and Add to define the format for the column now or you can choose Add Column to add the column to the Masking Definition and define the format later.

   Also, Define Format and Add features can save significant time. When you select multiple columns to add that have the same data type, you do not need to define the format for each column one by one. For instance, if you search for Social Security numbers (SSN) and the search yields 100 SSN columns, you could select them all, then click Define Format and Add to import the SSN format for all of them.

   Optionally, below are the other masking options available:

   • Group Masking: If you want to mask selected columns as a group, enable Group Masking. The columns that you want to mask as a group must all be from the same table. Any formats defined while this checkbox is selected will be applied to all the selected columns as a group.
   • Select all filtered rows: Enable the Select all filtered rows check box if you want to mask more than one column together rather than separately.

     After you define the masking format for the grouped columns and return to this page, the Column Group in the table shows an identical number for each entry row in the table for all members of the group. For example, if you have defined your first group containing four columns, each of the four entries in this page will show a number 1 in the Column Group column. This helps you to distinguish which columns belong to which column groups.

6. Do one of the following:

   • If you chose Add Column in the previous step and do not wish to provide the masking format for now:

     You will eventually need to define the column's masking format. When you are ready to provide the masking format, go to the Actions menu for the Masking Definition and select Edit to define the format. Read the following instructions to define the formats.

   • If you chose Define Format and Add in the previous step:
     The Define Format and Add page appears, where you can define the format for all selected columns, as explained below:

     • Choose the masking format either from the predefined masking formats drop-down or customize your own. Click Import.
     • You can provide one or more format entries.
     • You can generate Sample Data by clicking Generate.
     • When you have finished formatting the column, click Add. The sensitive columns you selected and assigned masking formats to earlier now appear in the next section. Click Next.

7. Review the Data Masking options. Before clicking Next, you can also provide the pre- and post-masking script. Refer to Selecting Data Masking Advanced Options for more information regarding Pre Mask Scripts and Post Mask Scripts.

8. Review the final page and click Create to return to the Masking Definitions page. The new masking definition will appear at the top of the table.

Data Masking Options

The data masking options include:

• Disable redo log generation during masking:

  Masking disables redo logging and flashback logging to purge any original unmasked data from logs. However, in certain circumstances when you only want to test masking, roll back changes, and retry with more mask columns, it is easier to uncheck this box and use a flashback database to retrieve the old unmasked data after it has been masked. You can use Enterprise Manager to flashback a database.

  Note:

  Disabling this option compromises security. You must ensure this option is enabled in the final mask performed on the copy of the production database.

• Refresh statistics after masking:

  If you have already enabled statistics collection and would like to use special options when collecting statistics, such as histograms or different sampling percentages, it is beneficial to turn off this option to disable default statistics collection and run your own statistics collection jobs.

• Drop temporary tables created during masking:

  Masking creates temporary tables that map the original sensitive data values to mask values. In some cases, you may want to preserve this information to track how masking changed your data. Note that doing so compromises security. These tables must be dropped before the database is available for unprivileged users.

• Decrypt encrypted columns:

  This option decrypts columns that were previously masked using Encrypt format. To decrypt a previously encrypted column, the seed value must be the same as the value used to encrypt.

  Decrypt only recovers the original value if the original format used for the encryption matches the original value. If the originally encrypted value did not conform to the specified regular expression, when decrypted, the encrypted value cannot reproduce the original value.

• Use parallel execution when possible:

  Oracle Database can make parallel various SQL operations that can significantly improve their performance. Data Masking uses this feature when you select this option. You can enable Oracle Database to automatically determine the degree of parallelism, or you can specify a value. For more information about using parallel execution and the degree of parallelism, see the Oracle Database Data Warehousing Guide.

• Recompile invalid dependent objects after masking:

  The masking process re-creates the table to be masked and as a consequence, all existing dependent objects (packages, procedures, functions, MViews, Views, Triggers) become invalid. You can specify that the masking process recompile these invalid objects after creating the table, by selecting the check box. Otherwise, invalid objects are not recompiled using utl_comp procedures at the end of masking.

  If you choose this option, indicate whether to use serial or parallel execution. You can enable Oracle Database to automatically determine the degree, or you can specify a value. For more information about using parallel execution and the degree of parallelism, see the Oracle Database Data Warehousing Guide.

Random Number Generator

The random number generation options include:

• Favor Speed:

  The DBMS_RANDOM package is used for random number generation.

• Favor Security:

  The DBMS_CRYPTO package is used for random number generation. Additionally, if you use the Substitute format, a seed value is required when you schedule the masking job or database clone job.

Pre Mask and Post Mask Scripts

Pre and post masking scripts are free flow scripts where a user can execute SQL statements and PL/SQL stored program units (procedures, functions, packages, anonymous block) before and after masking as required.

Use the Pre Mask Script text box to specify any user-specified SQL script that must run before masking starts.

Use the Post Mask Script text box to specify any user-specified SQL script that must run after masking completes.

To schedule a script generation job:

1. Select the masking definition to generate a script for, then click on the Actions button and select Manage Masking Script then Generate Masking Script.
2. Select a Data Masking option:

   • In-Database Masking – to replace sensitive data in-place with masked data on a specified database (usually copied from production).

   • In-Export Masking – to export masked data from the specified source database (usually production) using Oracle Data Pump.

   • You can choose both options; that is, a script to mask the database directly and a script to create a masked dump.

3. Select an Associated Database and Database Named Credentials from the drop-down list.
4. Change the default job name to something meaningful, if desired, and provide an optional job description.
5. Specify to start the job immediately or at a later specified date and time, then click Generate.

   A message confirms that the Generate script job has been submitted successfully. Click on the Refresh button to see the latest job status.

To set up the data masking job and schedule its execution:

1. Select the masking definition for which a script has been generated, then click Actions and select Schedule Masking.
2. Select a Data Masking Option radio button to indicate your preference:

   • In-Database Masking – Replaces sensitive data directly in the specified database (usually a copy from production) with masked data. This option is intended for non-production environments only.

     Note:

     You must enable the check box indicating that the selected database is not a production database in order to proceed.

   • In-Export Masking – Exports masked data from the specified source database (usually production) using Oracle Data Pump. This option is safe for production environments, as it does not modify customer data. However, it creates temporary tables that will be dropped once the masking operation is completed. Your selection will update the checkbox text below the radio buttons and other areas on the page.

3. From the dropdown menus, select the required Associated Database, Database Named Credentials, and Host Named Credentials.
4. Choose a Tablespace for Temporary Objects. There are three options:
   1. Default Tablespace
   2. Temporary Tablespace
   3. Custom Tablespace

   Select the appropriate option based on your needs.

5. Enter a Job Name or accept the default pre-filled value.
6. Specify whether to start the job immediately or at a later date and time. Then, click Next.
7. If you selected In-Database Masking in Step 2:
   1. Enter the script file location and name (pre-filled), and then click Submit.
8. If you selected In-Export Masking in Step 2:
   1. Enter the Export Filename (pre-filled).
   2. Specify a directory to save the mask dump files to by selecting an option from Type of Export Directory. The available options are a Database Directory, Custom Directory or an External Directory.
   3. Select whether to export the masked data only or the entire database along with the masked data through Data to Export. Exporting the entire database might significantly increase the overall job execution time.
   4. Enter the Maximum Export File Size (MB) (pre-filled). Optionally, choose to Enable Export File Compression and/or Enable Export File Encryption according to your needs. If Export File Encryption is enabled, enter and confirm an encryption password.
   5. Specify the Maximum Number of Threads (pre-filled).
   6. Generate Data Dump Logs is enabled by default but you can choose to turn it off as necessary.
   7. Click Submit.
9. A message confirms that the job has been scheduled and you can use the refresh button above the table to update the job status.