Dremio

Dremio sits in front of other systems. Its sources are other people’s databases and object stores, read in place; its spaces are the layer of views an organisation builds on top of them. So a Dremio scan finds sensitive data twice over: in the raw tables it can reach, and in every view that quietly carries a customer email three joins away from where it started.

What you need to connect

First, where Dremio runs:

The URL is the one in your browser’s address bar, port included — usually :9047. Classifyre talks to Dremio only through that address; it needs no JDBC driver and no additional open port.

Then, how to sign in:

Give the user SELECT on the spaces and sources you want scanned, and nothing more. A dedicated service user is the right identity: what it cannot see is not scanned.

What Classifyre reads

Tables (Dremio’s physical datasets — a database table, an Iceberg table, a promoted file or folder) and views, across every source and space the user can see. Narrow that with a list of paths to include or exclude, written the way Dremio writes them:

• Finance — a whole space or source
• Marketing.Campaigns — one folder and everything beneath it
• Samples."samples.dremio.com" — quote a name that itself contains a dot

Personal home spaces (@username) are skipped unless you ask for them. Files that nobody has promoted to a table are skipped too: Dremio cannot query them, so there are no rows to sample.

Metadata on every asset

Lineage

Worth knowing

• Every sampled table is a Dremio query, so scan cost is engine cost. On Dremio Cloud that means the engine has to be running; the sampling strategy is what keeps the bill small.
• Source lineage needs to see the source’s settings. The host and database behind a source are only visible to a user who may view that source’s configuration. Without that, assets and view lineage are unaffected — only the link through to the underlying database is missing.
• Object-storage sources can be deep. Discovery walks folders, and a data lake has a lot of them. Scope those sources with include paths.
• Dremio tables have no keys, so incremental scans page by row position rather than by key. On a table that is being rewritten between runs, a row can be seen twice or missed until the next full pass.
• Self-signed certificates on a self-hosted Dremio can be accepted with a connection setting. Leave verification on everywhere else.

Configuration

Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the augmentation notebook that enriches assets after extraction, the detectors to run, the scan schedule, and the compute limits for its scan jobs.

Required

Without these, the source will not save.

This section depends on which authentication method you pick — one of the following applies.

Secrets

Stored encrypted and never shown again after you save them. See Configuration & Fields.

This section depends on which authentication method you pick — one of the following applies.

Optional

Everything you can tune. Sensible defaults apply when you leave them alone.