[SDS] Extend mask action to logs, APM spans, and RUM events (#37660)

* [SDS] Extend mask action docs to cover APM spans and RUM events

The Data Scanner Unmask permission and mask action now support APM spans
and RUM events in addition to logs. Remove "logs only" qualifiers and
update the sds-mask-action shortcode to reflect GA availability.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* [SDS] Rename Summary page to Findings page across SDS shortcodes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: DeForest Richards <56796055+drichards-87@users.noreply.github.com>

Author: 3 people

content/en/security/sensitive_data_scanner/_index.md

@@ -89,7 +89,7 @@ For each [scanning rule][17], one of the following actions can be applied to mat
 - {{< ui >}}Redact{{< /ui >}}: Replace the entire matched data with a single token that you choose, such as `[sensitive_data]`.
 - {{< ui >}}Partially redact{{< /ui >}}: Replace a specific portion of all matching values.
 - {{< ui >}}Hash{{< /ui >}}: Replace the entire matched data with a non-reversible unique identifier.
-- {{< ui >}}Mask{{< /ui >}} (available for logs only): Obfuscate all matching values. Users with the `Data Scanner Unmask` permission can de-obfuscate (unmask) and view this data in Datadog. See [Mask action][16] for more information.
+- {{< ui >}}Mask{{< /ui >}} (available for logs, APM spans, and RUM events): Obfuscate all matching values. Users with the `Data Scanner Unmask` permission can de-obfuscate (unmask) and view this data in Datadog. See [Mask action][16] for more information.
 
 **Note**: When scanning sampled data, you will not be able to select actions that obfuscate the data it scans.
 

content/en/security/sensitive_data_scanner/setup/telemetry_data.md

@@ -33,7 +33,7 @@ For each scanning rule, one of the following actions can be applied to matched s
 - {{< ui >}}Redact{{< /ui >}}: Replace the entire matched data with a single token that you choose, such as `[sensitive_data]`.
 - {{< ui >}}Partially redact{{< /ui >}}: Replace a specific portion of all matching values.
 - {{< ui >}}Hash{{< /ui >}}: Replace the entire matched data with a non-reversible unique identifier.
-- {{< ui >}}Mask{{< /ui >}} (available for logs only): Obfuscate all matching values. Users with the `Data Scanner Unmask` permission can de-obfuscate (unmask) and view this data in Datadog. See [Mask action](#mask-action) for more information.
+- {{< ui >}}Mask{{< /ui >}} (available for logs, APM spans, and RUM events): Obfuscate all matching values. Users with the `Data Scanner Unmask` permission can de-obfuscate (unmask) and view this data in Datadog. See [Mask action](#mask-action) for more information.
 
 **Notes**:
 - When scanning sampled data, you will not be able to select actions that obfuscate the data it scans.
@@ -59,7 +59,7 @@ This document goes through the following:
 
 By default, users with the Datadog Admin role have access to view and set up scanning rules. To allow other users access, grant the `data_scanner_read` or `data_scanner_write` permissions under [Compliance][1] to a custom role. See [Access Control][2] for details on how to set up roles and permissions.
 
-If a scanning rule uses the {{< ui >}}mask{{< /ui >}} action (only available for logs) for matched sensitive data, users with the `data_scanner_unmask` permission can de-obfuscate and view the data in Datadog. **Note**: Datadog does not recommend using the {{< ui >}}mask{{< /ui >}} action for credentials, unless you have a plan to respond to and rotate all leaked credentials. See [Mask action](#mask-action) for more information.
+If a scanning rule uses the {{< ui >}}mask{{< /ui >}} action for matched sensitive data, users with the `data_scanner_unmask` permission can de-obfuscate and view the data in Datadog. **Note**: Datadog does not recommend using the {{< ui >}}mask{{< /ui >}} action for credentials, unless you have a plan to respond to and rotate all leaked credentials. See [Mask action](#mask-action) for more information.
 
 {{< img src="sensitive_data_scanner/read_write_permissions.png" alt="The compliance permissions sections showing data scanner read and writer permissions" style="width:80%;">}}
 

layouts/shortcodes/pci-apm.en.md

@@ -16,7 +16,7 @@ To begin **onboarding**:
 apm_config:
   apm_dd_url: <https://trace-pci.agent.datadoghq.com>
 ```
-4. All spans that are sent to the PCI compliant endpoint(s) automatically have a set of [Sensitive Data Scanner][106] PCI rules that are applied to scrub any cardholder data. These dedicated PCI rules must be enabled for PCI DSS compliance and are included with no additional charge. Note that Sensitive Data Scanner for PCI customers does not include the Summary page or estimated usage metric capabilities.
+4. All spans that are sent to the PCI compliant endpoint(s) automatically have a set of [Sensitive Data Scanner][106] PCI rules that are applied to scrub any cardholder data. These dedicated PCI rules must be enabled for PCI DSS compliance and are included with no additional charge. Note that Sensitive Data Scanner for PCI customers does not include the Findings page or estimated usage metric capabilities.
 
 To finish onboarding and be moved to **compliant**:
 1. Inform your [Datadog support][101] or your [Customer Success Manager][102] that you have moved over **all** your endpoints to the PCI compliant endpoint(s).

layouts/shortcodes/pci-logs.en.md

@@ -18,7 +18,7 @@ To begin **onboarding**:
    logs_config:
      logs_dd_url: agent-http-intake-pci.logs.datadoghq.com:443
    ```
-4. All logs that are sent to the PCI compliant endpoint(s) automatically have a set of [Sensitive Data Scanner][106] PCI rules that are applied to scrub any cardholder data. These dedicated PCI rules must be enabled for PCI DSS compliance and are included with no additional charge. Note that Sensitive Data Scanner for PCI customers does not include the Summary page or estimated usage metric capabilities.
+4. All logs that are sent to the PCI compliant endpoint(s) automatically have a set of [Sensitive Data Scanner][106] PCI rules that are applied to scrub any cardholder data. These dedicated PCI rules must be enabled for PCI DSS compliance and are included with no additional charge. Note that Sensitive Data Scanner for PCI customers does not include the Findings page or estimated usage metric capabilities.
 
 To finish onboarding and be moved to **compliant**:
 1. Inform your [Datadog support][101] or your [Customer Success Manager][102] that you have moved over **all** your endpoints to the PCI compliant endpoint(s).

layouts/shortcodes/sds-mask-action.md

@@ -1,14 +1,14 @@
-<div class="alert alert-danger">The <b>mask</b> action is only available for logs.</div>
-
 When you set up or edit a scanner rule, there is an **Action on Match** section where you can set the rule to use the **mask** action for matched sensitive data. The **mask** action obfuscates the sensitive data, but users with the `Data Scanner Unmask` permission can de-obfuscate (unmask) and view the data in Datadog.
 
 **Notes**:
-- Unmasking can only be performed on indexed logs within Datadog.
+- Unmasking is available for indexed logs, APM spans, and RUM events within Datadog.
 - Masked data that is accessed programmatically, such as by using the API or Terraform, or within archives, always appears obfuscated and cannot be unmasked.
 - Unmasking does not work on rehydrated logs.
 - Datadog does not recommend using the **mask** action for credentials, unless you have a plan to respond to and rotate all leaked credentials.
 
-To unmask sensitive data, navigate to the [Summary page][101], click on a scanning rule, and then click on a log. If you have permission to see masked data, that data has an eye icon next to it. Click the eye icon to reveal the data. You can also use the [Log Explorer][102] to view your masked log data.
+To unmask sensitive data, navigate to the [Findings page][101], click on a scanning rule, and then click on a finding. If you have permission to see masked data, that data has an eye icon next to it. Click the eye icon to reveal the data. You can also use the [Log Explorer][102], [Trace Explorer][103], or [RUM Explorer][104] to view masked data.
 
-[101]: https://app.datadoghq.com/organization-settings/sensitive-data-scanner/summary
-[102]: https://app.datadoghq.com/logs
+[101]: https://app.datadoghq.com/sensitive-data-scanner/telemetry
+[102]: https://app.datadoghq.com/logs
+[103]: https://app.datadoghq.com/apm/traces
+[104]: https://app.datadoghq.com/rum/explorer