From 977618a96e2bff7ae12913028971a6c85032e240 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Wed, 27 Mar 2024 12:13:57 -0400
Subject: [PATCH] Initial discovery and classification CLI implementation

---
 Dockerfile                                    |  20 +
 classification/classification.go              | 153 ++++++
 .../classification_fakeclassifier_test.go     | 213 ++++++++
 classification/examples/example_policy.rego   |  70 +++
 .../examples/example_policy_simple.rego       |  22 +
 classification/label.go                       |  43 ++
 classification/publisher/publisher.go         |  21 +
 classification/publisher/stdout.go            |  39 ++
 classification/rego/README.md                 |   8 +
 classification/rego/address.rego              |  34 ++
 classification/rego/address_test.rego         |  61 +++
 classification/rego/age.rego                  |  15 +
 classification/rego/age_test.rego             |  37 ++
 classification/rego/ccn.rego                  |  17 +
 classification/rego/ccn_test.rego             |  26 +
 classification/rego/cvv.rego                  |  58 +++
 classification/rego/cvv_test.rego             |  29 ++
 classification/rego/dob.rego                  |  45 ++
 classification/rego/dob_test.rego             | 110 +++++
 classification/rego/email.rego                |  17 +
 classification/rego/email_test.rego           |  13 +
 classification/rego/first_name.rego           |  20 +
 classification/rego/first_name_test.rego      |  49 ++
 classification/rego/full_name.rego            |  15 +
 classification/rego/full_name_test.rego       |  25 +
 classification/rego/ip_address.rego           |  28 ++
 classification/rego/ip_address_test.rego      |  25 +
 classification/rego/labels.yaml               |  77 +++
 classification/rego/last_name.rego            |  20 +
 classification/rego/last_name_test.rego       |  49 ++
 classification/rego/passport.rego             |  22 +
 classification/rego/passport_test.rego        |  65 +++
 classification/rego/phone_number.rego         |  17 +
 classification/rego/phone_number_test.rego    |  13 +
 classification/rego/ssn.rego                  |  24 +
 classification/rego/ssn_test.rego             |  73 +++
 classification/rego_classifier.go             | 126 +++++
 classification/rego_classifier_test.go        | 457 ++++++++++++++++++
 cmd/main.go                                   |  75 +++
 cmd/repo_scan.go                              |  18 +
 discovery/config/config.go                    |  59 +++
 discovery/config/util.go                      | 138 ++++++
 discovery/config/util_test.go                 | 178 +++++++
 discovery/repository/denodo/denodo.go         | 114 +++++
 discovery/repository/doc.go                   |  15 +
 discovery/repository/gen.go                   |   5 +
 discovery/repository/genericsql/genericsql.go | 303 ++++++++++++
 .../repository/genericsql/genericsql_test.go  | 301 ++++++++++++
 discovery/repository/genericsql/util.go       |  35 ++
 discovery/repository/metadata.go              |  81 ++++
 discovery/repository/metadata_test.go         |  71 +++
 discovery/repository/mock_repository.go       | 342 +++++++++++++
 discovery/repository/mysql/mysql.go           |  97 ++++
 discovery/repository/mysql/mysql_test.go      |  31 ++
 discovery/repository/oracle/config.go         |  27 ++
 discovery/repository/oracle/oracle.go         | 125 +++++
 discovery/repository/oracle/oracle_test.go    |  86 ++++
 discovery/repository/postgresql/config.go     |  22 +
 discovery/repository/postgresql/postgresql.go | 103 ++++
 .../repository/postgresql/postgresql_test.go  |  31 ++
 discovery/repository/redshift/redshift.go     |  94 ++++
 .../repository/redshift/redshift_test.go      |  32 ++
 discovery/repository/repository.go            | 237 +++++++++
 discovery/repository/repository_test.go       | 134 +++++
 .../repository/sample_all_databases_test.go   | 228 +++++++++
 .../repository/sample_repository_test.go      | 181 +++++++
 discovery/repository/sampling.go              |  56 +++
 discovery/repository/sampling_test.go         |  77 +++
 discovery/repository/snowflake/config.go      |  36 ++
 discovery/repository/snowflake/snowflake.go   | 100 ++++
 .../repository/snowflake/snowflake_test.go    |  31 ++
 discovery/repository/sqlserver/sqlserver.go   | 104 ++++
 .../repository/sqlserver/sqlserver_test.go    |  31 ++
 discovery/scanner.go                          | 161 ++++++
 go.mod                                        |  76 ++-
 go.sum                                        | 269 ++++++++++-
 scan/scanner.go                               |   3 +-
 77 files changed, 6257 insertions(+), 6 deletions(-)
 create mode 100644 Dockerfile
 create mode 100644 classification/classification.go
 create mode 100644 classification/classification_fakeclassifier_test.go
 create mode 100644 classification/examples/example_policy.rego
 create mode 100644 classification/examples/example_policy_simple.rego
 create mode 100644 classification/label.go
 create mode 100644 classification/publisher/publisher.go
 create mode 100644 classification/publisher/stdout.go
 create mode 100644 classification/rego/README.md
 create mode 100644 classification/rego/address.rego
 create mode 100644 classification/rego/address_test.rego
 create mode 100644 classification/rego/age.rego
 create mode 100644 classification/rego/age_test.rego
 create mode 100644 classification/rego/ccn.rego
 create mode 100644 classification/rego/ccn_test.rego
 create mode 100644 classification/rego/cvv.rego
 create mode 100644 classification/rego/cvv_test.rego
 create mode 100644 classification/rego/dob.rego
 create mode 100644 classification/rego/dob_test.rego
 create mode 100644 classification/rego/email.rego
 create mode 100644 classification/rego/email_test.rego
 create mode 100644 classification/rego/first_name.rego
 create mode 100644 classification/rego/first_name_test.rego
 create mode 100644 classification/rego/full_name.rego
 create mode 100644 classification/rego/full_name_test.rego
 create mode 100644 classification/rego/ip_address.rego
 create mode 100644 classification/rego/ip_address_test.rego
 create mode 100644 classification/rego/labels.yaml
 create mode 100644 classification/rego/last_name.rego
 create mode 100644 classification/rego/last_name_test.rego
 create mode 100644 classification/rego/passport.rego
 create mode 100644 classification/rego/passport_test.rego
 create mode 100644 classification/rego/phone_number.rego
 create mode 100644 classification/rego/phone_number_test.rego
 create mode 100644 classification/rego/ssn.rego
 create mode 100644 classification/rego/ssn_test.rego
 create mode 100644 classification/rego_classifier.go
 create mode 100644 classification/rego_classifier_test.go
 create mode 100644 cmd/main.go
 create mode 100644 cmd/repo_scan.go
 create mode 100644 discovery/config/config.go
 create mode 100644 discovery/config/util.go
 create mode 100644 discovery/config/util_test.go
 create mode 100644 discovery/repository/denodo/denodo.go
 create mode 100644 discovery/repository/doc.go
 create mode 100644 discovery/repository/gen.go
 create mode 100644 discovery/repository/genericsql/genericsql.go
 create mode 100644 discovery/repository/genericsql/genericsql_test.go
 create mode 100644 discovery/repository/genericsql/util.go
 create mode 100644 discovery/repository/metadata.go
 create mode 100644 discovery/repository/metadata_test.go
 create mode 100644 discovery/repository/mock_repository.go
 create mode 100644 discovery/repository/mysql/mysql.go
 create mode 100644 discovery/repository/mysql/mysql_test.go
 create mode 100644 discovery/repository/oracle/config.go
 create mode 100644 discovery/repository/oracle/oracle.go
 create mode 100644 discovery/repository/oracle/oracle_test.go
 create mode 100644 discovery/repository/postgresql/config.go
 create mode 100644 discovery/repository/postgresql/postgresql.go
 create mode 100644 discovery/repository/postgresql/postgresql_test.go
 create mode 100644 discovery/repository/redshift/redshift.go
 create mode 100644 discovery/repository/redshift/redshift_test.go
 create mode 100644 discovery/repository/repository.go
 create mode 100644 discovery/repository/repository_test.go
 create mode 100644 discovery/repository/sample_all_databases_test.go
 create mode 100644 discovery/repository/sample_repository_test.go
 create mode 100644 discovery/repository/sampling.go
 create mode 100644 discovery/repository/sampling_test.go
 create mode 100644 discovery/repository/snowflake/config.go
 create mode 100644 discovery/repository/snowflake/snowflake.go
 create mode 100644 discovery/repository/snowflake/snowflake_test.go
 create mode 100644 discovery/repository/sqlserver/sqlserver.go
 create mode 100644 discovery/repository/sqlserver/sqlserver_test.go
 create mode 100644 discovery/scanner.go

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a35bd86
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+FROM golang:1.22 as build
+
+# Set destination for COPY.
+WORKDIR /app
+
+# Download dependencies.
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy the source code.
+COPY . .
+
+# Build.
+RUN CGO_ENABLED=0 go build -o dmap cmd/*.go
+
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=build /app/dmap /dmap
+
+ENTRYPOINT ["/dmap"]
diff --git a/classification/classification.go b/classification/classification.go
new file mode 100644
index 0000000..43682eb
--- /dev/null
+++ b/classification/classification.go
@@ -0,0 +1,153 @@
+// Package classification provides various types and functions to facilitate
+// data classification. The type Classifier provides an interface which takes
+// sampled data as input and returns a classified version of that sample as
+// output. The package contains at least one implementation which uses Rego and
+// OPA to perform the actual classification logic (see LabelClassifier), however
+// other implementations may be added in the future.
+package classification
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+// TODO: godoc -ccampo 2024-03-27
+type ClassifiedTable struct {
+	Repo    string `json:"repo"`
+	Catalog string `json:"catalog"`
+	Schema  string `json:"schema"`
+	Table   string `json:"table"`
+}
+
+// Result represents the classification of a data attribute.
+type Result struct {
+	Table           *ClassifiedTable `json:"table"`
+	AttributeName   string           `json:"attributeName"`
+	Classifications []*Label         `json:"classifications"`
+}
+
+// Classifier implementations know how to turn a row of data into a sequence of
+// classification results.
+type Classifier interface {
+	// Classify takes as input what amounts to a "row of data": complete
+	// information about where the table comes from as well as a list of columns
+	// and attributeValues. While the values might be any data type, by the time
+	// we reach here, we expect the values to be represented as strings.
+	//
+	// For a given attribute, if it is classified as belonging to a particular
+	// classification group, we will add an instance for it in the Result.
+	// If however, there is no assigned classification, we will skip it in the
+	// results. A zero length return value is normal if none of the attributes
+	// matched the classification requirements.
+	Classify(
+		ctx context.Context,
+		table *ClassifiedTable,
+		attrs map[string]any,
+	) ([]Result, error)
+}
+
+// ClassifySamples uses the provided Classifier to classify the sample data
+// passed via the "samples" parameter. It is mostly a helper function which
+// loops through each repository.Sample, retrieves the attribute names and
+// values of that sample, passes them to Classifier.Classify, and then
+// aggregates the results. Please see the documentation for Classifier and its
+// Classify method for more details. The returned slice represents all the
+// unique classification results for a given sample set.
+func ClassifySamples(
+	ctx context.Context,
+	classifier Classifier,
+	samples []repository.Sample,
+) ([]Result, error) {
+	var classifications []Result
+	for _, sample := range samples {
+		table := ClassifiedTable{
+			Repo:    sample.Metadata.Repo,
+			Catalog: sample.Metadata.Database,
+			Schema:  sample.Metadata.Schema,
+			Table:   sample.Metadata.Table,
+		}
+		// Classify each sampled row
+		for _, sampleResult := range sample.Results {
+			res, err := classifier.Classify(ctx, &table, sampleResult)
+			if err != nil {
+				return nil, fmt.Errorf("error classifying sample: %w", err)
+			}
+			classifications = append(classifications, res...)
+		}
+	}
+	return combineAndDedupe(classifications), nil
+}
+
+// AggregateClassifySamples classifies the given samples with every classifier,
+// and returns the aggregate result slice. For details on how each
+// classification is executed, see ClassifySamples.
+func AggregateClassifySamples(
+	ctx context.Context,
+	classifiers map[string]Classifier,
+	samples []repository.Sample,
+) ([]Result, error) {
+	classifications := make([]Result, 0)
+	for _, classifier := range classifiers {
+		classified, err := ClassifySamples(ctx, classifier, samples)
+		if err != nil {
+			return nil, err
+		}
+		classifications = append(classifications, classified...)
+	}
+	return classifications, nil
+}
+
+// combineAndDedupe takes a slice of Result and combines the individual elements
+// when they have the same schema/table/attribute, but different labels, into a
+// Result element with combined labels. Additionally, only distinct results by
+// schema, table, and attribute are present in the return slice.
+func combineAndDedupe(results []Result) []Result {
+	set := make(map[tableAttrLabel]bool)
+	distinctLabels := make(map[tableAttr][]*Label)
+	for _, result := range results {
+		for _, lbl := range result.Classifications {
+			key := tableAttrLabel{
+				ta: tableAttr{
+					table: *result.Table,
+					attr:  result.AttributeName,
+				},
+				label: lbl.Name,
+			}
+
+			if !set[key] {
+				set[key] = true
+				distinctLabels[key.ta] = append(distinctLabels[key.ta], lbl)
+			}
+		}
+	}
+
+	distinctResults := make([]Result, 0, len(distinctLabels))
+	for ta, labels := range distinctLabels {
+		result := Result{
+			Table: &ClassifiedTable{
+				Repo:    ta.table.Repo,
+				Catalog: ta.table.Catalog,
+				Schema:  ta.table.Schema,
+				Table:   ta.table.Table,
+			},
+			AttributeName:   ta.attr,
+			Classifications: labels,
+		}
+		distinctResults = append(distinctResults, result)
+	}
+
+	return distinctResults
+}
+
+// Both tableAttr and tableAttrLabel are only used as map keys
+type tableAttr struct {
+	table ClassifiedTable
+	attr  string
+}
+
+type tableAttrLabel struct {
+	ta    tableAttr
+	label string
+}
diff --git a/classification/classification_fakeclassifier_test.go b/classification/classification_fakeclassifier_test.go
new file mode 100644
index 0000000..5e41169
--- /dev/null
+++ b/classification/classification_fakeclassifier_test.go
@@ -0,0 +1,213 @@
+package classification
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+type classifyFunc func(table *ClassifiedTable, attrs map[string]any) ([]Result, error)
+
+type fakeClassifier struct {
+	classify classifyFunc
+}
+
+var _ Classifier = (*fakeClassifier)(nil)
+
+func (f fakeClassifier) Classify(
+	_ context.Context,
+	table *ClassifiedTable,
+	attrs map[string]any,
+) ([]Result, error) {
+	return f.classify(table, attrs)
+}
+
+func Test_Classify_FakeClassifier_SingleSample(t *testing.T) {
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repoName,
+			Database: catalogName,
+			Schema:   schemaName,
+			Table:    tableName,
+		},
+		Results: []repository.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4256",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "53",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	table := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName,
+	}
+
+	expected := []Result{
+		{
+			Table:           &table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table,
+			AttributeName:   "social_sec_num",
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+
+	classifier := fakeClassifier{
+		classify: func(
+			table *ClassifiedTable,
+			attrs map[string]any,
+		) ([]Result, error) {
+			return expected, nil
+		},
+	}
+
+	actual, err := ClassifySamples(context.Background(), classifier, []repository.Sample{sample})
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func Test_AggregateClassify_FakeClassifier_MultipleSamples(t *testing.T) {
+	tableName1 := tableName + "1"
+	tableName2 := tableName + "2"
+	ageAttr := "age"
+	ssnAttr := "social_sec_num"
+	ccnAttr := "credit_card_num"
+	samples := []repository.Sample{
+		{
+			Metadata: repository.SampleMetadata{
+				Repo:     repoName,
+				Database: catalogName,
+				Schema:   schemaName,
+				Table:    tableName1,
+			},
+			Results: []repository.SampleResult{
+				{
+					ageAttr: "52",
+					ssnAttr: "512-23-4256",
+					ccnAttr: "4111111111111111",
+				},
+				{
+					ageAttr: "53",
+					ssnAttr: "512-23-4258",
+					ccnAttr: "4111111111111111",
+				},
+			},
+		},
+		{
+			Metadata: repository.SampleMetadata{
+				Repo:     repoName,
+				Database: catalogName,
+				Schema:   schemaName,
+				Table:    tableName2,
+			},
+			Results: []repository.SampleResult{
+				{
+					ageAttr: "21",
+					ssnAttr: "123-45-6789",
+					ccnAttr: "0123456789012345",
+				},
+				{
+					ageAttr: "22",
+					ssnAttr: "987-65-4321",
+					ccnAttr: "0123456789012345",
+				},
+			},
+		},
+	}
+
+	table1 := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName1,
+	}
+	table2 := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName2,
+	}
+
+	expectedFromClassifier1 := []Result{
+		{
+			Table:           &table1,
+			AttributeName:   ageAttr,
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table1,
+			AttributeName:   ssnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table1,
+			AttributeName:   ccnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+	expectedFromClassifier2 := []Result{
+		{
+			Table:           &table2,
+			AttributeName:   ageAttr,
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table2,
+			AttributeName:   ssnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table2,
+			AttributeName:   ccnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+	expected := append(expectedFromClassifier1, expectedFromClassifier2...)
+
+	classifiers := map[string]Classifier{
+		"classifier1": Classifier(
+			fakeClassifier{
+				classify: func(
+					table *ClassifiedTable,
+					attrs map[string]any,
+				) ([]Result, error) {
+					return expectedFromClassifier1, nil
+				},
+			},
+		),
+		"classifier2": Classifier(
+			fakeClassifier{
+				classify: func(
+					table *ClassifiedTable,
+					attrs map[string]any,
+				) ([]Result, error) {
+					return expectedFromClassifier2, nil
+				},
+			},
+		),
+	}
+
+	actual, err := AggregateClassifySamples(context.Background(), classifiers, samples)
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, actual)
+}
diff --git a/classification/examples/example_policy.rego b/classification/examples/example_policy.rego
new file mode 100644
index 0000000..f872855
--- /dev/null
+++ b/classification/examples/example_policy.rego
@@ -0,0 +1,70 @@
+package classifier
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "EMAIL" if {
+	regex.match(
+		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
+		val
+	)
+}
+
+classify(_, val) := "PHONE" if {
+	regex.match(
+		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
+		val
+	)
+}
+
+classify(_, val) := "SSN" if {
+	regex.match(
+		`\A((((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))-((0[1-9])|([1-9]\d))-((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))+((0[1-9])|([1-9]\d))+((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))\.((0[1-9])|([1-9]\d))\.((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))((0[1-9])|([1-9]\d))((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3}))))\z`,
+		val
+	)
+}
+
+classify(_, val) := "CCN" if {
+	regex.match(
+		`\A(4[0-9]{3}[0-9]{4}[0-9]{4}[0-9](?:[0-9]{3})?|[0-9]{4}[-][0-9]{4}[-][0-9]{4}[-][0-9]{4}|5[1-5][0-9]{2}[0-9]{4}[0-9]{4}[0-9]{4}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\z`,
+		val
+	)
+}
+
+classify(_, val) := "IP_ADDRESS" if {
+	regex.match(
+		`\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
+		val
+	)
+}
+
+classify(key, val) := "AGE" if {
+	lower(key) == "age"
+	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\A.*address.*\z`, lower(key))
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\Astreet.*\z`, lower(key))
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "state"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zip"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zipcode"
+}
diff --git a/classification/examples/example_policy_simple.rego b/classification/examples/example_policy_simple.rego
new file mode 100644
index 0000000..9a2c312
--- /dev/null
+++ b/classification/examples/example_policy_simple.rego
@@ -0,0 +1,22 @@
+package classifier
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "CCN" if {
+	regex.match(
+		`\A(4[0-9]{3}[0-9]{4}[0-9]{4}[0-9](?:[0-9]{3})?|[0-9]{4}[-][0-9]{4}[-][0-9]{4}[-][0-9]{4}|5[1-5][0-9]{2}[0-9]{4}[0-9]{4}[0-9]{4}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\z`,
+		val
+	)
+}
+
+classify(key, val) := "AGE" if {
+	contains(lower(key), "age")
+	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
+}
diff --git a/classification/label.go b/classification/label.go
new file mode 100644
index 0000000..42709fb
--- /dev/null
+++ b/classification/label.go
@@ -0,0 +1,43 @@
+package classification
+
+import (
+	"embed"
+	"fmt"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// Label represents a data classification label.
+type Label struct {
+	Name               string   `json:"name"`
+	Description        string   `json:"description"`
+	Tags               []string `json:"tags"`
+	ClassificationRule string   `json:"-"`
+}
+
+//go:embed rego/*.rego
+var regoFs embed.FS
+
+//go:embed rego/labels.yaml
+var labelsYaml string
+
+// GetLabels returns a slice of all known labels defined in the labels.yaml
+// file.
+func GetLabels() ([]*Label, error) {
+	lbls := struct {
+		Labels []*Label `yaml:"labels"`
+	}{}
+	if err := yaml.Unmarshal([]byte(labelsYaml), &lbls); err != nil {
+		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
+	}
+	for _, lbl := range lbls.Labels {
+		fname := "rego/" + strings.ReplaceAll(strings.ToLower(lbl.Name), " ", "_") + ".rego"
+		b, err := regoFs.ReadFile(fname)
+		if err != nil {
+			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
+		}
+		lbl.ClassificationRule = string(b)
+	}
+	return lbls.Labels, nil
+}
diff --git a/classification/publisher/publisher.go b/classification/publisher/publisher.go
new file mode 100644
index 0000000..97a33b7
--- /dev/null
+++ b/classification/publisher/publisher.go
@@ -0,0 +1,21 @@
+// Package publisher provides types for publishing data classifications results
+// to an external source (Publisher), such as to stdout (StdOutPublisher).
+package publisher
+
+import (
+	"context"
+
+	"github.com/cyralinc/dmap/classification"
+)
+
+// Publisher publishes classification and discovery results to some destination,
+// which is left up to the implementer.
+type Publisher interface {
+	// PublishClassifications publishes a list of classification.Result to
+	// some destination. Any error(s) during publication should be returned.
+	PublishClassifications(
+		ctx context.Context,
+		repoId string,
+		results []classification.Result,
+	) error
+}
diff --git a/classification/publisher/stdout.go b/classification/publisher/stdout.go
new file mode 100644
index 0000000..30b65b7
--- /dev/null
+++ b/classification/publisher/stdout.go
@@ -0,0 +1,39 @@
+package publisher
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/cyralinc/dmap/classification"
+)
+
+// StdOutPublisher "publishes" classification results to stdout in JSON format.
+type StdOutPublisher struct{}
+
+// StdOutPublisher implements Publisher
+var _ Publisher = (*StdOutPublisher)(nil)
+
+func NewStdOutPublisher() *StdOutPublisher {
+	return &StdOutPublisher{}
+}
+
+func (c *StdOutPublisher) PublishClassifications(
+	_ context.Context,
+	repoId string,
+	results []classification.Result,
+) error {
+	classifications := struct {
+		Repo            string                  `json:"repo"`
+		Classifications []classification.Result `json:"classifications"`
+	}{
+		Repo:            repoId,
+		Classifications: results,
+	}
+	b, err := json.MarshalIndent(classifications, "", "    ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal classifications: %w", err)
+	}
+	fmt.Println(string(b))
+	return nil
+}
diff --git a/classification/rego/README.md b/classification/rego/README.md
new file mode 100644
index 0000000..c664cbe
--- /dev/null
+++ b/classification/rego/README.md
@@ -0,0 +1,8 @@
+This directory contains all the data label definitions used for classification.
+The label metadata is specified in the [`labels.yaml`](labels.yaml) file. Please
+see that file's doc comment for more details.
+
+Additionally, the classification rule Rego code must be specified as a
+`<label>.rego` file, where `<label>` is the name of the label in lowercase. For
+example, if the label `ADDRESS` is defined in `labels.yaml`, it should have an
+`address.rego` file defined as well.
diff --git a/classification/rego/address.rego b/classification/rego/address.rego
new file mode 100644
index 0000000..e61d882
--- /dev/null
+++ b/classification/rego/address.rego
@@ -0,0 +1,34 @@
+package classifier_address
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "state"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zip"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zipcode"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zipcode"
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\A.*address.*\z`, lower(key))
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\Astreet.*\z`, lower(key))
+}
diff --git a/classification/rego/address_test.rego b/classification/rego/address_test.rego
new file mode 100644
index 0000000..e97150e
--- /dev/null
+++ b/classification/rego/address_test.rego
@@ -0,0 +1,61 @@
+package classifier_address
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_column_name_state {
+    output.state == "ADDRESS" with input as {"state":"AZ"}
+}
+
+test_insensitive_column_name_state {
+    output.STATE == "ADDRESS" with input as {"STATE":"AZ"}
+}
+
+test_column_name_address {
+    output.address == "ADDRESS" with input as {"address":"123 some street"}
+}
+
+test_insensitive_column_name_address {
+    output.ADDRESS == "ADDRESS" with input as {"ADDRESS":"123 some street"}
+}
+
+test_column_name_contains_address {
+    output.some_address_here == "ADDRESS" with input as {"some_address_here":"123 some street"}
+}
+
+test_insensitive_column_name_contains_address {
+    output.some_ADDRESS_Here == "ADDRESS" with input as {"some_ADDRESS_Here":"123 some street"}
+}
+
+test_column_name_street {
+    output.street == "ADDRESS" with input as {"street":"123 some street"}
+}
+
+test_insensitive_column_name_street {
+    output.STREET == "ADDRESS" with input as {"STREET":"123 some street"}
+}
+
+test_column_name_starts_with_street {
+    output.street_name == "ADDRESS" with input as {"street_name":"123 some street"}
+}
+
+test_insensitive_column_name_starts_with_street {
+    output.STREET_Name == "ADDRESS" with input as {"STREET_Name":"123 some street"}
+}
+
+test_column_name_zip {
+    output.zip == "ADDRESS" with input as {"zip":"11111"}
+}
+
+test_insensitive_column_name_zip {
+    output.ZIP == "ADDRESS" with input as {"ZIP":"11111"}
+}
+
+test_column_name_zipcode {
+    output.zipcode == "ADDRESS" with input as {"zipcode":"11111"}
+}
+
+test_insensitive_column_name_zipcode {
+    output.ZIPCODE == "ADDRESS" with input as {"ZIPCODE":"11111"}
+}
diff --git a/classification/rego/age.rego b/classification/rego/age.rego
new file mode 100644
index 0000000..6797bd1
--- /dev/null
+++ b/classification/rego/age.rego
@@ -0,0 +1,15 @@
+package classifier_age
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "AGE" if {
+	lower(key) == "age"
+	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
+}
diff --git a/classification/rego/age_test.rego b/classification/rego/age_test.rego
new file mode 100644
index 0000000..edc3ef5
--- /dev/null
+++ b/classification/rego/age_test.rego
@@ -0,0 +1,37 @@
+package classifier_age
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_column_name_age_invalid_age {
+    output.age == "UNLABELED" with input as {"age":"120"}
+}
+
+test_insensitive_column_name_age_invalid {
+    output.AGE == "UNLABELED" with input as {"AGE":"120"}
+}
+
+test_column_name_age_single_digit {
+    output.age == "AGE" with input as {"age":"1"}
+}
+
+test_insensitive_column_name_age_single_digit {
+    output.AGE == "AGE" with input as {"AGE":"1"}
+}
+
+test_column_name_age_double_digit {
+    output.age == "AGE" with input as {"age":"10"}
+}
+
+test_insensitive_column_name_age_double_digit {
+    output.AGE == "AGE" with input as {"AGE":"10"}
+}
+
+test_column_name_age_triple_digit {
+    output.age == "AGE" with input as {"age":"100"}
+}
+
+test_insensitive_column_name_age_triple_digit {
+    output.AGE == "AGE" with input as {"AGE":"100"}
+}
diff --git a/classification/rego/ccn.rego b/classification/rego/ccn.rego
new file mode 100644
index 0000000..5c8d343
--- /dev/null
+++ b/classification/rego/ccn.rego
@@ -0,0 +1,17 @@
+package classifier_ccn
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "CCN" if {
+	regex.match(
+		`\A(?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})\z`,
+		val
+    )
+}
diff --git a/classification/rego/ccn_test.rego b/classification/rego/ccn_test.rego
new file mode 100644
index 0000000..31d2e40
--- /dev/null
+++ b/classification/rego/ccn_test.rego
@@ -0,0 +1,26 @@
+package classifier_ccn
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_valid_amex_ccn {
+    output.message == "CCN" with input as {"message":"370136066365291"}
+}
+
+test_valid_visa_ccn {
+    output.message == "CCN" with input as {"message":"4613688275707134"}
+}
+
+test_valid_mastercard_ccn {
+    output.message == "CCN" with input as {"message":"5423909386888564"}
+}
+
+# TODO : Fix pattern to match
+test_valid_mastercard_ccn {
+    output.message == "CCN" with input as {"message":"2701306282695666"}
+}
+
+test_valid_discover_ccn {
+    output.message == "CCN" with input as {"message":"6536673682309236"}
+}
diff --git a/classification/rego/cvv.rego b/classification/rego/cvv.rego
new file mode 100644
index 0000000..075b705
--- /dev/null
+++ b/classification/rego/cvv.rego
@@ -0,0 +1,58 @@
+package classifier_cvv
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvv"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "csc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "3csc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cav"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cid"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvd"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cve"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvn"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "spc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "pvv"
+}
+
+classify(_, val) := "CVV" if {
+	regex.match(`^\d{3,4}$`, val)
+}
diff --git a/classification/rego/cvv_test.rego b/classification/rego/cvv_test.rego
new file mode 100644
index 0000000..233ec72
--- /dev/null
+++ b/classification/rego/cvv_test.rego
@@ -0,0 +1,29 @@
+package classifier_cvv
+
+test_cvv_key {
+	output.CVV == "CVV" with input as {"CVV":"test"}
+}
+
+test_cvv_key {
+	output.cvv == "CVV" with input as {"cvv":"test"}
+}
+
+test_cvv_key {
+	output.CvV == "CVV" with input as {"CvV":"test"}
+}
+
+test_cvv_pattern {
+	output.message == "CVV" with input as {"message":"451"}
+}
+
+test_cvv_pattern {
+	output.message == "CVV" with input as {"message":"5061"}
+}
+
+test_cvv_pattern {
+	output.message == "CVV" with input as {"message":"123"}
+}
+
+test_cvv_pattern {
+	output.message == "UNLABELED" with input as {"message":"12345"}
+}
diff --git a/classification/rego/dob.rego b/classification/rego/dob.rego
new file mode 100644
index 0000000..424e079
--- /dev/null
+++ b/classification/rego/dob.rego
@@ -0,0 +1,45 @@
+package classifier_dob
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "DOB" if {
+	lower(key) == "dob"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "dateofbirth"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "date_of_birth"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "birthdate"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "birth_date"
+}
+
+classify(_, val) := "DOB" if {
+	# mm/dd/yyyy mm-dd-yyyy mm.dd.yyyy
+	regex.match(`^(0?[1-9]|1[0-2])[\/\.-](0?[1-9]|[12]\d|3[01])[\/\.-](19|20)\d{2}$`, val)
+}
+
+classify(_, val) := "DOB" if {
+	# dd/mm/yyyy
+	regex.match(`^(0?[1-9]|[12]\d|3[01])[\/\.-](0?[1-9]|1[0-2])[\/\.-](19|20)\d{2}$`, val)
+}
+
+classify(_, val) := "DOB" if {
+	# yyyy/mm/dd
+	regex.match(`^(19|20)\d{2}[\/\.-](0?[1-9]|1[0-2])[\/\.-](0?[1-9]|[12]\d|3[01])$`, val)
+}
diff --git a/classification/rego/dob_test.rego b/classification/rego/dob_test.rego
new file mode 100644
index 0000000..bd25728
--- /dev/null
+++ b/classification/rego/dob_test.rego
@@ -0,0 +1,110 @@
+package classifier_dob
+
+test_dob_key {
+	output.dob == "DOB" with input as {"dob":"test"}
+}
+
+test_dob_key {
+	output.DOB == "DOB" with input as {"DOB":"test"}
+}
+
+test_dob_key {
+	output.DoB == "DOB" with input as {"DoB":"test"}
+}
+
+test_dob_key {
+	output.birthdate == "DOB" with input as {"birthdate":"test"}
+}
+
+test_dob_key {
+	output.BirthDate == "DOB" with input as {"BirthDate":"test"}
+}
+
+test_dob_key {
+	output.dateofbirth == "DOB" with input as {"dateofbirth":"test"}
+}
+
+test_dob_key {
+	output.DateOfBirth == "DOB" with input as {"DateOfBirth":"test"}
+}
+
+test_dob_key {
+	output.birthdate == "DOB" with input as {"birthdate":"test"}
+}
+
+test_dob_key {
+	output.birth_date == "DOB" with input as {"birth_date":"test"}
+}
+
+# mm/dd/yyyy
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"01/01/1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1-1-1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"10.01.1971"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"11/30/2023"}
+}
+
+# dd/mm/yyyy
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"01/01/1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1/1/1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"10/01/1971"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"30/11/2023"}
+}
+
+
+# yyyy/mm/dd
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900/01/10"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900/1/1"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1971/10/01"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"2023/12/31"}
+}
+
+# yyyy-mm-dd
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900-01-10"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900-1-1"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1971-10-01"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"2023-12-31"}
+}
diff --git a/classification/rego/email.rego b/classification/rego/email.rego
new file mode 100644
index 0000000..821cfd8
--- /dev/null
+++ b/classification/rego/email.rego
@@ -0,0 +1,17 @@
+package classifier_email
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "EMAIL" if {
+	regex.match(
+		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
+		val
+	)
+}
diff --git a/classification/rego/email_test.rego b/classification/rego/email_test.rego
new file mode 100644
index 0000000..3a5b007
--- /dev/null
+++ b/classification/rego/email_test.rego
@@ -0,0 +1,13 @@
+package classifier_email
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_valid_email_com {
+    output.message == "EMAIL" with input as {"message":"me@me.com"}
+}
+
+test_valid_email_us {
+    output.message == "EMAIL" with input as {"message":"me@state.pa.us"}
+}
diff --git a/classification/rego/first_name.rego b/classification/rego/first_name.rego
new file mode 100644
index 0000000..0052607
--- /dev/null
+++ b/classification/rego/first_name.rego
@@ -0,0 +1,20 @@
+package classifier_first_name
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "FIRST_NAME" if {
+	contains(lower(key), "first")
+	contains(lower(key), "name")
+}
+
+classify(key, _) := "FIRST_NAME" if {
+	contains(lower(key), "given")
+	contains(lower(key), "name")
+}
diff --git a/classification/rego/first_name_test.rego b/classification/rego/first_name_test.rego
new file mode 100644
index 0000000..6c16add
--- /dev/null
+++ b/classification/rego/first_name_test.rego
@@ -0,0 +1,49 @@
+package classifier_first_name
+
+test_fn_pattern {
+	output.first_name == "FIRST_NAME" with input as {"first_name":"John"}
+}
+
+test_fn_pattern {
+	output.first_name == "FIRST_NAME" with input as {"first_name":"Robert"}
+}
+
+test_fn_pattern {
+	output.firstname == "FIRST_NAME" with input as {"firstname":"Robert"}
+}
+
+test_fn_pattern {
+	output.firstName == "FIRST_NAME" with input as {"firstName":"Robert"}
+}
+
+test_fn_pattern {
+	output.First_Name == "FIRST_NAME" with input as {"First_Name":"Robert"}
+}
+
+test_fn_pattern {
+	output.FirstName == "FIRST_NAME" with input as {"FirstName":"Robert"}
+}
+
+test_gn_pattern {
+	output.given_name == "FIRST_NAME" with input as {"given_name":"John"}
+}
+
+test_gn_pattern {
+	output.given_name == "FIRST_NAME" with input as {"given_name":"Robert"}
+}
+
+test_gn_pattern {
+	output.givenname == "FIRST_NAME" with input as {"givenname":"Robert"}
+}
+
+test_gn_pattern {
+	output.givenName == "FIRST_NAME" with input as {"givenName":"Robert"}
+}
+
+test_gn_pattern {
+	output.Given_Name == "FIRST_NAME" with input as {"Given_Name":"Robert"}
+}
+
+test_gn_pattern {
+	output.GivenName == "FIRST_NAME" with input as {"GivenName":"Robert"}
+}
diff --git a/classification/rego/full_name.rego b/classification/rego/full_name.rego
new file mode 100644
index 0000000..c5f8102
--- /dev/null
+++ b/classification/rego/full_name.rego
@@ -0,0 +1,15 @@
+package classifier_full_name
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "FULL_NAME" if {
+	contains(lower(key), "full")
+	contains(lower(key), "name")
+}
diff --git a/classification/rego/full_name_test.rego b/classification/rego/full_name_test.rego
new file mode 100644
index 0000000..78b39c5
--- /dev/null
+++ b/classification/rego/full_name_test.rego
@@ -0,0 +1,25 @@
+package classifier_full_name
+
+test_fn_pattern {
+	output.full_name == "FULL_NAME" with input as {"full_name":"John"}
+}
+
+test_fn_pattern {
+	output.full_name == "FULL_NAME" with input as {"full_name":"Robert"}
+}
+
+test_fn_pattern {
+	output.fullname == "FULL_NAME" with input as {"fullname":"Robert"}
+}
+
+test_fn_pattern {
+	output.fullName == "FULL_NAME" with input as {"fullName":"Robert"}
+}
+
+test_fn_pattern {
+	output.Full_Name == "FULL_NAME" with input as {"Full_Name":"Robert"}
+}
+
+test_fn_pattern {
+	output.FullName == "FULL_NAME" with input as {"FullName":"Robert"}
+}
diff --git a/classification/rego/ip_address.rego b/classification/rego/ip_address.rego
new file mode 100644
index 0000000..c14b33e
--- /dev/null
+++ b/classification/rego/ip_address.rego
@@ -0,0 +1,28 @@
+package classifier_ip_address
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "IP_ADDRESS" if {
+	regex.match(`\d+\.\d+\.\d+\.\d+`, val)
+}
+
+classify(key, val) := "IP_ADDRESS" if {
+	regex.match(
+	    `\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
+	    val
+	)
+}
+
+classify(key, val) := "IP_ADDRESS" if {
+	regex.match(
+		`\A(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\z`,
+		val
+	)
+}
diff --git a/classification/rego/ip_address_test.rego b/classification/rego/ip_address_test.rego
new file mode 100644
index 0000000..3ab915d
--- /dev/null
+++ b/classification/rego/ip_address_test.rego
@@ -0,0 +1,25 @@
+package classifier_ip_address
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_ipv4_google {
+    output.column == "IP_ADDRESS" with input as {"column":"8.8.8.8"}
+}
+
+test_ipv4_localhost {
+    output.column == "IP_ADDRESS" with input as {"column":"127.0.0.1"}
+}
+
+test_ipv4_internal {
+    output.column == "IP_ADDRESS" with input as {"column":"10.1.1.1"}
+}
+
+test_ipv6 {
+    output.column == "IP_ADDRESS" with input as {"column":"2001:db8:3333:4444:5555:6666:7777:8888"}
+}
+
+test_ipv6_google {
+    output.column == "IP_ADDRESS" with input as {"column":"2001:4860:4860::8888"}
+}
diff --git a/classification/rego/labels.yaml b/classification/rego/labels.yaml
new file mode 100644
index 0000000..462dbf8
--- /dev/null
+++ b/classification/rego/labels.yaml
@@ -0,0 +1,77 @@
+# Contains all the predefined data labels by Cyral. To add a new predefined
+# label, define it in this file along with its classification rule Rego code in
+# a '<label>.rego' file.
+#
+# YAML structure:
+#
+# labels:               # The list of labels
+#   - name: foo         # The label name
+#     description: bar  # The label description
+#     tags:             # The label tags (list)
+#       - tag1
+#       - tag2
+labels:
+  - name: Address
+    description: Address
+    tags:
+      - PII
+
+  - name: Age
+    description: Age
+    tags:
+      - PII
+
+  - name: CCN
+    description: Credit card number
+    tags:
+      - PCI
+
+  - name: CVV
+    description: Credit card verification value (CVV)
+    tags:
+      - PCI
+
+  - name: DOB
+    description: Date of birth
+    tags:
+      - PII
+
+  - name: Email
+    description: Email address
+    tags:
+      - PII
+
+  - name: First Name
+    description: First name
+    tags:
+      - PII
+
+  - name: Full Name
+    description: Full name
+    tags:
+      - PII
+
+  - name: IP Address
+    description: IP address
+    tags:
+      - PII
+
+  - name: Last Name
+    description: Last name
+    tags:
+      - PII
+
+  - name: Passport
+    description: Passport number
+    tags:
+      - PII
+
+  - name: Phone Number
+    description: Phone number
+    tags:
+      - PII
+
+  - name: SSN
+    description: Social security number
+    tags:
+      - PII
diff --git a/classification/rego/last_name.rego b/classification/rego/last_name.rego
new file mode 100644
index 0000000..977807f
--- /dev/null
+++ b/classification/rego/last_name.rego
@@ -0,0 +1,20 @@
+package classifier_last_name
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "LAST_NAME" if {
+	contains(lower(key), "last")
+	contains(lower(key), "name")
+}
+
+classify(key, _) := "LAST_NAME" if {
+	contains(lower(key), "sur")
+	contains(lower(key), "name")
+}
diff --git a/classification/rego/last_name_test.rego b/classification/rego/last_name_test.rego
new file mode 100644
index 0000000..6e9edaa
--- /dev/null
+++ b/classification/rego/last_name_test.rego
@@ -0,0 +1,49 @@
+package classifier_last_name
+
+test_ln_pattern {
+	output.last_name == "LAST_NAME" with input as {"last_name":"John"}
+}
+
+test_ln_pattern {
+	output.last_name == "LAST_NAME" with input as {"last_name":"Robert"}
+}
+
+test_ln_pattern {
+	output.lastname == "LAST_NAME" with input as {"lastname":"Robert"}
+}
+
+test_ln_pattern {
+	output.lastName == "LAST_NAME" with input as {"lastName":"Robert"}
+}
+
+test_ln_pattern {
+	output.Last_Name == "LAST_NAME" with input as {"Last_Name":"Robert"}
+}
+
+test_ln_pattern {
+	output.LastName == "LAST_NAME" with input as {"LastName":"Robert"}
+}
+
+test_sn_pattern {
+	output.sur_name == "LAST_NAME" with input as {"sur_name":"John"}
+}
+
+test_sn_pattern {
+	output.sur_name == "LAST_NAME" with input as {"sur_name":"Robert"}
+}
+
+test_sn_pattern {
+	output.surname == "LAST_NAME" with input as {"surname":"Robert"}
+}
+
+test_sn_pattern {
+	output.surName == "LAST_NAME" with input as {"surName":"Robert"}
+}
+
+test_sn_pattern {
+	output.Sur_Name == "LAST_NAME" with input as {"Sur_Name":"Robert"}
+}
+
+test_sn_pattern {
+	output.SurName == "LAST_NAME" with input as {"SurName":"Robert"}
+}
diff --git a/classification/rego/passport.rego b/classification/rego/passport.rego
new file mode 100644
index 0000000..c9df3cb
--- /dev/null
+++ b/classification/rego/passport.rego
@@ -0,0 +1,22 @@
+package classifier_passport
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "PASSPORT" if {
+	contains(lower(key), "passport")
+}
+
+classify(_, val) := "PASSPORT" if {
+	regex.match(`^[A-PR-WYZ]{1,2}[1-9]\d\s?\d{4,6}[1-9]$`, val)
+}
+
+classify(_, val) := "PASSPORT" if {
+	regex.match(`^[1-9]\d\s?\d{4,6}[1-9][A-PR-WY]{1,2}$`, val)
+}
diff --git a/classification/rego/passport_test.rego b/classification/rego/passport_test.rego
new file mode 100644
index 0000000..44fc4b3
--- /dev/null
+++ b/classification/rego/passport_test.rego
@@ -0,0 +1,65 @@
+package classifier_passport
+
+test_passport_key {
+	output.passport == "PASSPORT" with input as {"passport":"not-a-passport-number"}
+}
+
+# United States
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"A12345678"}
+}
+
+# Canada
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"G12345678"}
+}
+
+# United Kingdom
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"GH1234567"}
+}
+
+# Australia
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"P12345678"}
+}
+
+# India
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"P1234567"}
+}
+
+# Germany
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"E12345678"}
+}
+
+# China
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"E123456789"}
+}
+
+# Japan
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"P1234567"}
+}
+
+# South Korea
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"M12345678"}
+}
+
+# Brazil
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"G12345678"}
+}
+
+# Mexico
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"E12345678"}
+}
+
+# South Africa (diplomat, standard covered by other countries)
+test_passport_sa_pattern {
+	output.message == "PASSPORT" with input as {"message":"D123456789"}
+}
diff --git a/classification/rego/phone_number.rego b/classification/rego/phone_number.rego
new file mode 100644
index 0000000..fd29c8a
--- /dev/null
+++ b/classification/rego/phone_number.rego
@@ -0,0 +1,17 @@
+package classifier_phone_number
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "PHONE" if {
+	regex.match(
+		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
+		val
+	)
+}
diff --git a/classification/rego/phone_number_test.rego b/classification/rego/phone_number_test.rego
new file mode 100644
index 0000000..73295ea
--- /dev/null
+++ b/classification/rego/phone_number_test.rego
@@ -0,0 +1,13 @@
+package classifier_phone_number
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_valid_us_phone {
+    output.message == "PHONE" with input as {"message":"7175551212"}
+}
+
+test_valid_us_phone {
+    output.message == "PHONE" with input as {"message":"17175551212"}
+}
diff --git a/classification/rego/ssn.rego b/classification/rego/ssn.rego
new file mode 100644
index 0000000..eb0ca9a
--- /dev/null
+++ b/classification/rego/ssn.rego
@@ -0,0 +1,24 @@
+package classifier_ssn
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "SSN" if {
+	pattern := regex.find_n(`\b(\d{9}|\d{3}\-\d{2}\-\d{4})\b`, val, 1)
+	count(pattern) == 1
+	t_val := replace(pattern[0], "-", "")
+	f_check := substring(t_val, 0, 3)
+	f_check != "000"
+	f_check != "666"
+	to_number(f_check) < 900
+	m_check := substring(t_val, 3, 2)
+	m_check != "00"
+	e_check := substring(t_val, 5, 4)
+	e_check != "0000"
+}
diff --git a/classification/rego/ssn_test.rego b/classification/rego/ssn_test.rego
new file mode 100644
index 0000000..7f6a8d5
--- /dev/null
+++ b/classification/rego/ssn_test.rego
@@ -0,0 +1,73 @@
+package classifier_ssn
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_invalid_first_000 {
+    output.column == "UNLABELED" with input as {"column":"000123456"}
+}
+
+test_invalid_first_666 {
+    output.column == "UNLABELED" with input as {"column":"666123456"}
+}
+
+test_invalid_first_900s {
+    output.column == "UNLABELED" with input as {"column":"905123456"}
+}
+
+test_invalid_middle {
+    output.column == "UNLABELED" with input as {"column":"123006789"}
+}
+
+test_invalid_end {
+    output.column == "UNLABELED" with input as {"column":"123450000"}
+}
+
+test_ssn_on_valid_amex_ccn {
+    output.message == "UNLABELED" with input as {"message":"370136066365291"}
+}
+
+test_ssn_on_valid_amex_ccn {
+    output.message == "UNLABELED" with input as {"message":"370136066365291"}
+}
+
+test_ssn_on_valid_visa_ccn {
+    output.message == "UNLABELED" with input as {"message":"4613688275707134"}
+}
+
+test_ssn_on_valid_mastercard_format_1_ccn {
+    output.message == "UNLABELED" with input as {"message":"5423909386888564"}
+}
+
+test_ssn_on_valid_mastercard_format_2_ccn {
+    output.message == "UNLABELED" with input as {"message":"2701306282695666"}
+}
+
+test_ssn_on_valid_discover_ccn {
+    output.message == "UNLABELED" with input as {"message":"6536673682309236"}
+}
+
+test_valid_ssn_dashes {
+    output.message == "SSN" with input as {"message":"111-11-1111"}
+}
+
+test_valid_ssn_dashes_sequential {
+    output.message == "SSN" with input as {"message":"123-45-6789"}
+}
+
+test_valid_ssn_dashes_in_value {
+    output.message == "SSN" with input as {"message":"this has a ssn 111-11-1111 that is valid"}
+}
+
+test_valid_ssn_no_dashes {
+    output.message == "SSN" with input as {"message":"111111111"}
+}
+
+test_valid_ssn_no_dashes_sequential {
+    output.message == "SSN" with input as {"message":"123456789"}
+}
+
+test_valid_ssn_no_dashes_in_value {
+    output.message == "SSN" with input as {"message":"this has a ssn 111111111 that is valid"}
+}
diff --git a/classification/rego_classifier.go b/classification/rego_classifier.go
new file mode 100644
index 0000000..a215b33
--- /dev/null
+++ b/classification/rego_classifier.go
@@ -0,0 +1,126 @@
+package classification
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/rego"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	unlabeledLabel = "UNLABELED"
+)
+
+// TODO: godoc -ccampo 2024-03-26
+type LabelClassifier struct {
+	lbl           *Label
+	preparedQuery rego.PreparedEvalQuery
+}
+
+// *LabelClassifier implements Classifier
+var _ Classifier = (*LabelClassifier)(nil)
+
+// TODO: godoc -ccampo 2024-03-26
+func NewLabelClassifier(lbl *Label) (*LabelClassifier, error) {
+	if lbl == nil {
+		return nil, fmt.Errorf("label cannot be nil")
+	}
+	q, err := prepareClassifierCode(lbl.ClassificationRule)
+	if err != nil {
+		return nil, err
+	}
+	return &LabelClassifier{lbl: lbl, preparedQuery: q}, nil
+}
+
+// TODO: godoc -ccampo 2024-03-26
+func (c *LabelClassifier) Classify(
+	_ context.Context,
+	table *ClassifiedTable,
+	attrs map[string]any,
+) ([]Result, error) {
+	if c == nil || len(attrs) == 0 {
+		return nil, fmt.Errorf("invalid arguments")
+	}
+
+	results, err := c.preparedQuery.Eval(context.Background(), rego.EvalInput(attrs))
+	if err != nil {
+		return nil, fmt.Errorf(
+			"[classifier %s] error evaluating query for inputs %s; %w", c.lbl.Name, attrs, err,
+		)
+	}
+
+	log.Debugf("[classifier %s] results: '%s'", c.lbl.Name, results)
+	if len(results) != 1 || len(results[0].Expressions) != 1 {
+		return nil, fmt.Errorf(
+			"[classifier %s] received malformed result in classification eval - expected 1 result with 1 expression result, but found: '%s'",
+			c.lbl.Name,
+			results,
+		)
+	}
+
+	exprValue := results[0].Expressions[0]
+	if exprValue == nil {
+		return nil, fmt.Errorf("[classifier %s] did not expect nil value in expression value", c.lbl.Name)
+	}
+
+	mapVal := results[0].Expressions[0].Value
+	resolvedMap, ok := mapVal.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf(
+			"[classifier %s] expected type to be map[string]any, but found: %T", c.lbl.Name, mapVal,
+		)
+	}
+
+	// Count the number of classifications, ignoring unlabeled classifications.
+	resultLength := 0
+	for _, v := range resolvedMap {
+		if v != unlabeledLabel {
+			resultLength++
+		}
+	}
+
+	// If there are no classifications, return nil.
+	if resultLength == 0 {
+		return nil, nil
+	}
+
+	classifications := make([]Result, resultLength)
+	resultIndex := 0
+	for attrName, v := range resolvedMap {
+		valueAsString, ok := v.(string)
+		if !ok {
+			log.Errorf("value type expected to be string, was: %T", v)
+			continue
+		}
+		if valueAsString != unlabeledLabel {
+			classifications[resultIndex] = Result{
+				Table:           table,
+				AttributeName:   attrName,
+				Classifications: []*Label{c.lbl},
+			}
+			resultIndex++
+		}
+	}
+	return classifications, nil
+}
+
+func prepareClassifierCode(classifierCode string) (rego.PreparedEvalQuery, error) {
+	log.Tracef("classifier module code: '%s'", classifierCode)
+	moduleName := "classifier"
+	compiledRego, err := ast.CompileModules(map[string]string{moduleName: classifierCode})
+	if err != nil {
+		return rego.PreparedEvalQuery{}, fmt.Errorf("error compiling rego code: %w", err)
+	}
+	regoQuery := compiledRego.Modules[moduleName].Package.Path.String() + ".output"
+	retVal, err := rego.New(
+		rego.Query(regoQuery),
+		rego.Compiler(compiledRego),
+	).PrepareForEval(context.Background())
+	if err != nil {
+		return rego.PreparedEvalQuery{}, fmt.Errorf("error preparing rego code for evaluation: %w", err)
+	}
+	return retVal, nil
+}
diff --git a/classification/rego_classifier_test.go b/classification/rego_classifier_test.go
new file mode 100644
index 0000000..076fce5
--- /dev/null
+++ b/classification/rego_classifier_test.go
@@ -0,0 +1,457 @@
+package classification
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+const (
+	isDigitsRegex = "\\A\\d+\\z"
+	digitsLabel   = "DIGITS"
+	isARegex      = "\\A[Aa]\\z"
+	isALabel      = "ISA"
+	allCRegex     = "\\A[Cc]+\\z"
+	allCLabel     = "ALLC"
+)
+
+var fooTable = ClassifiedTable{
+	Repo:    "some_repo",
+	Catalog: "testdb",
+	Schema:  "testSchema",
+	Table:   "Foo",
+}
+
+var noCatalogFooTable = ClassifiedTable{
+	Repo:   "some_repo",
+	Schema: "testSchema",
+	Table:  "Foo",
+}
+
+func regexToClassifyCode(regex, label string) string {
+	return fmt.Sprintf(
+		"package classifier\noutput := \n"+
+			"{k: v |\n  v := classify(k, input[k])\n}\n"+
+			"classify(key, val) = \"%s\" {\n  re_match(`%s`, val)\n} "+
+			"else = \"UNLABELED\" {\n  true\n}",
+		label, regex,
+	)
+}
+
+func multiRegexClassify(regexes, labels []string) string {
+	return multiRegexClassifyWithPackage("classifier", regexes, labels)
+}
+
+func multiRegexClassifyWithPackage(pkg string, regexes, labels []string) string {
+	prefix := "package " + pkg + "\noutput := \n" +
+		"{k: v |\n v := classify(k, input[k])\n}\n" +
+		"classify(key, val) = "
+	middle := ""
+	for i, r := range regexes {
+		middle = fmt.Sprintf(
+			"%s\"%s\" {\n re_match(`%s`, val)\n} else = ",
+			middle, labels[i], r,
+		)
+	}
+	return fmt.Sprintf("%s%s \"UNLABELED\" {\n true\n}", prefix, middle)
+}
+
+type regoClassifyTestCase struct {
+	code            string
+	table           *ClassifiedTable
+	attributeNames  []string
+	attributeValues []string
+	expected        []Result
+}
+
+func TestRegoClassify(t *testing.T) {
+	tests := []struct {
+		name     string
+		code     string
+		table    *ClassifiedTable
+		attrs    map[string]any
+		expected []Result
+	}{
+		{
+			name: "multi regex classify",
+			code: multiRegexClassify(
+				[]string{isDigitsRegex, isARegex, allCRegex},
+				[]string{digitsLabel, isALabel, allCLabel},
+			),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "fred",
+				"b": "A",
+				"c": "123",
+				"d": "bob",
+				"e": "0",
+				"f": "cCc",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: isALabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "c",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "e",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "f",
+					Classifications: []*Label{{Name: allCLabel}},
+				},
+			},
+		},
+		{
+			name: "multi regex classify with custom package",
+			code: multiRegexClassifyWithPackage(
+				"foo_bar",
+				[]string{isDigitsRegex, isARegex, allCRegex},
+				[]string{digitsLabel, isALabel, allCLabel},
+			),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "fred",
+				"b": "A",
+				"c": "123",
+				"d": "bob",
+				"e": "0",
+				"f": "cCc",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: isALabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "c",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "e",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "f",
+					Classifications: []*Label{{Name: allCLabel}},
+				},
+			},
+		},
+		{
+			name:  "regex classifier",
+			code:  regexToClassifyCode(isDigitsRegex, digitsLabel),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "123",
+				"b": "0",
+				"c": "fred",
+				"d": "a",
+				"e": "A",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "a",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+			},
+		},
+		{
+			name:  "regex classify - no catalog",
+			code:  regexToClassifyCode(isDigitsRegex, digitsLabel),
+			table: &noCatalogFooTable,
+			attrs: map[string]any{
+				"a": "123",
+				"b": "0",
+				"c": "fred",
+				"d": "a",
+				"e": "A",
+			},
+			expected: []Result{
+				{
+					Table:           &noCatalogFooTable,
+					AttributeName:   "a",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &noCatalogFooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+			},
+		},
+		{
+			name:  "regex classify - different attributes",
+			code:  regexToClassifyCode(isARegex, isALabel),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "123",
+				"b": "0",
+				"c": "fred",
+				"d": "a",
+				"e": "A",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "d",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "e",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				classifier, err := NewLabelClassifier(&Label{Name: "dummy", ClassificationRule: tt.code})
+				if err != nil {
+					t.Errorf("Error creating classifier: %s", err.Error())
+				}
+				results, err := classifier.Classify(
+					context.Background(),
+					tt.table,
+					tt.attrs,
+				)
+				assert.NoError(t, err)
+				if len(results) != len(tt.expected) {
+					t.Errorf(
+						"Expected %d classification results, but found %d",
+						len(tt.expected), len(results),
+					)
+				}
+				for i, r := range results {
+					if tt.expected[i].Table.Repo != r.Table.Repo ||
+						tt.expected[i].Table.Catalog != r.Table.Catalog ||
+						tt.expected[i].Table.Schema != r.Table.Schema ||
+						tt.expected[i].Table.Table != r.Table.Table {
+						t.Errorf(
+							"Expected classification results[%d] tables to match. "+
+								"Found: '%+v', Expected: '%+v'",
+							i, *r.Table, *tt.expected[i].Table,
+						)
+					}
+					if tt.expected[i].AttributeName != r.AttributeName {
+						t.Errorf(
+							"Expected attribute names on classifiers[%d] to match. "+
+								"Found: %s, Expected: %s",
+							i, r.AttributeName, tt.expected[i].AttributeName,
+						)
+					}
+					if len(tt.expected[i].Classifications) != len(r.Classifications) {
+						t.Errorf(
+							"Expected length of classifications[%d] to match. "+
+								"Found: %d, Expected: %d",
+							i, len(tt.expected[i].Classifications), len(r.Classifications),
+						)
+					}
+					for j, cl := range r.Classifications {
+						if cl.Name != tt.expected[i].Classifications[j].Name {
+							t.Errorf(
+								"Expected classification[%d][%d] == '%s'; "+
+									"found: '%s'.",
+								i, j, tt.expected[i].Classifications[j].Name, cl.Name,
+							)
+						}
+					}
+				}
+			},
+		)
+	}
+}
+
+const (
+	repoName    = "repoName"
+	catalogName = "catalogName"
+	schemaName  = "schema"
+	tableName   = "table"
+)
+
+func Test_Classify_Rego_SingleSample(t *testing.T) {
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repoName,
+			Database: catalogName,
+			Schema:   schemaName,
+			Table:    tableName,
+		},
+		Results: []repository.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4256",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "4111111111111111",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	classifier := testRegoClassifier(t)
+
+	actual, err := ClassifySamples(context.Background(), classifier, []repository.Sample{sample})
+	require.NoError(t, err)
+
+	table := &ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName,
+	}
+
+	expected := []Result{
+		{
+			Table:           table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}, {Name: "CCN"}},
+		},
+		{
+			Table:           table,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+	}
+
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func Test_Classify_Rego_MultipleSamples(t *testing.T) {
+	metadata1 := repository.SampleMetadata{
+		Repo:     repoName,
+		Database: catalogName,
+		Schema:   schemaName,
+		Table:    tableName,
+	}
+
+	metadata2 := repository.SampleMetadata{
+		Repo:     repoName,
+		Database: catalogName,
+		Schema:   schemaName + "2",
+		Table:    tableName + "2",
+	}
+
+	samples := []repository.Sample{
+		{
+			Metadata: metadata1,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111111",
+				},
+			},
+		},
+		{
+			Metadata: metadata1,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+			},
+		},
+		{
+			Metadata: metadata2,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"name":            "Joe Smith",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+				{
+					"age":             "4111111111111113",
+					"name":            "Joe Smith",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+			},
+		},
+	}
+
+	classifier := testRegoClassifier(t)
+
+	actual, err := ClassifySamples(context.Background(), classifier, samples)
+	require.NoError(t, err)
+
+	table1 := &ClassifiedTable{
+		Repo:    metadata1.Repo,
+		Catalog: metadata1.Database,
+		Schema:  metadata1.Schema,
+		Table:   metadata1.Table,
+	}
+
+	table2 := &ClassifiedTable{
+		Repo:    metadata2.Repo,
+		Catalog: metadata2.Database,
+		Schema:  metadata2.Schema,
+		Table:   metadata2.Table,
+	}
+
+	expected := []Result{
+		{
+			Table:           table1,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}},
+		},
+		{
+			Table:           table1,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}, {Name: "CCN"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+	}
+
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func testRegoClassifier(t *testing.T) Classifier {
+	fin, err := os.ReadFile("./examples/example_policy_simple.rego")
+	require.NoError(t, err)
+
+	classifierCode := string(fin)
+
+	classifier, err := NewLabelClassifier(&Label{Name: "dummy", ClassificationRule: classifierCode})
+	require.NoError(t, err)
+
+	return classifier
+}
diff --git a/cmd/main.go b/cmd/main.go
new file mode 100644
index 0000000..f0444ef
--- /dev/null
+++ b/cmd/main.go
@@ -0,0 +1,75 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/alecthomas/kong"
+	log "github.com/sirupsen/logrus"
+)
+
+type Globals struct {
+	// TODO: add config file as global -ccampo 2024-03-22
+	LogLevel  logLevelFlag     `help:"Set the logging level (trace|debug|info|warn|error|fatal)" enum:"trace,debug,info,warn,error,fatal" default:"info"`
+	LogFormat logFormatFlag    `help:"Set the logging format (text|json)" enum:"text,json" default:"text"`
+	Version   kong.VersionFlag `name:"version" help:"Print version information and quit"`
+}
+
+type logLevelFlag string
+
+func (l logLevelFlag) AfterApply() error {
+	lvl, err := log.ParseLevel(string(l))
+	if err != nil {
+		return err
+	}
+	log.SetLevel(lvl)
+	return nil
+}
+
+type logFormatFlag string
+
+func (l logFormatFlag) AfterApply() error {
+	switch l {
+	case "json":
+		log.SetFormatter(&log.JSONFormatter{})
+		return nil
+	case "text":
+		log.SetFormatter(
+			&log.TextFormatter{
+				FullTimestamp:          true,
+				DisableLevelTruncation: true,
+				PadLevelText:           true,
+			},
+		)
+		return nil
+	default:
+		return fmt.Errorf("unsupported log format: %s", string(l))
+	}
+}
+
+type CLI struct {
+	Globals
+	RepoScan RepoScanCmd `cmd:"" help:"Perform data discovery and classification on a data repository."`
+}
+
+func main() {
+	cli := CLI{
+		Globals: Globals{},
+	}
+	ctx := kong.Parse(
+		&cli,
+		kong.Name("dmap"),
+		kong.Description("Assess your data security posture in AWS."),
+		kong.UsageOnError(),
+		kong.ConfigureHelp(
+			kong.HelpOptions{
+				Compact: true,
+			},
+		),
+		kong.Vars{
+			// TODO: get version from file -ccampo 2024-03-27
+			"version": "0.0.1",
+		},
+	)
+	err := ctx.Run(&cli.Globals)
+	ctx.FatalIfErrorf(err)
+}
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
new file mode 100644
index 0000000..cbd88fe
--- /dev/null
+++ b/cmd/repo_scan.go
@@ -0,0 +1,18 @@
+package main
+
+import (
+	"context"
+
+	"github.com/cyralinc/dmap/discovery"
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+type RepoScanCmd struct {
+	config.Config
+}
+
+func (cmd *RepoScanCmd) Run(_ *Globals) error {
+	craw := discovery.NewScanner(&cmd.Config)
+	defer craw.Cleanup()
+	return craw.InitAndRun(context.Background())
+}
diff --git a/discovery/config/config.go b/discovery/config/config.go
new file mode 100644
index 0000000..7b1a052
--- /dev/null
+++ b/discovery/config/config.go
@@ -0,0 +1,59 @@
+package config
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/alecthomas/kong"
+	"github.com/gobwas/glob"
+)
+
+// TODO: godoc -ccampo 2024-03-27
+type Config struct {
+	Repo RepoConfig `embed:""`
+	Dmap DmapConfig `embed:""`
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type RepoConfig struct {
+	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
+	Host         string         `help:"Hostname of the repository." required:""`
+	Port         uint16         `help:"Port of the repository." required:""`
+	User         string         `help:"Username to connect to the repository." required:""`
+	Password     string         `help:"Password to connect to the repository." required:""`
+	Advanced     map[string]any `help:"Advanced configuration for the repository."`
+	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used."`
+	MaxOpenConns uint           `help:"Maximum number of open connections to the repository." default:"10"`
+	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
+	IncludePaths GlobFlag       `help:"List of glob patterns to include when querying the database(s), as a comma separated list." default:"*"`
+	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when querying the database(s), as a comma separated list." default:""`
+}
+
+// GlobFlag is a kong.MapperValue implementation that represents a glob pattern.
+type GlobFlag []glob.Glob
+
+// TODO: godoc -ccampo 2024-03-27
+func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
+	var patterns string
+	if err := ctx.Scan.PopValueInto("string", &patterns); err != nil {
+		return err
+	}
+	var parsedPatterns []glob.Glob
+	for _, pattern := range strings.Split(patterns, ",") {
+		parsedPattern, err := glob.Compile(pattern)
+		if err != nil {
+			return fmt.Errorf("cannot compile %s pattern: %w", pattern, err)
+		}
+		parsedPatterns = append(parsedPatterns, parsedPattern)
+	}
+	ctx.Value.Target.Set(reflect.ValueOf(GlobFlag(parsedPatterns)))
+	return nil
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type DmapConfig struct {
+	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
+	ClientID     string `help:"API client ID to access the Dmap API."`
+	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
+}
diff --git a/discovery/config/util.go b/discovery/config/util.go
new file mode 100644
index 0000000..9ce32bd
--- /dev/null
+++ b/discovery/config/util.go
@@ -0,0 +1,138 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+const (
+	configConnOpts = "connection-string-args"
+)
+
+// BuildConnOptsStr parses the repo config to produce a string in the format
+// "?option=value&option2=value2". Example:
+//
+//	BuildConnOptsStr(config.RepoConfig{
+//	    Advanced: map[string]any{
+//	        "connection-string-args": []any{"sslmode=disable"},
+//	    },
+//	})
+//
+// returns ("?sslmode=disable", nil).
+func BuildConnOptsStr(cfg RepoConfig) (string, error) {
+	connOptsMap, err := MapFromConnOpts(cfg)
+	if err != nil {
+		return "", fmt.Errorf("connection options: %w", err)
+	}
+
+	connOptsStr := ""
+	for key, val := range connOptsMap {
+		// Don't add if the value is empty, since that would make the
+		// string malformed.
+		if val != "" {
+			if connOptsStr == "" {
+				connOptsStr += fmt.Sprintf("%s=%s", key, val)
+			} else {
+				// Need & for subsequent options
+				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
+			}
+		}
+	}
+	// Only add ? if connection string is not empty
+	if connOptsStr != "" {
+		connOptsStr = "?" + connOptsStr
+	}
+
+	return connOptsStr, nil
+}
+
+// MapFromConnOpts builds a map from the list of connection options given in the
+// config. Each option has the format 'option=value'. Err only if the config is
+// malformed, to inform user.
+func MapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
+	m := make(map[string]string)
+	connOptsInterface, ok := cfg.Advanced[configConnOpts]
+	if !ok {
+		return nil, nil
+	}
+	connOpts, ok := connOptsInterface.([]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
+	}
+	for _, optInterface := range connOpts {
+		opt, ok := optInterface.(string)
+		if !ok {
+			return nil, fmt.Errorf("'%v' is not a string", optInterface)
+		}
+		splitOpt := strings.Split(opt, "=")
+		if len(splitOpt) != 2 {
+			return nil, fmt.Errorf(
+				"malformed '%s'. "+
+					"Please follow the format 'option=value'", configConnOpts,
+			)
+		}
+		key := splitOpt[0]
+		val := splitOpt[1]
+		m[key] = val
+	}
+	return m, nil
+}
+
+// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
+// for a given repo and set of parameters. Example:
+//
+// repo-advanced:
+//
+//	snowflake:
+//	  account: exampleAccount
+//	  role: exampleRole
+//	  warehouse: exampleWarehouse
+//
+// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
+// []string{"account", "role", "warehouse"}) returns the map
+//
+// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
+// "exampleWarehouse"}
+//
+// The suffix 'String' means that the values of the map are strings. This gives
+// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
+// without name conflicts.
+func FetchAdvancedConfigString(
+	cfg RepoConfig,
+	repo string,
+	parameters []string,
+) (map[string]string, error) {
+	advancedCfg, err := getAdvancedConfig(cfg, repo)
+	if err != nil {
+		return nil, err
+	}
+	repoSpecificMap := make(map[string]string)
+	for _, key := range parameters {
+		var valInterface any
+		var val string
+		var ok bool
+		if valInterface, ok = advancedCfg[key]; !ok {
+			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
+		}
+		if val, ok = valInterface.(string); !ok {
+			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
+		}
+		repoSpecificMap[key] = val
+	}
+	return repoSpecificMap, nil
+}
+
+// getAdvancedConfig gets the Advanced field in a repo config and converts it to
+// a map[string]any. In every step, it checks for error and generates
+// nice messages.
+func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
+	advancedCfgInterface, ok := cfg.Advanced[repo]
+	if !ok {
+		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
+	}
+	advancedCfg, ok := advancedCfgInterface.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
+	}
+	return advancedCfg, nil
+}
diff --git a/discovery/config/util_test.go b/discovery/config/util_test.go
new file mode 100644
index 0000000..743c785
--- /dev/null
+++ b/discovery/config/util_test.go
@@ -0,0 +1,178 @@
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUtil(t *testing.T) {
+	for scenario, fn := range map[string]func(
+		t *testing.T,
+	){
+		"build connection string succeeds":                            testBuildConnOptionsSucc,
+		"build connection string fails":                               testBuildConnOptionsFail,
+		"build map from correct connection options succeeds":          testMapConnOptionsSucc,
+		"build map from missing connection options does not err":      testMapConnOptionsMissing,
+		"build map from non-list connection options fails":            testMapConnOptionsMalformedMap,
+		"build map from malformed (non-'=') connection options fails": testMapConnOptionsMalformedColon,
+		"fetch correct advanced config succeeds":                      testAdvancedConfigSucc,
+		"fetch advanced config with missing parameter errs":           testAdvancedConfigMissing,
+		"fetch advanced config with malformed parameters errs":        testAdvancedConfigMalformed,
+	} {
+		t.Run(
+			scenario, func(t *testing.T) {
+				teardown := setupTest(t)
+				defer teardown()
+				fn(t)
+			},
+		)
+	}
+}
+
+func setupTest(t *testing.T) func() {
+	return func() {}
+}
+
+// Returns a correct repo config
+func getSampleRepoConfig() RepoConfig {
+	return RepoConfig{
+		Advanced: map[string]any{
+			configConnOpts: []any{"sslmode=disable"},
+		},
+	}
+}
+
+func testBuildConnOptionsSucc(t *testing.T) {
+	sampleRepoCfg := getSampleRepoConfig()
+	connOptsStr, err := BuildConnOptsStr(sampleRepoCfg)
+	require.NoError(t, err)
+	require.Equal(t, connOptsStr, "?sslmode=disable")
+}
+
+func testBuildConnOptionsFail(t *testing.T) {
+	invalidRepoCfg := RepoConfig{
+		Advanced: map[string]any{
+			// Invalid: map instead of string
+			configConnOpts: []any{
+				map[string]string{"sslmode": "disable"},
+			},
+		},
+	}
+	connOptsStr, err := BuildConnOptsStr(invalidRepoCfg)
+	require.Error(t, err)
+	require.Empty(t, connOptsStr)
+}
+
+func testMapConnOptionsSucc(t *testing.T) {
+	sampleRepoCfg := getSampleRepoConfig()
+	connOptsMap, err := MapFromConnOpts(sampleRepoCfg)
+	require.NoError(t, err)
+	require.EqualValues(
+		t, connOptsMap, map[string]string{
+			"sslmode": "disable",
+		},
+	)
+}
+
+// The mapping should only fail if the config is malformed, not if it is missing
+func testMapConnOptionsMissing(t *testing.T) {
+	sampleCfg := RepoConfig{}
+	optsMap, err := MapFromConnOpts(sampleCfg)
+	require.NoError(t, err)
+	require.Empty(t, optsMap)
+}
+
+func testMapConnOptionsMalformedMap(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			// Let's put a map instead of the required list
+			configConnOpts: map[string]any{
+				"testKey": "testValue",
+			},
+		},
+	}
+	_, err := MapFromConnOpts(sampleCfg)
+	require.Error(t, err)
+}
+
+func testMapConnOptionsMalformedColon(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			// Let's use a colon instead of '=' to divide options
+			configConnOpts: []string{"sslmode:disable"},
+		},
+	}
+	_, err := MapFromConnOpts(sampleCfg)
+	require.Error(t, err)
+}
+
+func testAdvancedConfigSucc(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				"account":   "exampleAccount",
+				"role":      "exampleRole",
+				"warehouse": "exampleWarehouse",
+			},
+		},
+	}
+	repoSpecificMap, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.NoError(t, err)
+	require.EqualValues(
+		t, repoSpecificMap, map[string]string{
+			"account":   "exampleAccount",
+			"role":      "exampleRole",
+			"warehouse": "exampleWarehouse",
+		},
+	)
+}
+
+func testAdvancedConfigMissing(t *testing.T) {
+	// Without the snowflake config at all
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{},
+	}
+	_, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+
+	sampleCfg = RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				// Missing account
+
+				"role":      "exampleRole",
+				"warehouse": "exampleWarehouse",
+			},
+		},
+	}
+	_, err = FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+}
+
+func testAdvancedConfigMalformed(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				// Let's give a _list_ of things
+				"account":   []string{"account1", "account2"},
+				"role":      []string{"role1", "role2"},
+				"warehouse": []string{"warehouse1", "warehouse2"},
+			},
+		},
+	}
+	_, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+}
diff --git a/discovery/repository/denodo/denodo.go b/discovery/repository/denodo/denodo.go
new file mode 100644
index 0000000..38ef30c
--- /dev/null
+++ b/discovery/repository/denodo/denodo.go
@@ -0,0 +1,114 @@
+package denodo
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+	"github.com/cyralinc/dmap/discovery/repository/postgresql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Use PostgreSQL driver for Denodo
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypeDenodo = "denodo"
+
+	// IntrospectQuery is the SQL query used to introspect the database. For
+	// Denodo, the object hierarchy is (database > views). When querying
+	// Denodo, the database corresponds to a schema, and the view corresponds
+	// to a table (see SampleTable).
+	IntrospectQuery = "SELECT " +
+		"database_name AS table_schema, " +
+		"view_name AS table_name, " +
+		"column_name, " +
+		"column_type_name AS data_type " +
+		"FROM " +
+		"CATALOG_VDP_METADATA_VIEWS()"
+)
+
+type denodoRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *denodoRepository implements repository.Repository
+var _ repository.Repository = (*denodoRepository)(nil)
+
+func NewDenodoRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	pgCfg, err := postgresql.ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
+	}
+	if repoCfg.Database == "" {
+		return nil, errors.New("database name is mandatory for Denodo repositories")
+	}
+
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		repoCfg.User,
+		repoCfg.Password,
+		repoCfg.Host,
+		repoCfg.Port,
+		repoCfg.Database,
+		pgCfg.ConnOptsStr,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		postgresql.RepoTypePostgres,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &denodoRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *denodoRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented for Denodo repositories")
+}
+
+func (repo *denodoRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.IntrospectWithQuery(ctx, IntrospectQuery)
+}
+
+func (repo *denodoRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Denodo uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// The postgres driver is currently unable to properly send the
+	// parameters of a prepared statement to Denodo. Therefore, instead of
+	// building a prepared statement, we populate the query string before
+	// sending it to the driver.
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s OFFSET %d ROWS LIMIT %d",
+		attrStr, meta.Schema, meta.Name, params.Offset, params.SampleSize,
+	)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
+}
+
+func (repo *denodoRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *denodoRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeDenodo, NewDenodoRepository)
+}
diff --git a/discovery/repository/doc.go b/discovery/repository/doc.go
new file mode 100644
index 0000000..0b6a30b
--- /dev/null
+++ b/discovery/repository/doc.go
@@ -0,0 +1,15 @@
+// Package repository encapsulates the concept of a Dmap data repository, and
+// provides functionality to register multiple implementations of such
+// repositories. All supported repositories are represented as sub-packages of
+// the repository name, e.g. mysql, postgresql, etc.
+//
+// The key interface is Repository, which provides encapsulates functionality to
+// introspect and sample the underlying database it represents.
+//
+// Repository implementations should reside in their own sub-package of the
+// repository package. Each implementation should provide a constructor that
+// matches the signature of the RepoConstructor type, and pass it to Register
+// function as part of the repository package's init function. This will make
+// the repository implementation available to the NewRepository factory
+// function.
+package repository
diff --git a/discovery/repository/gen.go b/discovery/repository/gen.go
new file mode 100644
index 0000000..05ac883
--- /dev/null
+++ b/discovery/repository/gen.go
@@ -0,0 +1,5 @@
+package repository
+
+// Mock generation - see https://vektra.github.io/mockery/
+
+//go:generate mockery --inpackage --with-expecter --name=Repository --filename=mock_repository.go
diff --git a/discovery/repository/genericsql/genericsql.go b/discovery/repository/genericsql/genericsql.go
new file mode 100644
index 0000000..667f1cd
--- /dev/null
+++ b/discovery/repository/genericsql/genericsql.go
@@ -0,0 +1,303 @@
+// Package genericsql provides a generic implementation of SQL functionalities
+// that works for a subset of ANSI SQL compatible databases. Many
+// repository.Repository implementations may partially or fully delegate to this
+// implementation. In that respect, it acts somewhat as a base implementation
+// which can be used by SQL-compatible repositories.
+package genericsql
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+
+	"github.com/gobwas/glob"
+)
+
+const (
+	IntrospectQuery = "SELECT " +
+		"table_schema, " +
+		"table_name, " +
+		"column_name, " +
+		"data_type " +
+		"FROM " +
+		"information_schema.columns " +
+		"WHERE " +
+		"table_schema NOT IN " +
+		"(" +
+		"'INFORMATION_SCHEMA', " +
+		"'information_schema', " +
+		"'mysql', " +
+		"'sys', " +
+		"'performance_schema', " +
+		"'pg_catalog'" +
+		")"
+	PingQuery           = "SELECT 1"
+	SampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
+)
+
+// GenericSqlRepository implements generic SQL functionalities that
+// works for a subset of ANSI SQL compatible databases and may be
+// useful for some repository.Repository implementations.
+type GenericSqlRepository struct {
+	repoName     string
+	repoType     string
+	database     string
+	db           *sql.DB
+	includePaths []glob.Glob
+	excludePaths []glob.Glob
+}
+
+// NewGenericSqlRepository is a constructor for the GenericSqlRepository type.
+// It establishes a database connection for a given repoType and returns a
+// pointer to a GenericSqlRepository instance.
+func NewGenericSqlRepository(
+	repoName, repoType, database, connStr string, maxOpenConns uint,
+	repoIncludePaths, repoExcludePaths []glob.Glob,
+) (
+	*GenericSqlRepository,
+	error,
+) {
+	db, err := getDbHandle(repoType, connStr, maxOpenConns)
+	if err != nil {
+		return nil, fmt.Errorf("error retrieving DB handle for repo type %s: %w", repoType, err)
+	}
+	return &GenericSqlRepository{
+		repoName:     repoName,
+		repoType:     repoType,
+		database:     database,
+		db:           db,
+		includePaths: repoIncludePaths,
+		excludePaths: repoExcludePaths,
+	}, nil
+}
+
+// NewGenericSqlRepositoryFromDB instantiate a new *GenericSqlRepository based
+// on a given db connection. This can be used by tests to mock the database.
+func NewGenericSqlRepositoryFromDB(
+	repoName, repoType, database string,
+	db *sql.DB,
+) *GenericSqlRepository {
+	return &GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+	}
+}
+
+// ListDatabasesWithQuery returns a list of the names of all databases on the
+// server, as determined by the given query. The query is expected to return
+// a row set containing a single column corresponding to the database name. If
+// the query returns more than one column, an error will be returned.
+func (repo *GenericSqlRepository) ListDatabasesWithQuery(
+	ctx context.Context,
+	query string,
+	params ...any,
+) ([]string, error) {
+	log.Tracef("Query: %s", query)
+	rows, err := repo.db.QueryContext(ctx, query, params...)
+	if err != nil {
+		return nil, fmt.Errorf("error querying databases: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	var dbs []string
+	for rows.Next() {
+		var dbName string
+		if err := rows.Scan(&dbName); err != nil {
+			return nil, fmt.Errorf("error scanning database query result row: %w", err)
+		}
+		dbs = append(dbs, dbName)
+	}
+	// Something broke while iterating the row set
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("error iterating database query rows: %w", err)
+	}
+	return dbs, nil
+}
+
+// Introspect calls IntrospectWithQuery with a default query string
+func (repo *GenericSqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.IntrospectWithQuery(ctx, IntrospectQuery)
+}
+
+/*
+IntrospectWithQuery executes a query against the information_schema table in the
+database which returns a four-column (all varchar) row set (of N rows, depending
+on the number of tables in the database) in the form:
+
+table_schema, table_name, column_name, data_type
+
+This row set represents all the columns of all the tables in the repository.
+The row set is then parsed into an instance of repository.Metadata and
+returned. Additionally, any errors which occur during the query execution or
+parsing process will be returned.
+*/
+func (repo *GenericSqlRepository) IntrospectWithQuery(
+	ctx context.Context,
+	query string,
+) (*repository.Metadata, error) {
+	log.Tracef("Query: %s", query)
+	rows, err := repo.db.QueryContext(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+
+	repoMeta, err := newMetadataFromQueryResult(
+		repo.repoType, repo.repoName,
+		repo.database, repo.includePaths, repo.excludePaths, rows,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return repoMeta, nil
+}
+
+func (repo *GenericSqlRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// ANSI SQL uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return repo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+// SampleTableWithQuery calls SampleTable with a custom SQL query. Any
+// placeholder parameters in the query should be passed via params.
+func (repo *GenericSqlRepository) SampleTableWithQuery(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	query string,
+	params ...any,
+) (repository.Sample, error) {
+	log.Tracef("Query: %s", query)
+	rows, err := repo.db.QueryContext(ctx, query, params...)
+	if err != nil {
+		return repository.Sample{},
+			fmt.Errorf("error sampling %s.%s.%s: %w", repo.database, meta.Schema, meta.Name, err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repo.repoName,
+			Database: repo.database,
+			Schema:   meta.Schema,
+			Table:    meta.Name,
+		},
+	}
+
+	for rows.Next() {
+		data, err := GetCurrentRowAsMap(rows)
+		if err != nil {
+			return repository.Sample{}, err
+		}
+		sample.Results = append(sample.Results, data)
+	}
+
+	// Something broke while iterating the row set
+	err = rows.Err()
+	if err != nil {
+		return repository.Sample{}, fmt.Errorf("error iterating sample data row set: %w", err)
+	}
+
+	return sample, nil
+}
+
+func (repo *GenericSqlRepository) Ping(ctx context.Context) error {
+	log.Tracef("Query: %s", PingQuery)
+	rows, err := repo.db.QueryContext(ctx, PingQuery)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = rows.Close() }()
+	return nil
+}
+
+// GetDb is a getter for the repository's sql.DB handle.
+func (repo *GenericSqlRepository) GetDb() *sql.DB {
+	return repo.db
+}
+
+func (repo *GenericSqlRepository) Close() error {
+	return repo.db.Close()
+}
+
+func getDbHandle(repoType, connStr string, maxOpenConns uint) (*sql.DB, error) {
+	db, err := sql.Open(repoType, connStr)
+	if err != nil {
+		return nil, err
+	}
+	db.SetMaxOpenConns(int(maxOpenConns))
+	return db, nil
+}
+
+// newMetadataFromQueryResult builds the repository metadata from the results
+// of a query to the INFORMATION_SCHEMA columns view.
+func newMetadataFromQueryResult(
+	repoType, repoName, db string,
+	includePaths, excludePaths []glob.Glob, rows *sql.Rows,
+) (
+	*repository.Metadata,
+	error,
+) {
+	repo := repository.NewMetadata(repoType, repoName, db)
+
+	for rows.Next() {
+		var attr repository.AttributeMetadata
+		err := rows.Scan(&attr.Schema, &attr.Table, &attr.Name, &attr.DataType)
+		if err != nil {
+			return nil, err
+		}
+
+		// skip tables that match excludePaths or does not match includePaths
+		log.Tracef("checking if %s.%s.%s matches excludePaths %s\n", db, attr.Schema, attr.Table, excludePaths)
+		if matchPathPatterns(db, attr.Schema, attr.Table, excludePaths) {
+			continue
+		}
+		log.Tracef("checking if %s.%s.%s matches includePaths: %s\n", db, attr.Schema, attr.Table, includePaths)
+		if !matchPathPatterns(db, attr.Schema, attr.Table, includePaths) {
+			continue
+		}
+
+		// SchemaMetadata exists - add a table if necessary
+		if schema, ok := repo.Schemas[attr.Schema]; ok {
+			// TableMetadata exists - just append the attribute
+			if table, ok := schema.Tables[attr.Table]; ok {
+				table.Attributes = append(table.Attributes, &attr)
+			} else { // First time seeing this table
+				table := repository.NewTableMetadata(attr.Schema, attr.Table)
+				table.Attributes = append(table.Attributes, &attr)
+				schema.Tables[attr.Table] = table
+			}
+		} else { // SchemaMetadata doesn't exist - create it
+			table := repository.NewTableMetadata(attr.Schema, attr.Table)
+			table.Attributes = append(table.Attributes, &attr)
+			schema := repository.NewSchemaMetadata(attr.Schema)
+			schema.Tables[attr.Table] = table
+			repo.Schemas[attr.Schema] = schema
+		}
+	}
+
+	// Something broke while iterating the row set
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return repo, nil
+}
+
+func matchPathPatterns(database, schema, table string, patterns []glob.Glob) bool {
+	for _, pattern := range patterns {
+		if pattern.Match(fmt.Sprintf("%s.%s.%s", database, schema, table)) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/discovery/repository/genericsql/genericsql_test.go b/discovery/repository/genericsql/genericsql_test.go
new file mode 100644
index 0000000..0dd0219
--- /dev/null
+++ b/discovery/repository/genericsql/genericsql_test.go
@@ -0,0 +1,301 @@
+package genericsql
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/gobwas/glob"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+func Test_Introspect_IsSuccessful(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName:     repoName,
+		repoType:     repoType,
+		database:     database,
+		db:           db,
+		includePaths: []glob.Glob{glob.MustCompile("exampleDb.*")},
+	}
+
+	cols := []string{
+		"table_schema",
+		"table_name",
+		"column_name",
+		"data_type",
+	}
+
+	rows := sqlmock.NewRows(cols).
+		AddRow("schema1", "table1", "column1", "varchar").
+		AddRow("schema1", "table1", "column2", "decimal").
+		AddRow("schema1", "table2", "column1", "integer").
+		AddRow("schema2", "table1", "column1", "date")
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnRows(rows)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	expectedMetadata := repository.Metadata{
+		Name:     repoName,
+		RepoType: repoType,
+		Database: database,
+		Schemas: map[string]*repository.SchemaMetadata{
+			"schema1": {
+				Name: "schema1",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column2",
+								DataType: "decimal",
+							},
+						},
+					},
+					"table2": {
+						Schema: "schema1",
+						Name:   "table2",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table2",
+								Name:     "column1",
+								DataType: "integer",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "schema2",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema2",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "date",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	assert.NoError(t, err)
+	assert.EqualValues(t, &expectedMetadata, meta)
+}
+
+func Test_Introspect_QueryError(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+	}
+
+	expectedErr := errors.New("dummy error")
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnError(expectedErr)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	assert.Nil(t, meta)
+	assert.EqualError(t, err, expectedErr.Error())
+}
+
+func Test_Introspect_RowError(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+	}
+
+	cols := []string{
+		"table_schema",
+		"table_name",
+		"column_name",
+		"data_type",
+	}
+
+	expectedErr := errors.New("dummy error")
+
+	rows := sqlmock.NewRows(cols).
+		AddRow("schema1", "table1", "column1", "varchar").
+		RowError(0, errors.New("dummy error"))
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnRows(rows)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	assert.Nil(t, meta)
+	assert.EqualError(t, err, expectedErr.Error())
+}
+
+func Test_Introspect_Filtered(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+		includePaths: []glob.Glob{
+			glob.MustCompile("exampleDb.schema1.*"),
+			glob.MustCompile("exampleDb.*.table1"),
+		},
+		excludePaths: []glob.Glob{
+			glob.MustCompile("exampleDb.schema3.*"),
+		},
+	}
+
+	cols := []string{
+		"table_schema",
+		"table_name",
+		"column_name",
+		"data_type",
+	}
+
+	rows := sqlmock.NewRows(cols).
+		AddRow("schema1", "table1", "column1", "varchar").
+		AddRow("schema1", "table1", "column2", "decimal").
+		AddRow("schema1", "table2", "column1", "integer").
+		AddRow("schema2", "table1", "column1", "date").
+		AddRow("schema2", "table1", "column2", "decimal").
+		AddRow("schema2", "table2", "column1", "varchar").
+		AddRow("schema3", "table1", "column2", "decimal").
+		AddRow("schema3", "table2", "column1", "integer")
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnRows(rows)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	expectedMetadata := repository.Metadata{
+		Name:     repoName,
+		RepoType: repoType,
+		Database: database,
+		Schemas: map[string]*repository.SchemaMetadata{
+			"schema1": {
+				Name: "schema1",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column2",
+								DataType: "decimal",
+							},
+						},
+					},
+					"table2": {
+						Schema: "schema1",
+						Name:   "table2",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table2",
+								Name:     "column1",
+								DataType: "integer",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "schema2",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema2",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "date",
+							},
+							{
+								Schema:   "schema2",
+								Table:    "table1",
+								Name:     "column2",
+								DataType: "decimal",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	assert.NoError(t, err)
+	assert.EqualValues(t, &expectedMetadata, meta)
+}
diff --git a/discovery/repository/genericsql/util.go b/discovery/repository/genericsql/util.go
new file mode 100644
index 0000000..eac797e
--- /dev/null
+++ b/discovery/repository/genericsql/util.go
@@ -0,0 +1,35 @@
+package genericsql
+
+import (
+	"database/sql"
+)
+
+// GetCurrentRowAsMap transforms the current row referenced by a sql.Rows row
+// set into a map where the key is the column name and the value is the column
+// value. It is effectively an alternative to the sql.Rows.Scan method, where it
+// copies the value of the current row into a string/interface map. Note: just
+// like Scan, because this only operates on the current row pointed to by the
+// row set, this function does not iterate the row set forward. Therefore,
+// sql.Rows.Next must be called first to iterate the row set forward, and the
+// same error checking applies. The map returned represents the single,
+// current-most row pointed to by the row set iterator.
+func GetCurrentRowAsMap(rows *sql.Rows) (map[string]any, error) {
+	colNames, err := rows.Columns()
+	if err != nil {
+		return nil, err
+	}
+	row := make(map[string]any, len(colNames))
+	colValues := make([]any, len(colNames))
+	colValPointers := make([]any, len(colNames))
+	for i := range colValues {
+		colValPointers[i] = &colValues[i]
+	}
+	// Scans the row into the set of column-value pointers
+	if err := rows.Scan(colValPointers...); err != nil {
+		return nil, err
+	}
+	for i, colName := range colNames {
+		row[colName] = colValues[i]
+	}
+	return row, nil
+}
diff --git a/discovery/repository/metadata.go b/discovery/repository/metadata.go
new file mode 100644
index 0000000..87d783a
--- /dev/null
+++ b/discovery/repository/metadata.go
@@ -0,0 +1,81 @@
+package repository
+
+import (
+	"strings"
+)
+
+// Metadata represents the structure of a database repository catalog. The
+// traditional hierarchy is: Server (cluster) > Database > Schema (namespace) >
+// Table. Some database systems do not have the concept of a "database" (e.g.
+// MySQL). In those cases, the 'Database' field is expected to be an empty
+// string. See: https://stackoverflow.com/a/17943883
+type Metadata struct {
+	Name     string
+	RepoType string
+	Database string
+	Schemas  map[string]*SchemaMetadata
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type SchemaMetadata struct {
+	Name   string
+	Tables map[string]*TableMetadata
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type TableMetadata struct {
+	Schema     string
+	Name       string
+	Attributes []*AttributeMetadata
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func (t *TableMetadata) AttributeNames() []string {
+	attrNames := make([]string, 0, len(t.Attributes))
+	for _, attr := range t.Attributes {
+		attrNames = append(attrNames, attr.Name)
+	}
+	return attrNames
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func (t *TableMetadata) QuotedAttributeNamesString(quoteChar string) string {
+	sep := quoteChar + "," + quoteChar
+	commaSeparatedNames := strings.Join(t.AttributeNames(), sep)
+	return quoteChar + commaSeparatedNames + quoteChar
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type AttributeMetadata struct {
+	Schema   string `field:"table_schema"`
+	Table    string `field:"table_name"`
+	Name     string `field:"column_name"`
+	DataType string `field:"data_type"`
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewMetadata(repoType, repoName, database string) *Metadata {
+	return &Metadata{
+		Name:     repoName,
+		RepoType: repoType,
+		Database: database,
+		Schemas:  make(map[string]*SchemaMetadata),
+	}
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewSchemaMetadata(schemaName string) *SchemaMetadata {
+	return &SchemaMetadata{
+		Name:   schemaName,
+		Tables: make(map[string]*TableMetadata),
+	}
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewTableMetadata(schemaName, tableName string) *TableMetadata {
+	return &TableMetadata{
+		Schema:     schemaName,
+		Name:       tableName,
+		Attributes: []*AttributeMetadata{},
+	}
+}
diff --git a/discovery/repository/metadata_test.go b/discovery/repository/metadata_test.go
new file mode 100644
index 0000000..0bc011f
--- /dev/null
+++ b/discovery/repository/metadata_test.go
@@ -0,0 +1,71 @@
+package repository
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAttributeNames(t *testing.T) {
+	table := TableMetadata{
+		Schema: "schema",
+		Name:   "table",
+		Attributes: []*AttributeMetadata{
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name1",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name2",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name3",
+				DataType: "varchar",
+			},
+		},
+	}
+
+	names := []string{"name1", "name2", "name3"}
+
+	assert.ElementsMatch(t, table.AttributeNames(), names)
+}
+
+func TestQuotedAttributeNamesString(t *testing.T) {
+	table := TableMetadata{
+		Schema: "schema",
+		Name:   "table",
+		Attributes: []*AttributeMetadata{
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name1",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name2",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name3",
+				DataType: "varchar",
+			},
+		},
+	}
+
+	quoteChar := "`"
+	expected := "`name1`,`name2`,`name3`"
+	namesStr := table.QuotedAttributeNamesString(quoteChar)
+
+	assert.Equal(t, expected, namesStr)
+}
diff --git a/discovery/repository/mock_repository.go b/discovery/repository/mock_repository.go
new file mode 100644
index 0000000..976daca
--- /dev/null
+++ b/discovery/repository/mock_repository.go
@@ -0,0 +1,342 @@
+// Code generated by mockery v2.40.1. DO NOT EDIT.
+
+package repository
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockRepository is an autogenerated mock type for the Repository type
+type MockRepository struct {
+	mock.Mock
+}
+
+type MockRepository_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockRepository) EXPECT() *MockRepository_Expecter {
+	return &MockRepository_Expecter{mock: &_m.Mock}
+}
+
+// Close provides a mock function with given fields:
+func (_m *MockRepository) Close() error {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Close")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// MockRepository_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
+type MockRepository_Close_Call struct {
+	*mock.Call
+}
+
+// Close is a helper method to define mock.On call
+func (_e *MockRepository_Expecter) Close() *MockRepository_Close_Call {
+	return &MockRepository_Close_Call{Call: _e.mock.On("Close")}
+}
+
+func (_c *MockRepository_Close_Call) Run(run func()) *MockRepository_Close_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run()
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_Close_Call) Return(_a0 error) *MockRepository_Close_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockRepository_Close_Call) RunAndReturn(run func() error) *MockRepository_Close_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Introspect provides a mock function with given fields: ctx
+func (_m *MockRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Introspect")
+	}
+
+	var r0 *Metadata
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (*Metadata, error)); ok {
+		return rf(ctx)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) *Metadata); ok {
+		r0 = rf(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*Metadata)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(ctx)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockRepository_Introspect_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Introspect'
+type MockRepository_Introspect_Call struct {
+	*mock.Call
+}
+
+// Introspect is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRepository_Expecter) Introspect(ctx interface{}) *MockRepository_Introspect_Call {
+	return &MockRepository_Introspect_Call{Call: _e.mock.On("Introspect", ctx)}
+}
+
+func (_c *MockRepository_Introspect_Call) Run(run func(ctx context.Context)) *MockRepository_Introspect_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_Introspect_Call) Return(_a0 *Metadata, _a1 error) *MockRepository_Introspect_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockRepository_Introspect_Call) RunAndReturn(
+	run func(context.Context) (
+		*Metadata,
+		error,
+	),
+) *MockRepository_Introspect_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListDatabases provides a mock function with given fields: ctx
+func (_m *MockRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListDatabases")
+	}
+
+	var r0 []string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) ([]string, error)); ok {
+		return rf(ctx)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) []string); ok {
+		r0 = rf(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(ctx)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockRepository_ListDatabases_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListDatabases'
+type MockRepository_ListDatabases_Call struct {
+	*mock.Call
+}
+
+// ListDatabases is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRepository_Expecter) ListDatabases(ctx interface{}) *MockRepository_ListDatabases_Call {
+	return &MockRepository_ListDatabases_Call{Call: _e.mock.On("ListDatabases", ctx)}
+}
+
+func (_c *MockRepository_ListDatabases_Call) Run(run func(ctx context.Context)) *MockRepository_ListDatabases_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_ListDatabases_Call) Return(_a0 []string, _a1 error) *MockRepository_ListDatabases_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockRepository_ListDatabases_Call) RunAndReturn(
+	run func(context.Context) (
+		[]string,
+		error,
+	),
+) *MockRepository_ListDatabases_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Ping provides a mock function with given fields: ctx
+func (_m *MockRepository) Ping(ctx context.Context) error {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Ping")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context) error); ok {
+		r0 = rf(ctx)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// MockRepository_Ping_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Ping'
+type MockRepository_Ping_Call struct {
+	*mock.Call
+}
+
+// Ping is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRepository_Expecter) Ping(ctx interface{}) *MockRepository_Ping_Call {
+	return &MockRepository_Ping_Call{Call: _e.mock.On("Ping", ctx)}
+}
+
+func (_c *MockRepository_Ping_Call) Run(run func(ctx context.Context)) *MockRepository_Ping_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_Ping_Call) Return(_a0 error) *MockRepository_Ping_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockRepository_Ping_Call) RunAndReturn(run func(context.Context) error) *MockRepository_Ping_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SampleTable provides a mock function with given fields: ctx, meta, params
+func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (
+	Sample,
+	error,
+) {
+	ret := _m.Called(ctx, meta, params)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SampleTable")
+	}
+
+	var r0 Sample
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *TableMetadata, SampleParameters) (Sample, error)); ok {
+		return rf(ctx, meta, params)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *TableMetadata, SampleParameters) Sample); ok {
+		r0 = rf(ctx, meta, params)
+	} else {
+		r0 = ret.Get(0).(Sample)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *TableMetadata, SampleParameters) error); ok {
+		r1 = rf(ctx, meta, params)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockRepository_SampleTable_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SampleTable'
+type MockRepository_SampleTable_Call struct {
+	*mock.Call
+}
+
+// SampleTable is a helper method to define mock.On call
+//   - ctx context.Context
+//   - meta *TableMetadata
+//   - params SampleParameters
+func (_e *MockRepository_Expecter) SampleTable(
+	ctx interface{},
+	meta interface{},
+	params interface{},
+) *MockRepository_SampleTable_Call {
+	return &MockRepository_SampleTable_Call{Call: _e.mock.On("SampleTable", ctx, meta, params)}
+}
+
+func (_c *MockRepository_SampleTable_Call) Run(
+	run func(
+		ctx context.Context,
+		meta *TableMetadata,
+		params SampleParameters,
+	),
+) *MockRepository_SampleTable_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_SampleTable_Call) Return(_a0 Sample, _a1 error) *MockRepository_SampleTable_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockRepository_SampleTable_Call) RunAndReturn(
+	run func(
+		context.Context,
+		*TableMetadata,
+		SampleParameters,
+	) (Sample, error),
+) *MockRepository_SampleTable_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockRepository creates a new instance of MockRepository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockRepository(
+	t interface {
+		mock.TestingT
+		Cleanup(func())
+	},
+) *MockRepository {
+	mock := &MockRepository{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/discovery/repository/mysql/mysql.go b/discovery/repository/mysql/mysql.go
new file mode 100644
index 0000000..154217c
--- /dev/null
+++ b/discovery/repository/mysql/mysql.go
@@ -0,0 +1,97 @@
+package mysql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// MySQL DB driver
+	_ "github.com/go-sql-driver/mysql"
+)
+
+const (
+	RepoTypeMysql = "mysql"
+	DatabaseQuery = `
+SELECT 
+    schema_name
+FROM 
+    information_schema.schemata
+WHERE
+    schema_name <> 'information_schema'
+    AND schema_name <> 'performance_schema'
+    AND schema_name <> 'sys'
+`
+)
+
+type mySqlRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *mySqlRepository implements repository.Repository
+var _ repository.Repository = (*mySqlRepository)(nil)
+
+func NewMySQLRepository(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+	connStr := fmt.Sprintf(
+		"%s:%s@tcp(%s:%d)/%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		// This can be an empty string. See:
+		// https://github.com/go-sql-driver/mysql#dsn-data-source-name
+		cfg.Database,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		cfg.Host,
+		RepoTypeMysql,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &mySqlRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *mySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *mySqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *mySqlRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// MySQL uses backticks to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("`")
+	// The generic select/limit/offset query and ? placeholders work fine with MySQL
+	query := fmt.Sprintf(genericsql.SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+func (repo *mySqlRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *mySqlRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeMysql, NewMySQLRepository)
+}
diff --git a/discovery/repository/mysql/mysql_test.go b/discovery/repository/mysql/mysql_test.go
new file mode 100644
index 0000000..1a1936a
--- /dev/null
+++ b/discovery/repository/mysql/mysql_test.go
@@ -0,0 +1,31 @@
+package mysql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *mySqlRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &mySqlRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
+	}
+}
diff --git a/discovery/repository/oracle/config.go b/discovery/repository/oracle/config.go
new file mode 100644
index 0000000..d47839c
--- /dev/null
+++ b/discovery/repository/oracle/config.go
@@ -0,0 +1,27 @@
+package oracle
+
+import (
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+const (
+	configServiceName = "service-name"
+)
+
+type Config struct {
+	ServiceName string
+}
+
+func ParseConfig(cfg config.RepoConfig) (*Config, error) {
+	oracleCfg, err := config.FetchAdvancedConfigString(
+		cfg,
+		RepoTypeOracle,
+		[]string{configServiceName},
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &Config{
+		ServiceName: oracleCfg[configServiceName],
+	}, nil
+}
diff --git a/discovery/repository/oracle/oracle.go b/discovery/repository/oracle/oracle.go
new file mode 100644
index 0000000..9e3044c
--- /dev/null
+++ b/discovery/repository/oracle/oracle.go
@@ -0,0 +1,125 @@
+package oracle
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Oracle DB driver
+	_ "github.com/sijms/go-ora/v2"
+)
+
+const (
+	RepoTypeOracle  = "oracle"
+	introspectQuery = `
+WITH users AS (
+  SELECT
+    username
+  FROM
+    sys.all_users
+  WHERE
+    oracle_maintained = 'N' AND
+    username <> 'RDSADMIN'
+)
+SELECT
+  owner AS table_schema,
+  table_name,
+  column_name,
+  data_type
+FROM
+  sys.all_tab_columns
+INNER JOIN
+  users
+ON
+  owner = users.username
+`
+)
+
+type oracleRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *oracleRepository implements repository.Repository
+var _ repository.Repository = (*oracleRepository)(nil)
+
+func NewOracleRepository(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+	oracleCfg, err := ParseConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
+	}
+
+	connStr := fmt.Sprintf(
+		`oracle://%s:%s@%s:%d/%s`,
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		oracleCfg.ServiceName,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		cfg.Host,
+		RepoTypeOracle,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &oracleRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// ListDatabases is left unimplemented for Oracle, because Oracle doesn't have
+// the traditional concept of "databases". Note that Introspect already
+// identifies all the accessible objects on the server.
+func (repo *oracleRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented for Oracle repos")
+}
+
+func (repo *oracleRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.IntrospectWithQuery(ctx, introspectQuery)
+}
+
+func (repo *oracleRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Oracle uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Oracle uses :x for placeholders
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s OFFSET :1 ROWS FETCH NEXT :2 ROWS ONLY",
+		attrStr, meta.Schema, meta.Name,
+	)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.Offset, params.SampleSize)
+}
+
+// Ping verifies the connection to Oracle database used by this Repository.
+// Normally we would just delegate to the Ping method implemented by
+// genericsql.GenericSqlRepository. However, that implementation executes a
+// 'SELECT 1' query to test for connectivity, and Oracle being Oracle, does not
+// like this. So instead, we defer to the native Ping method implemented by the
+// Oracle sql.DB driver.
+func (repo *oracleRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.GetDb().PingContext(ctx)
+}
+
+func (repo *oracleRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeOracle, NewOracleRepository)
+}
diff --git a/discovery/repository/oracle/oracle_test.go b/discovery/repository/oracle/oracle_test.go
new file mode 100644
index 0000000..aaba6a4
--- /dev/null
+++ b/discovery/repository/oracle/oracle_test.go
@@ -0,0 +1,86 @@
+package oracle
+
+import (
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+// Query Alias
+const (
+	usernameAlias         = "USERNAME"
+	oracleMaintainedAlias = "ORACLE_MAINTAINED"
+	statusAlias           = "ACCOUNT_STATUS"
+	createdAtAlias        = "CREATED_AT"
+	lastUsedAtAlias       = "LAST_USED_AT"
+	roleAlias             = "ROLE"
+	isPredefinedAlias     = "IS_PREDEFINED"
+)
+
+type OracleTestSuite struct {
+	suite.Suite
+	repo                              oracleRepository
+	mock                              sqlmock.Sqlmock
+	databaseUserQuery                 string
+	databaseRolesForUserQueryTemplate string
+}
+
+func TestOracle(t *testing.T) {
+	s := new(OracleTestSuite)
+	suite.Run(t, s)
+}
+
+func (s *OracleTestSuite) SetupSuite() {
+	s.databaseUserQuery = `
+	SELECT 
+		users.username AS ` + usernameAlias + `,
+		users.oracle_maintained AS ` + oracleMaintainedAlias + `,
+		users.account_status AS ` + statusAlias + `,
+		users.created AS ` + createdAtAlias + `,
+		users.last_login AS ` + lastUsedAtAlias + `
+	FROM 
+		dba_users users
+	ORDER BY
+		users.username
+	ASC
+		`
+	s.databaseRolesForUserQueryTemplate = `
+	SELECT 
+		privs.granted_role AS ` + roleAlias + `,
+		roles.oracle_maintained AS ` + isPredefinedAlias + `
+	FROM 
+		dba_role_privs privs
+	LEFT JOIN
+		dba_roles roles
+	ON
+		privs.granted_role = roles.role
+	WHERE 
+		privs.grantee = '%s'
+	ORDER BY
+		privs.granted_role
+	ASC
+		`
+}
+
+func (s *OracleTestSuite) BeforeTest(suiteName, testName string) {
+	db, mock, err := sqlmock.New()
+	require.NoError(s.T(), err)
+
+	s.mock = mock
+	s.repo = oracleRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB(
+			"oracle-repo",
+			"oracle-driver",
+			"oracle-db",
+			db,
+		),
+	}
+}
+
+func (s *OracleTestSuite) TearDownTest() {
+	s.repo.genericSqlRepo.GetDb().Close()
+}
diff --git a/discovery/repository/postgresql/config.go b/discovery/repository/postgresql/config.go
new file mode 100644
index 0000000..100be9a
--- /dev/null
+++ b/discovery/repository/postgresql/config.go
@@ -0,0 +1,22 @@
+package postgresql
+
+import (
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+type Config struct {
+	ConnOptsStr string
+}
+
+// ParseConfig produces a config structure with PostgreSQL-specific parameters
+// found in the repo config.
+func ParseConfig(cfg config.RepoConfig) (*Config, error) {
+	connOptsStr, err := config.BuildConnOptsStr(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Config{
+		ConnOptsStr: connOptsStr,
+	}, nil
+}
diff --git a/discovery/repository/postgresql/postgresql.go b/discovery/repository/postgresql/postgresql.go
new file mode 100644
index 0000000..2477d73
--- /dev/null
+++ b/discovery/repository/postgresql/postgresql.go
@@ -0,0 +1,103 @@
+package postgresql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+	// Postgresql DB driver
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypePostgres = "postgres"
+
+	DatabaseQuery = `
+SELECT 
+	datname 
+FROM
+	pg_database
+WHERE
+	datistemplate = false
+	AND datallowconn = true
+	AND datname <> 'rdsadmin'
+`
+)
+
+type postgresqlRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *postgresqlRepository implements repository.Repository
+var _ repository.Repository = (*postgresqlRepository)(nil)
+
+func NewPostgresqlRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	pgCfg, err := ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgresql config: %w", err)
+	}
+	database := repoCfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "postgres"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		repoCfg.User,
+		repoCfg.Password,
+		repoCfg.Host,
+		repoCfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		RepoTypePostgres,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &postgresqlRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *postgresqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *postgresqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *postgresqlRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// PostgreSQL uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// PostgreSQL uses $x for placeholders
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+func (repo *postgresqlRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *postgresqlRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypePostgres, NewPostgresqlRepository)
+}
diff --git a/discovery/repository/postgresql/postgresql_test.go b/discovery/repository/postgresql/postgresql_test.go
new file mode 100644
index 0000000..dc568a8
--- /dev/null
+++ b/discovery/repository/postgresql/postgresql_test.go
@@ -0,0 +1,31 @@
+package postgresql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *postgresqlRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &postgresqlRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
+	}
+}
diff --git a/discovery/repository/redshift/redshift.go b/discovery/repository/redshift/redshift.go
new file mode 100644
index 0000000..d43b3a5
--- /dev/null
+++ b/discovery/repository/redshift/redshift.go
@@ -0,0 +1,94 @@
+package redshift
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+	"github.com/cyralinc/dmap/discovery/repository/postgresql"
+
+	// Use PostgreSQL DB driver for Redshift
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypeRedshift = "redshift"
+)
+
+type redshiftRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *redshiftRepository implements repository.Repository
+var _ repository.Repository = (*redshiftRepository)(nil)
+
+func NewRedshiftRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	pgCfg, err := postgresql.ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
+	}
+	database := repoCfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "dev"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		repoCfg.User,
+		repoCfg.Password,
+		repoCfg.Host,
+		repoCfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		postgresql.RepoTypePostgres,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &redshiftRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *redshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	// Redshift and Postgres use the same query to list the server databases.
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, postgresql.DatabaseQuery)
+}
+
+func (repo *redshiftRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *redshiftRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Redshift uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Redshift uses $x for placeholders
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+func (repo *redshiftRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *redshiftRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeRedshift, NewRedshiftRepository)
+}
diff --git a/discovery/repository/redshift/redshift_test.go b/discovery/repository/redshift/redshift_test.go
new file mode 100644
index 0000000..b768aa8
--- /dev/null
+++ b/discovery/repository/redshift/redshift_test.go
@@ -0,0 +1,32 @@
+package redshift
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+	"github.com/cyralinc/dmap/discovery/repository/postgresql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(postgresql.DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *redshiftRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &redshiftRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
+	}
+}
diff --git a/discovery/repository/repository.go b/discovery/repository/repository.go
new file mode 100644
index 0000000..1a0bbfd
--- /dev/null
+++ b/discovery/repository/repository.go
@@ -0,0 +1,237 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/hashicorp/go-multierror"
+	"golang.org/x/sync/semaphore"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+// Repository represents a Dmap data repository, and provides functionality to
+// introspect its corresponding schema.
+type Repository interface {
+	// ListDatabases returns a list of the names of all databases on the server.
+	ListDatabases(ctx context.Context) ([]string, error)
+
+	// Introspect will read and analyze the basic properties of the repository
+	// and return as a Metadata instance. This includes all the repository's
+	// databases, schemas, tables, columns, and attributes.
+	Introspect(ctx context.Context) (*Metadata, error)
+
+	// SampleTable samples the table referenced by the TableMetadata meta
+	// parameter and returns the sample as a slice of Sample. The parameters for
+	// the sample, such as sample size, are passed via the params parameter (see
+	// SampleParameters for more details). The returned sample result set
+	// contains one Sample for each table row sampled. The length of the results
+	// will be less than or equal to the sample size. If there are fewer results
+	// than the specified sample size, it is because the table in question had a
+	// row count less than the sample size. Prefer small sample sizes to limit
+	// impact on the database.
+	SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error)
+
+	// Ping is meant to be used as a general purpose connectivity test. It
+	// should be invoked e.g. in the dry-run mode.
+	Ping(ctx context.Context) error
+
+	// Close is meant to be used as a general purpose cleanup. It should be
+	// invoked when the Repository is no longer used.
+	Close() error
+}
+
+// RepoConstructor represents the function signature that all repository
+// implementations should use for their constructor functions.
+type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repository, error)
+
+var registry = make(map[string]RepoConstructor)
+
+// Register makes a repository available by the provided repository type (repoType).
+// If Register is called twice with the same repoType, or if constructor is nil, it
+// panics. Note that Register is not thread-safe. It is expected to be called from
+// either a package's init function, or from the program's main function.
+func Register(repoType string, constructor RepoConstructor) {
+	if constructor == nil {
+		panic("attempt to register nil constructor for repoType " + repoType)
+	}
+
+	if _, dup := registry[repoType]; dup {
+		panic("register called twice for repoType " + repoType)
+	}
+
+	registry[repoType] = constructor
+}
+
+// NewRepository is a factory function to return a concrete Repository implementation
+// based on the specified type, e.g. MySQL, PostgreSQL, MSSQL, etc.
+func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+	constructor, ok := registry[cfg.Type]
+	if !ok {
+		return nil, errors.New("unsupported repo type " + cfg.Type)
+	}
+
+	repo, err := constructor(ctx, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error creating repository, %w", err)
+	}
+
+	return repo, nil
+}
+
+// sampleAndErr is a "pair" type intended to be passed to a channel (see
+// SampleRepository)
+type sampleAndErr struct {
+	sample Sample
+	err    error
+}
+
+// samplesAndErr is a "pair" type intended to be passed to a channel (see
+// SampleAllDatabases)
+type samplesAndErr struct {
+	samples []Sample
+	err     error
+}
+
+// SampleRepository is a helper function which will sample every table in a
+// given repository and return them as a collection of Sample. First the
+// repository is introspected by calling Repository.Introspect to return the
+// repository metadata (Metadata). Then, for each schema and table in the
+// metadata, it calls Repository.SampleTable in a new goroutine. Once all the
+// sampling goroutines are finished, their results are collected and returned
+// as a slice of Sample.
+func SampleRepository(ctx context.Context, repo Repository, params SampleParameters) (
+	[]Sample,
+	error,
+) {
+	meta, err := repo.Introspect(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error introspecting repository: %w", err)
+	}
+
+	// Fan out sample executions
+	out := make(chan sampleAndErr)
+	numTables := 0
+	for _, schemaMeta := range meta.Schemas {
+		for _, tableMeta := range schemaMeta.Tables {
+			numTables++
+			go func(meta *TableMetadata, params SampleParameters) {
+				sample, err := repo.SampleTable(ctx, meta, params)
+				out <- sampleAndErr{sample: sample, err: err}
+			}(tableMeta, params)
+		}
+	}
+
+	var samples []Sample
+	var errs error
+	for i := 0; i < numTables; i++ {
+		res := <-out
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		} else {
+			samples = append(samples, res.sample)
+		}
+	}
+	close(out)
+
+	if errs != nil {
+		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
+	}
+
+	return samples, nil
+}
+
+// SampleAllDatabases uses the given repository to list all the databases on the
+// server, and samples each one in parallel by calling SampleRepository for each
+// database. The repository is intended to be configured to connect to the
+// default database on the server, or at least some database which can be used
+// to enumerate the full set of databases on the server. An error will be
+// returned if the set of databases cannot be listed. If there is an error
+// connecting to or sampling a database, the error will be logged and no samples
+// will be returned for that database. Therefore, the returned slice of samples
+// contains samples for only the databases which could be discovered and
+// successfully sampled, and could potentially be empty if no databases were
+// sampled.
+func SampleAllDatabases(
+	ctx context.Context,
+	repo Repository,
+	repoCfg config.RepoConfig,
+	sampleParams SampleParameters,
+) (
+	[]Sample,
+	error,
+) {
+	// We assume that this repository will be connected to the default database
+	// (or at least some database that can discover all the other databases),
+	// and we use that to discover all other databases.
+	dbs, err := repo.ListDatabases(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error listing databases: %w", err)
+	}
+
+	// Sample each database on a separate goroutine, and send the samples
+	// to the 'out' channel. Each slice of samples will be aggregated below
+	// on the main goroutine and returned.
+	var wg sync.WaitGroup
+	out := make(chan samplesAndErr)
+	wg.Add(len(dbs))
+	// Ensures that we avoid opening more than the specified number of
+	// connections.
+	var sema *semaphore.Weighted
+	if repoCfg.MaxOpenConns > 0 {
+		sema = semaphore.NewWeighted(int64(repoCfg.MaxOpenConns))
+	}
+	for _, db := range dbs {
+		go func(db string, cfg config.RepoConfig) {
+			defer wg.Done()
+			if sema != nil {
+				_ = sema.Acquire(ctx, 1)
+				defer sema.Release(1)
+			}
+			cfg.Database = db
+			// Create a repository instance for this database. It will be used
+			// to connect and sample the database.
+			repo, err := NewRepository(ctx, cfg)
+			if err != nil {
+				log.Errorf("error creating repository instance for database %s: %v", db, err)
+				return
+			}
+			// Close this repository and free up unused resources since we don't
+			// need it any longer.
+			defer func() { _ = repo.Close() }()
+			s, err := SampleRepository(ctx, repo, sampleParams)
+			if err != nil && len(s) == 0 {
+				log.Errorf("error gathering repository data samples for database %s: %v", db, err)
+				return
+			}
+			// Send the samples for this database to the 'out' channel. The
+			// samples for each database will be aggregated into a single slice
+			// on the main goroutine and returned.
+			out <- samplesAndErr{samples: s, err: err}
+		}(db, repoCfg)
+	}
+
+	// Start a goroutine to close the 'out' channel once all the goroutines
+	// we launched above are done. This will allow the aggregation range loop
+	// below to terminate properly. Note that this must start after the wg.Add
+	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
+	go func() {
+		wg.Wait()
+		close(out)
+	}()
+
+	// Aggregate and return the results.
+	var ret []Sample
+	var errs error
+	for res := range out {
+		ret = append(ret, res.samples...)
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		}
+	}
+	return ret, errs
+}
diff --git a/discovery/repository/repository_test.go b/discovery/repository/repository_test.go
new file mode 100644
index 0000000..4b25138
--- /dev/null
+++ b/discovery/repository/repository_test.go
@@ -0,0 +1,134 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+func TestRegister_Successful(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		return nil, nil
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestRegister_NilConstructor(t *testing.T) {
+	require.Empty(t, registry)
+	assert.Panics(t, func() { Register("repoType", nil) })
+	assert.Empty(t, registry)
+}
+
+func TestRegister_TwoCalls_Panics(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		return nil, nil
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	assert.Panics(t, func() { Register(repoType, constructor) })
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestNewRepository_IsSuccessful(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+
+	called := false
+	expectedRepo := dummyRepo{}
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		called = true
+		return expectedRepo, nil
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	cfg := config.RepoConfig{Type: repoType}
+	repo, err := NewRepository(context.Background(), cfg)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedRepo, repo)
+	assert.True(t, called, "Constructor was not called")
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestNewRepository_ConstructorError(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+
+	called := false
+	expectedErr := errors.New("dummy error")
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		called = true
+		return nil, expectedErr
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	cfg := config.RepoConfig{Type: repoType}
+	repo, err := NewRepository(context.Background(), cfg)
+	assert.ErrorIs(t, err, expectedErr)
+	assert.Nil(t, repo)
+	assert.True(t, called, "Constructor was not called")
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestNewRepository_UnsupportedRepoType(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+
+	cfg := config.RepoConfig{Type: repoType}
+	repo, err := NewRepository(context.Background(), cfg)
+	assert.Error(t, err)
+	assert.Nil(t, repo)
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+type dummyRepo struct{}
+
+func (d dummyRepo) SampleTable(context.Context, *TableMetadata, SampleParameters) (
+	Sample,
+	error,
+) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) ListDatabases(context.Context) ([]string, error) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Introspect(context.Context) (*Metadata, error) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Ping(context.Context) error {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Close() error {
+	panic("not implemented")
+}
diff --git a/discovery/repository/sample_all_databases_test.go b/discovery/repository/sample_all_databases_test.go
new file mode 100644
index 0000000..2dc6b56
--- /dev/null
+++ b/discovery/repository/sample_all_databases_test.go
@@ -0,0 +1,228 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+const mockRepoType = "mockRepo"
+
+func setup() *MockRepository {
+	repo := new(MockRepository)
+	Register(
+		mockRepoType,
+		func(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	return repo
+}
+
+func cleanup() {
+	delete(registry, mockRepoType)
+}
+
+func TestSampleAllDatabases_Error(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	listDbErr := errors.New("error listing databases")
+	repo.On("ListDatabases", ctx).Return(nil, listDbErr)
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.Nil(t, samples)
+	require.ErrorIs(t, err, listDbErr)
+}
+
+func TestSampleAllDatabases_Successful_TwoDatabases(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Name:     "test",
+		RepoType: mockRepoType,
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.On("Introspect", mock.Anything).Return(&meta, nil)
+	sample := Sample{
+		Metadata: SampleMetadata{
+			Repo:     "repo",
+			Database: "db",
+			Schema:   "schema",
+			Table:    "table",
+		},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(sample, nil)
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.NoError(t, err)
+	// Two databases should be sampled, and our mock will return the sample for
+	// each sample call. This really just asserts that we've sampled the correct
+	// number of times.
+	require.ElementsMatch(t, samples, []Sample{sample, sample})
+}
+
+func TestSampleAllDatabases_IntrospectError(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	introspectErr := errors.New("introspect error")
+	repo.On("Introspect", mock.Anything).Return(nil, introspectErr)
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.Empty(t, samples)
+	require.NoError(t, err)
+}
+
+func TestSampleAllDatabases_SampleError(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Name:     "test",
+		RepoType: mockRepoType,
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.On("Introspect", mock.Anything).Return(&meta, nil)
+	sampleErr := errors.New("sample error")
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(Sample{}, sampleErr)
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.NoError(t, err)
+	require.Empty(t, samples)
+}
+
+func TestSampleAllDatabases_TwoDatabases_OneSampleError(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Name:     "test",
+		RepoType: mockRepoType,
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.On("Introspect", mock.Anything).Return(&meta, nil)
+	sample := Sample{
+		Metadata: SampleMetadata{
+			Repo:     "repo",
+			Database: "db",
+			Schema:   "schema",
+			Table:    "table",
+		},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(sample, nil).Once()
+	sampleErr := errors.New("sample error")
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(Sample{}, sampleErr).Once()
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.NoError(t, err)
+	// Because of a single sample error, we expect only one database was
+	// sampled.
+	require.ElementsMatch(t, samples, []Sample{sample})
+}
diff --git a/discovery/repository/sample_repository_test.go b/discovery/repository/sample_repository_test.go
new file mode 100644
index 0000000..fde10fb
--- /dev/null
+++ b/discovery/repository/sample_repository_test.go
@@ -0,0 +1,181 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSampleRepository(t *testing.T) {
+	ctx := context.Background()
+	repo := fakeRepo{}
+	params := SampleParameters{SampleSize: 2}
+	samples, err := SampleRepository(ctx, repo, params)
+	require.NoError(t, err)
+
+	// Order is not important and is actually non-deterministic due to concurrency
+	assert.ElementsMatch(t, samples, []Sample{table1Sample, table2Sample})
+}
+
+func TestSampleRepository_PartialError(t *testing.T) {
+	ctx := context.Background()
+	repo := fakeRepo{includeForbiddenTables: true}
+	params := SampleParameters{SampleSize: 2}
+	samples, err := SampleRepository(ctx, repo, params)
+	require.ErrorContains(t, err, "forbidden table")
+
+	// Order is not important and is actually non-deterministic due to concurrency
+	assert.ElementsMatch(t, samples, []Sample{table1Sample, table2Sample})
+}
+
+var repoMeta = Metadata{
+	Name:     "name",
+	RepoType: "repoType",
+	Database: "database",
+	Schemas: map[string]*SchemaMetadata{
+		"schema1": {
+			Name: "",
+			Tables: map[string]*TableMetadata{
+				"table1": {
+					Schema: "schema1",
+					Name:   "table1",
+					Attributes: []*AttributeMetadata{
+						{
+							Schema:   "schema1",
+							Table:    "table1",
+							Name:     "name1",
+							DataType: "varchar",
+						},
+						{
+							Schema:   "schema1",
+							Table:    "table1",
+							Name:     "name2",
+							DataType: "decimal",
+						},
+					},
+				},
+			},
+		},
+		"schema2": {
+			Name: "",
+			Tables: map[string]*TableMetadata{
+				"table2": {
+					Schema: "schema2",
+					Name:   "table2",
+					Attributes: []*AttributeMetadata{
+						{
+							Schema:   "schema2",
+							Table:    "table2",
+							Name:     "name3",
+							DataType: "int",
+						},
+						{
+							Schema:   "schema2",
+							Table:    "table2",
+							Name:     "name4",
+							DataType: "timestamp",
+						},
+					},
+				},
+			},
+		},
+	},
+}
+
+var schema1ForbiddenTable = TableMetadata{
+	Schema: "schema1",
+	Name:   "forbidden",
+	Attributes: []*AttributeMetadata{
+		{
+			Schema:   "schema1",
+			Table:    "forbidden",
+			Name:     "name1",
+			DataType: "varchar",
+		},
+		{
+			Schema:   "schema1",
+			Table:    "forbidden",
+			Name:     "name2",
+			DataType: "decimal",
+		},
+	},
+}
+
+var table1Sample = Sample{
+	Metadata: SampleMetadata{
+		Repo:     "name",
+		Database: "database",
+		Schema:   "schema1",
+		Table:    "table1",
+	},
+	Results: []SampleResult{
+		{
+			"name1": "foo",
+			"name2": "bar",
+		},
+		{
+			"name1": "baz",
+			"name2": "qux",
+		},
+	},
+}
+
+var table2Sample = Sample{
+	Metadata: SampleMetadata{
+		Repo:     "name",
+		Database: "database",
+		Schema:   "schema2",
+		Table:    "table2",
+	},
+	Results: []SampleResult{
+		{
+			"name3": "foo1",
+			"name4": "bar1",
+		},
+		{
+			"name3": "baz1",
+			"name4": "qux1",
+		},
+	},
+}
+
+type fakeRepo struct {
+	includeForbiddenTables bool
+}
+
+func (f fakeRepo) Introspect(context.Context) (*Metadata, error) {
+	if f.includeForbiddenTables {
+		repoMeta.Schemas["schema1"].Tables["forbidden"] = &schema1ForbiddenTable
+	}
+	return &repoMeta, nil
+}
+
+func (f fakeRepo) SampleTable(_ context.Context, meta *TableMetadata, _ SampleParameters) (
+	Sample,
+	error,
+) {
+	if meta.Name == "table1" {
+		return table1Sample, nil
+	} else if meta.Name == "table2" {
+		return table2Sample, nil
+	} else if meta.Name == "forbidden" {
+		return Sample{}, errors.New("forbidden table")
+	} else {
+		return Sample{}, errors.New("unrecognized table")
+	}
+}
+
+func (f fakeRepo) ListDatabases(context.Context) ([]string, error) {
+	panic("not implemented")
+}
+
+func (f fakeRepo) Ping(context.Context) error {
+	panic("not implemented")
+}
+
+func (f fakeRepo) Close() error {
+	panic("not implemented")
+}
diff --git a/discovery/repository/sampling.go b/discovery/repository/sampling.go
new file mode 100644
index 0000000..07b84d3
--- /dev/null
+++ b/discovery/repository/sampling.go
@@ -0,0 +1,56 @@
+package repository
+
+import (
+	"fmt"
+)
+
+// SampleParameters contains all parameters necessary to sample a table.
+type SampleParameters struct {
+	SampleSize uint
+	Offset     uint
+}
+
+// Sample represents a sample of a database table. The Metadata field contains
+// metadata about the sample itself. The actual results of the sample, which
+// are  represented by a set of database rows, are contained in the Results
+// field.
+type Sample struct {
+	Metadata SampleMetadata
+	Results  []SampleResult
+}
+
+// SampleMetadata contains the metadata associated with a given sample, such as
+// repo name, database name, table, schema, and query (if applicable). This can
+// be used for diagnostic and informational purposes when analyzing a
+// particular sample.
+type SampleMetadata struct {
+	Repo     string
+	Database string
+	Schema   string
+	Table    string
+}
+
+// SampleResult stores the results from a single database sample. It is
+// equivalent to a database row, where the map key is the column name and the
+// map value is the column value.
+type SampleResult map[string]any
+
+// GetAttributeNamesAndValues splits a SampleResult map into two slices and
+// returns them. The first slice contains all the keys of SampleResult,
+// representing the table's attribute names, and the second slice is the map's
+// corresponding values.
+func (result SampleResult) GetAttributeNamesAndValues() ([]string, []string) {
+	names := make([]string, 0, len(result))
+	vals := make([]string, 0, len(result))
+	for name, val := range result {
+		names = append(names, name)
+		var v string
+		if b, ok := val.([]byte); ok {
+			v = string(b)
+		} else {
+			v = fmt.Sprint(val)
+		}
+		vals = append(vals, v)
+	}
+	return names, vals
+}
diff --git a/discovery/repository/sampling_test.go b/discovery/repository/sampling_test.go
new file mode 100644
index 0000000..1bbdfe7
--- /dev/null
+++ b/discovery/repository/sampling_test.go
@@ -0,0 +1,77 @@
+package repository
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSampleResult_GetAttributeNamesAndValues(t *testing.T) {
+	tests := []struct {
+		name                string
+		result              SampleResult
+		wantNames, wantVals []string
+	}{
+		{
+			name: "string",
+			result: SampleResult{
+				"foo": "fooVal",
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"fooVal"},
+		},
+		{
+			name: "int",
+			result: SampleResult{
+				"foo": 123,
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"123"},
+		},
+		{
+			name: "float",
+			result: SampleResult{
+				"foo": 12.3,
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"12.3"},
+		},
+		{
+			name: "bytes",
+			result: SampleResult{
+				"foo": []byte("fooVal"),
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"fooVal"},
+		},
+		{
+			name: "bool",
+			result: SampleResult{
+				"foo": false,
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"false"},
+		},
+		{
+			name: "varied types",
+			result: SampleResult{
+				"foo":  "fooVal",
+				"bar":  123,
+				"baz":  12.3,
+				"qux":  []byte("quxVal"),
+				"quxx": true,
+			},
+			wantNames: []string{"foo", "bar", "baz", "qux", "quxx"},
+			wantVals:  []string{"fooVal", "123", "12.3", "quxVal", "true"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				gotNames, gotVals := tt.result.GetAttributeNamesAndValues()
+				require.ElementsMatch(t, tt.wantNames, gotNames)
+				require.ElementsMatch(t, tt.wantVals, gotVals)
+			},
+		)
+	}
+}
diff --git a/discovery/repository/snowflake/config.go b/discovery/repository/snowflake/config.go
new file mode 100644
index 0000000..57f3e0a
--- /dev/null
+++ b/discovery/repository/snowflake/config.go
@@ -0,0 +1,36 @@
+package snowflake
+
+import (
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+const (
+	configAccount   = "account"
+	configRole      = "role"
+	configWarehouse = "warehouse"
+)
+
+type Config struct {
+	Account   string
+	Role      string
+	Warehouse string
+}
+
+// ParseConfig produces a config structure with Snowflake-specific parameters
+// found in the repo config.
+func ParseConfig(cfg config.RepoConfig) (*Config, error) {
+	snowflakeCfg, err := config.FetchAdvancedConfigString(
+		cfg,
+		RepoTypeSnowflake,
+		[]string{configAccount, configRole, configWarehouse},
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &Config{
+		Account:   snowflakeCfg[configAccount],
+		Role:      snowflakeCfg[configRole],
+		Warehouse: snowflakeCfg[configWarehouse],
+	}, nil
+
+}
diff --git a/discovery/repository/snowflake/snowflake.go b/discovery/repository/snowflake/snowflake.go
new file mode 100644
index 0000000..9dfa583
--- /dev/null
+++ b/discovery/repository/snowflake/snowflake.go
@@ -0,0 +1,100 @@
+package snowflake
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Snowflake DB driver
+	_ "github.com/snowflakedb/gosnowflake"
+)
+
+const (
+	RepoTypeSnowflake = "snowflake"
+
+	DatabaseQuery = `
+SELECT 
+    DATABASE_NAME 
+FROM 
+    INFORMATION_SCHEMA.DATABASES 
+WHERE 
+    IS_TRANSIENT = 'NO'
+`
+)
+
+type snowflakeRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *snowflakeRepository implements repository.Repository
+var _ repository.Repository = (*snowflakeRepository)(nil)
+
+func NewSnowflakeRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	snowflakeCfg, err := ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("error when parsing snowflake config: %w", err)
+	}
+	database := repoCfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "SNOWFLAKE"
+	}
+	connStr := fmt.Sprintf(
+		"%s:%s@%s/%s?role=%s&warehouse=%s",
+		repoCfg.User,
+		repoCfg.Password,
+		snowflakeCfg.Account,
+		repoCfg.Database,
+		snowflakeCfg.Role,
+		snowflakeCfg.Warehouse,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		RepoTypeSnowflake,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &snowflakeRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *snowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *snowflakeRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *snowflakeRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	return repo.genericSqlRepo.SampleTable(ctx, meta, params)
+}
+
+func (repo *snowflakeRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *snowflakeRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeSnowflake, NewSnowflakeRepository)
+}
diff --git a/discovery/repository/snowflake/snowflake_test.go b/discovery/repository/snowflake/snowflake_test.go
new file mode 100644
index 0000000..05fe358
--- /dev/null
+++ b/discovery/repository/snowflake/snowflake_test.go
@@ -0,0 +1,31 @@
+package snowflake
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *snowflakeRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &snowflakeRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
+	}
+}
diff --git a/discovery/repository/sqlserver/sqlserver.go b/discovery/repository/sqlserver/sqlserver.go
new file mode 100644
index 0000000..a77bf5c
--- /dev/null
+++ b/discovery/repository/sqlserver/sqlserver.go
@@ -0,0 +1,104 @@
+package sqlserver
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// SQL Server DB driver
+	_ "github.com/denisenkom/go-mssqldb"
+)
+
+const (
+	RepoTypeSqlServer = "sqlserver"
+
+	// SampleQueryTemplate is the string template for the SQL query used to
+	// sample a SQL Server database. SQL Server doesn't support limit/offset, so
+	// we use top. It also uses the @ symbol for statement parameter
+	// placeholders. It is intended to be templated by the database name to
+	// query.
+	SampleQueryTemplate = `SELECT TOP (@p1) %s FROM "%s"."%s"`
+
+	// DatabaseQuery is the query to list all the databases on the server, minus
+	// the system default databases 'model' and 'tempdb'.
+	DatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
+)
+
+type SqlServerRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *SqlServerRepository implements repository.Repository
+var _ repository.Repository = (*SqlServerRepository)(nil)
+
+func NewSqlServerRepository(_ context.Context, cfg config.RepoConfig) (*SqlServerRepository, error) {
+	connStr := fmt.Sprintf(
+		"sqlserver://%s:%s@%s:%d",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+	)
+
+	// The database name is optional for MS SQL Server.
+	if cfg.Database != "" {
+		connStr = fmt.Sprintf(connStr+"?database=%s", cfg.Database)
+	}
+
+	genericSqlRepo, err := genericsql.NewGenericSqlRepository(
+		cfg.Host,
+		RepoTypeSqlServer,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.IncludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &SqlServerRepository{genericSqlRepo: genericSqlRepo}, nil
+}
+
+func (repo *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *SqlServerRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *SqlServerRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Sqlserver uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
+}
+
+func (repo *SqlServerRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *SqlServerRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(
+		RepoTypeSqlServer,
+		func(ctx context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewSqlServerRepository(ctx, cfg)
+		},
+	)
+}
diff --git a/discovery/repository/sqlserver/sqlserver_test.go b/discovery/repository/sqlserver/sqlserver_test.go
new file mode 100644
index 0000000..f1b3f87
--- /dev/null
+++ b/discovery/repository/sqlserver/sqlserver_test.go
@@ -0,0 +1,31 @@
+package sqlserver
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SqlServerRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &SqlServerRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
+	}
+}
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
diff --git a/discovery/scanner.go b/discovery/scanner.go
new file mode 100644
index 0000000..09b3f02
--- /dev/null
+++ b/discovery/scanner.go
@@ -0,0 +1,161 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/classification/publisher"
+	"github.com/cyralinc/dmap/discovery/config"
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/oracle"
+
+	// Registers repo types for use via 'init' side effects
+	_ "github.com/cyralinc/dmap/discovery/repository/denodo"
+	_ "github.com/cyralinc/dmap/discovery/repository/mysql"
+	_ "github.com/cyralinc/dmap/discovery/repository/oracle"
+	_ "github.com/cyralinc/dmap/discovery/repository/postgresql"
+	_ "github.com/cyralinc/dmap/discovery/repository/redshift"
+	_ "github.com/cyralinc/dmap/discovery/repository/snowflake"
+	_ "github.com/cyralinc/dmap/discovery/repository/sqlserver"
+)
+
+// TODO: godoc -ccampo 2024-03-27
+type Scanner struct {
+	config      *config.Config
+	repository  repository.Repository
+	classifiers map[string]classification.Classifier
+	publisher   publisher.Publisher
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewScanner(config *config.Config) Scanner {
+	return Scanner{config: config}
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func (s *Scanner) Init(ctx context.Context) error {
+	if s.config == nil {
+		return errors.New("unable to start crawler: config not found")
+	}
+	// Note: order is important here because we don't have nil checks in these
+	// init methods.
+	s.initPublisher()
+
+	if err := s.initClassifiers(); err != nil {
+		return err
+	}
+	if err := s.initRepository(ctx); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (s *Scanner) InitAndRun(ctx context.Context) error {
+	if err := s.Init(ctx); err != nil {
+		return err
+	}
+	return s.Run(ctx)
+}
+
+func (s *Scanner) Run(ctx context.Context) error {
+	sampleParams := repository.SampleParameters{SampleSize: s.config.Repo.SampleSize}
+	var samples []repository.Sample
+	// The name of the database to connect to has been left unspecified by
+	// the user, so we try to connect and sample all databases instead. Note
+	// that Oracle doesn't really have the concept of "databases", and thus
+	// the Scanner always scans the entire database, so only the single
+	// (default) repository instance is required in that case.
+	if s.config.Repo.Database == "" && s.config.Repo.Type != oracle.RepoTypeOracle {
+		var err error
+		samples, err = repository.SampleAllDatabases(
+			ctx,
+			s.repository,
+			s.config.Repo,
+			sampleParams,
+		)
+		if err != nil {
+			err = fmt.Errorf("error sampling databases: %w", err)
+			// If we didn't get any samples, just return the error.
+			if len(samples) == 0 {
+				return err
+			}
+			// There were error(s) during sampling, but we still got some
+			// samples. Just warn and continue.
+			log.WithError(err).Warn("error sampling databases")
+		}
+	} else {
+		// User specified a database (or this is an Oracle DB), therefore
+		// we already have a repository instance for it. Just use it to
+		// sample that database only.
+		var err error
+		samples, err = repository.SampleRepository(ctx, s.repository, sampleParams)
+		if err != nil {
+			err = fmt.Errorf("error gathering repository data samples: %w", err)
+			// If we didn't get any samples, just return the error.
+			if len(samples) == 0 {
+				return err
+			}
+			// There were error(s) during sampling, but we still got some
+			// samples. Just warn and continue.
+			log.WithError(err).Warn("error gathering repository data samples")
+		}
+	}
+
+	// Classify sampled data
+	classifications, err := classification.AggregateClassifySamples(ctx, s.classifiers, samples)
+	if err != nil {
+		return fmt.Errorf("error classifying samples: %w", err)
+	}
+
+	// Publish classifications if necessary
+	if len(classifications) == 0 {
+		log.Info("No discovered classifications")
+	} else if err := s.publisher.PublishClassifications(ctx, s.config.Repo.Host, classifications); err != nil {
+		return fmt.Errorf("error publishing classifications: %w", err)
+	}
+
+	// Done!
+	return nil
+}
+
+func (s *Scanner) Cleanup() {
+	// Nil checks are prevent panics if deps are not yet initialized.
+	if s.repository != nil {
+		_ = s.repository.Close()
+	}
+}
+
+func (s *Scanner) initClassifiers() error {
+	lbls, err := classification.GetLabels()
+	if err != nil {
+		return fmt.Errorf("error getting labels: %w", err)
+	}
+	s.classifiers = make(map[string]classification.Classifier, len(lbls))
+	for _, lbl := range lbls {
+		classifier, err := classification.NewLabelClassifier(lbl)
+		if err != nil {
+			return fmt.Errorf("unable to initialize rego classifier for label %s: %w", lbl.Name, err)
+		}
+		s.classifiers[lbl.Name] = classifier
+	}
+	return nil
+}
+
+func (s *Scanner) initPublisher() {
+	// TODO: eventually this should chose between publishing to the api and a local file -ccampo 2024-03-14
+	s.publisher = publisher.NewStdOutPublisher()
+}
+
+func (s *Scanner) initRepository(ctx context.Context) error {
+	// Connect to database
+	repo, err := repository.NewRepository(ctx, s.config.Repo)
+	if err != nil {
+		return fmt.Errorf("error connecting to database: %w", err)
+	}
+	s.repository = repo
+	return nil
+}
diff --git a/go.mod b/go.mod
index 334e256..e7fae8e 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,8 @@ module github.com/cyralinc/dmap
 go 1.21
 
 require (
+	github.com/DATA-DOG/go-sqlmock v1.5.2
+	github.com/alecthomas/kong v0.9.0
 	github.com/aws/aws-sdk-go-v2 v1.26.0
 	github.com/aws/aws-sdk-go-v2/config v1.27.9
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.9
@@ -11,12 +13,34 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/redshift v1.43.4
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.53.0
 	github.com/aws/aws-sdk-go-v2/service/sts v1.28.5
+	github.com/denisenkom/go-mssqldb v0.12.3
+	github.com/go-sql-driver/mysql v1.8.1
+	github.com/gobwas/glob v0.2.3
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/lib/pq v1.10.9
+	github.com/open-policy-agent/opa v0.62.1
+	github.com/sijms/go-ora/v2 v2.8.10
+	github.com/sirupsen/logrus v1.9.3
+	github.com/snowflakedb/gosnowflake v1.8.0
 	github.com/stretchr/testify v1.9.0
+	golang.org/x/sync v0.6.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
+	github.com/99designs/keyring v1.2.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 // indirect
+	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
+	github.com/OneOfOne/xxhash v1.2.8 // indirect
+	github.com/agnivade/levenshtein v1.1.1 // indirect
+	github.com/apache/arrow/go/v14 v14.0.2 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
@@ -29,9 +53,57 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.20.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.3 // indirect
 	github.com/aws/smithy-go v1.20.1 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/danieljoos/wincred v1.2.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
+	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
+	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/google/flatbuffers v24.3.25+incompatible // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/klauspost/compress v1.17.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/mtibben/percent v0.2.1 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.19.0 // indirect
+	github.com/prometheus/client_model v0.6.0 // indirect
+	github.com/prometheus/common v0.51.1 // indirect
+	github.com/prometheus/procfs v0.13.0 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/yashtewari/glob-intersection v0.2.0 // indirect
+	github.com/zeebo/xxh3 v1.0.2 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.24.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	golang.org/x/crypto v0.21.0 // indirect
+	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect
+	golang.org/x/mod v0.16.0 // indirect
+	golang.org/x/net v0.22.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/tools v0.19.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index e12f641..e5cc87c 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,42 @@
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
+github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
+github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0 h1:n1DH8TPV4qqPTje2RcUBYwtrTWlabVp4n46+74X2pn4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0/go.mod h1:HDcZnuGbiyppErN6lB+idp4CKhjbc8gwjto6OPpyggM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 h1:sO0/P7g68FrryJzljemN+6GTssUXdANk6aJ7T1ZxnsQ=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1/go.mod h1:h8hyGFDsU5HMivxiS2iYFZsgDbU9OnnJ163x5UGVKYo=
+github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 h1:LqbJ/WzJUwBf8UiaSzgX7aMclParm9/5Vgp+TY51uBQ=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2/go.mod h1:yInRyqWXAuaPrgI7p70+lDDgh3mlBohis29jGMISnmc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0 h1:AifHbc4mg0x9zW52WOpKbsHaDKuRhlI7TVl47thgQ70=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0/go.mod h1:T5RfihdXtBDxt1Ch2wobif3TvzTdumDy29kahv6AV9A=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 h1:fXPMAmuh0gDuRDey0atC8cXBuKIlqCzCkL8sm1n9Ov0=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1/go.mod h1:SUZc9YRRHfx2+FAQKNDGrssXehqLpxmwRv2mC/5ntj4=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1 h1:DzHpqpoJVaCgOUdVHxE8QB52S6NiVdDQvGlny1qvPqA=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
+github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
+github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
+github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
+github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
+github.com/alecthomas/assert/v2 v2.6.0 h1:o3WJwILtexrEUk3cUVal3oiQY2tfgr/FHWiz/v2n4FU=
+github.com/alecthomas/assert/v2 v2.6.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/kong v0.9.0 h1:G5diXxc85KvoV2f0ZRVuMsi45IrBgx9zDNGNj165aPA=
+github.com/alecthomas/kong v0.9.0/go.mod h1:Y47y5gKfHp1hDc7CH7OeXgLIpp+Q2m1Ni0L5s3bI8Os=
+github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
+github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/apache/arrow/go/v14 v14.0.2 h1:N8OkaJEOfI3mEZt07BIkvo4sC6XDbL+48MBPWO5IONw=
+github.com/apache/arrow/go/v14 v14.0.2/go.mod h1:u3fgh3EdgN/YQ8cVQRguVW3R+seMybFg8QBQ5LU+eBY=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/aws/aws-sdk-go-v2 v1.26.0 h1:/Ce4OCiM3EkpW7Y+xUnfAFpchU78K7/Ug01sZni9PgA=
 github.com/aws/aws-sdk-go-v2 v1.26.0/go.mod h1:35hUlJVYd+M++iLI3ALmVwMOyRYMmRqUXpTtRGW+K9I=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 h1:gTK2uhtAPtFcdRRJilZPx8uJLL2J85xK11nKtWL0wfU=
@@ -8,6 +47,8 @@ github.com/aws/aws-sdk-go-v2/credentials v1.17.9 h1:N8s0/7yW+h8qR8WaRlPQeJ6czVMN
 github.com/aws/aws-sdk-go-v2/credentials v1.17.9/go.mod h1:446YhIdmSV0Jf/SLafGZalQo+xr2iw7/fzXGDPTU1yQ=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 h1:af5YzcLf80tv4Em4jWVD75lpnOHSBkPUZxZfGkrI3HI=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0/go.mod h1:nQ3how7DMnFMWiU1SpECohgC82fpn4cKZ875NDMmwtA=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.13 h1:F+PUZee9mlfpEJVZdgyewRumKekS9O3fftj8fEMt0rQ=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.13/go.mod h1:Rl7i2dEWGHGsBIJCpUxlRt7VwK/HyXxICxdvIRssQHE=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 h1:0ScVK/4qZ8CIW0k8jOeFVsyS/sAiXpYxRBLolMkuLQM=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4/go.mod h1:84KyjNZdHC6QZW08nfHI6yZgPd+qRgaWcYsyLUo3QY8=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 h1:sHmMWWX5E7guWEFQ9SVo6A3S4xpPrWnd77a6y4WM6PU=
@@ -42,22 +83,246 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.28.5 h1:J/PpTf/hllOjx8Xu9DMflff3Fajf
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.5/go.mod h1:0ih0Z83YDH/QeQ6Ori2yGE2XvWYv/Xm+cZc01LC6oK0=
 github.com/aws/smithy-go v1.20.1 h1:4SZlSlMr36UEqC7XOyRVb27XMeZubNcBNN+9IgEPIQw=
 github.com/aws/smithy-go v1.20.1/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/danieljoos/wincred v1.2.1 h1:dl9cBrupW8+r5250DYkYxocLeZ1Y4vB1kxgtjxw8GQs=
+github.com/danieljoos/wincred v1.2.1/go.mod h1:uGaFL9fDn3OLTvzCGulzE+SzjEe5NGlh5FdCcyfPwps=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denisenkom/go-mssqldb v0.12.3 h1:pBSGx9Tq67pBOTLmxNuirNTeB8Vjmf886Kx+8Y+8shw=
+github.com/denisenkom/go-mssqldb v0.12.3/go.mod h1:k0mtMFOnU+AihqFxPMiF05rtiDrorD1Vrm1KEz5hxDo=
+github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
+github.com/dgraph-io/badger/v3 v3.2103.5/go.mod h1:4MPiseMeDQ3FNCYwRbbcBOGJLf5jsE0PPFzRiKjtcdw=
+github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
+github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dvsekhvalnov/jose2go v1.6.0 h1:Y9gnSnP4qEI0+/uQkHvFXeD2PLPJeXEL+ySMEA2EjTY=
+github.com/dvsekhvalnov/jose2go v1.6.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/form3tech-oss/jwt-go v3.2.5+incompatible h1:/l4kBbb4/vGSsdtB5nUe8L7B9mImVMaBPw9L/0TBHU8=
+github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
+github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
+github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=
+github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
+github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
+github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
+github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/flatbuffers v24.3.25+incompatible h1:CX395cjN9Kke9mmalRoL3d81AtFUxJM+yDthflgJGkI=
+github.com/google/flatbuffers v24.3.25+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
+github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
+github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
+github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
+github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/open-policy-agent/opa v0.62.1 h1:UcxBQ0fe6NEjkYc775j4PWoUFFhx4f6yXKIKSTAuTVk=
+github.com/open-policy-agent/opa v0.62.1/go.mod h1:YqiSIIuvKwyomtnnXkJvy0E3KtVKbavjPJ/hNMuOmeM=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
+github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
+github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
+github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
+github.com/prometheus/common v0.51.1 h1:eIjN50Bwglz6a/c3hAgSMcofL3nD+nFQkV6Dd4DsQCw=
+github.com/prometheus/common v0.51.1/go.mod h1:lrWtQx+iDfn2mbH5GUzlH9TSHyfZpHkSiG1W7y3sF2Q=
+github.com/prometheus/procfs v0.13.0 h1:GqzLlQyfsPbaEHaQkO7tbDlriv/4o5Hudv6OXHGKX7o=
+github.com/prometheus/procfs v0.13.0/go.mod h1:cd4PFCR54QLnGKPaKGA6l+cfuNXtht43ZKY6tow0Y1g=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/sijms/go-ora/v2 v2.8.10 h1:Ekhx0I+A9qVBy1eOLa2eIhHWWYwVTa0MM78KS6h+5fg=
+github.com/sijms/go-ora/v2 v2.8.10/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/snowflakedb/gosnowflake v1.8.0 h1:4bQj8eAYGMkou/nICiIEb9jSbBLDDp5cB6JaKx9WwiA=
+github.com/snowflakedb/gosnowflake v1.8.0/go.mod h1:7yyY2MxtDti2eXgtvlZ8QxzCN6KV2B4qb1HuygMI+0U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
+github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
+github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
+go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
+go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
+go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
+go.opentelemetry.io/otel/sdk v1.24.0 h1:YMPPDNymmQN3ZgczicBY3B6sf9n62Dlj9pWD3ucgoDw=
+go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
+go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
+go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
+golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
+golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.19.0 h1:tfGCXNR1OsFG+sVdLAitlpjAvD/I6dHDKnYrpEZUHkw=
+golang.org/x/tools v0.19.0/go.mod h1:qoJWxmGSIBmAeriMx19ogtrEPrGtDbPK634QFIcLAhc=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+gonum.org/v1/gonum v0.12.0 h1:xKuo6hzt+gMav00meVPUlXwSdoEJP46BR+wdxQEFK2o=
+gonum.org/v1/gonum v0.12.0/go.mod h1:73TDxJfAAHeA8Mk9mf8NlIppyhQNo5GLTcYeqgo2lvY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80 h1:Lj5rbfG876hIAYFjqiJnPHfhXbv+nzTWfm04Fg/XSVU=
+google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 h1:AjyfHzEPEFp/NpvfN5g+KDla3EMojjhRVZc1i7cj+oM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
+google.golang.org/grpc v1.62.0 h1:HQKZ/fa1bXkX1oFOvSjmZEUL8wLSaZTjCcLAlmZRtdk=
+google.golang.org/grpc v1.62.0/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/scan/scanner.go b/scan/scanner.go
index 7391d04..95ce39e 100644
--- a/scan/scanner.go
+++ b/scan/scanner.go
@@ -7,7 +7,7 @@ import (
 )
 
 // Scanner is an interface that should be implemented for a specific cloud
-// provider (e.g. AWS, GCP, etc). It defines the Scan method responsible for
+// provider (e.g. AWS, GCP, etc.). It defines the Scan method responsible for
 // scanning the existing data repositories of the corresponding cloud provider
 // environment.
 type Scanner interface {
@@ -19,7 +19,6 @@ type Scanner interface {
 type RepoType string
 
 const (
-	// Repo types
 	RepoTypeRDS        RepoType = "TYPE_RDS"
 	RepoTypeRedshift   RepoType = "TYPE_REDSHIFT"
 	RepoTypeDynamoDB   RepoType = "TYPE_DYNAMODB"