Creating Sensitive Data Protection inspection templates

Console

In the Google Cloud console, go to the Create template page.

Go to Create template

The Create template page contains the following sections:

• Define template
• Configure detection

Define template

Under Define template, enter an identifier for the inspection template. This is how you'll refer to the template when you run a job, create a job trigger, and so on. You can use letters, numbers, and hyphens. If you want, you can also enter a more human-friendly display name, as well as a description to better remember what the template does.

In the Resource location field, select the region where the data to be inspected is stored. The inspection template you create is also stored in this region. If you want to be able to use the new inspection template in any region, select Global (any region).

Configure detection

Next, you configure what Sensitive Data Protection detects in your content by choosing an infoType and other options.

InfoType detectors find sensitive data of a certain type. For example, the Sensitive Data Protection US_SOCIAL_SECURITY_NUMBER infoType detector finds US Social Security numbers. In addition to the built-in infoType detectors, you can create your own custom infoType detectors.

In the InfoTypes section, choose the infoType detector that corresponds to a data type you want to scan for. We don't recommend leaving this section blank. Doing so causes Sensitive Data Protection to scan your data with a default set of infoTypes, which might include infoTypes that you don't need. More information about each detector is provided in InfoType detector reference.

For more information about how to manage built-in and custom infoTypes in this section, see Manage infoTypes through the Google Cloud console.

Inspection rulesets

Inspection rulesets let you customize both built-in and custom infoType detectors using context rules. The types of inspection rules are:

• Exclusion rules, which help exclude false or unwanted findings.
• Hotword rules, which help detect additional findings.
• Adjustment rules, which adjust the likelihood of findings based on the context in which they appear.

To add a new ruleset, first specify one or more built-in or custom infoType detectors in the InfoTypes section. Select all infoType detectors that your rulesets modify (the target infoTypes) or use for assessment (the context infoTypes). Then, do the following:

1. Click Add a ruleset.
2. In the Choose target infoTypes field, select the infoTypes that the ruleset modifies if the rules are met.
3. Click Add a rule to open a menu with options, including Hotword rule, Exclusion rule, and Adjustment rule.

To create a hotword rule, select Hotword rule. Then, do the following:

1. In the Hotword field, enter a regular expression that Sensitive Data Protection looks for.
2. From the Hotword proximity menu, select whether the hotword you entered is found before or after the chosen infoType.
3. In Hotword distance from infoType, enter the approximate number of characters between the hotword and the chosen infoType.
4. In Confidence level adjustment, select whether to assign matches a fixed likelihood level, or to increase or decrease the default likelihood level by a certain amount.

To create an exclusion rule, select Exclusion rule and the type of exclusion rule to create, for example, Regular expression. Then, do the following:

1. Depending on the exclusion rule type that you selected, enter the regular expression, phrase, hotword, or context infoType that must be found for the rule to apply.
2. Depending on the exclusion rule type that you selected, set the matching type or image containment type:
• If you selected a text-based exclusion rule, select one of the following matching types:
• Full match: The finding must completely match the text or context infoType that you provided.
• Partial match: A substring of the finding must match the text or context infoType that you provided.
• Inverse match: The finding must not match the text or context infoType that you provided.
• If you selected an image-based exclusion rule, select the required spatial relationship between the target and context infoTypes. For example, if you select Encloses, the context finding must enclose the target finding for the rule to apply.

To create an adjustment rule, select Adjustment rule and the type of adjustment rule, for example, Adjust by image findings. Then, do the following:

1. In the Context infoTypes field, select the infoType detectors that provide context for the target finding. Sensitive Data Protection uses context infoTypes to assess whether it must adjust the target infoType.
2. In the Minimum likelihood field, select the lowest likelihood level that the context infoTypes can have and still trigger the adjustment rule. If the likelihood value of any detected context finding is lower than this value, Sensitive Data Protection doesn't adjust the likelihood of the target finding.
3. For image findings, in the Image containment type field, select the required spatial relationship between the target and context infoTypes. For example, if you select Encloses, the context finding must enclose the target finding for the rule to apply.
4. In the Likelihood field, select the new likelihood level to assign to the target finding.

You can add more rulesets to further refine your scan results.

Confidence threshold

Every time Sensitive Data Protection detects a potential match for sensitive data, it assigns it a likelihood value on a scale from "Very unlikely" to "Very likely." When you set a likelihood value here, you are instructing Sensitive Data Protection to only match on data that corresponds to that likelihood value or higher.

The default value of "Possible" is sufficient for most purposes. If you routinely get matches that are too broad, move the slider up. If you get too few matches, move the slider down.

When you're done, click Create to create the template. The template's summary information page appears.

To return to the main Sensitive Data Protection page, click the Back arrow in the Google Cloud console.

C#

To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.

To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.

using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using System;

public class InspectTemplateCreate
{
    public static InspectTemplate Create(
        string projectId,
        string templateId,
        string displayName,
        string description,
        Likelihood likelihood,
        int maxFindings,
        bool includeQuote)
    {
        var client = DlpServiceClient.Create();

        var request = new CreateInspectTemplateRequest
        {
            Parent = new LocationName(projectId, "global").ToString(),
            InspectTemplate = new InspectTemplate
            {
                DisplayName = displayName,
                Description = description,
                InspectConfig = new InspectConfig
                {
                    MinLikelihood = likelihood,
                    Limits = new InspectConfig.Types.FindingLimits
                    {
                        MaxFindingsPerRequest = maxFindings
                    },
                    IncludeQuote = includeQuote
                },
            },
            TemplateId = templateId
        };

        var response = client.CreateInspectTemplate(request);

        Console