This topic describes in detail how to create a new inspection template. For a quick walkthrough of how to create a new inspection template using the Cloud DLP UI, see Quickstart creating a Cloud DLP inspection template.
About templates
You can use templates to create and persist configuration information to use with Cloud Data Loss Prevention (DLP). Templates are useful for decoupling configuration information—such as what you inspect for and how you de-identify it—from the implementation of your requests. Templates provide a way to re-use configuration and enable consistency across users and datasets.
Cloud DLP supports inspection templates, which are discussed in this topic, and de-identification templates, which are discussed in Creating Cloud DLP de-identification templates.
For conceptual information about templates in Cloud DLP, see Templates.
Create a new inspection template
To create a new Cloud DLP template:
Console
In the GCP Console, open Cloud DLP.
From the Create menu, choose Template.
Alternatively, click the following button:
The Create template page contains the following sections:
Naming
Under Naming, enter an identifier for the inspection template. This is how you'll refer to the template when you run a job, create a job trigger, and so on. You can use letters, numbers, and hyphens. If you want, you can also enter a description to better remember what the template does.
InfoTypes
Next, choose a built-in infoType to use to scan your content.
InfoType detectors find sensitive data of a certain type. For example, the
Cloud DLP US_SOCIAL_SECURITY_NUMBER infoType detector finds
US Social Security numbers.
Under InfoTypes, choose the infoType detector that corresponds to a data type you want to scan for. You can also leave this field blank to scan for all default infoTypes. More information about each detector is provided in InfoType detector reference.
Confidence threshold
Every time Cloud DLP detects a potential match for sensitive data, it assigns it a likelihood value on a scale from "Very unlikely" to "Very likely." When you set a likelihood value here, you are instructing Cloud DLP to only match on data that corresponds to that likelihood value or higher.
The default value of "Possible" is sufficient for most purposes. If you routinely get matches that are too broad when you use this template, move the slider up. If you get too few matches, move the slider down.
When you're done, click Create to create the template. The template's summary information page appears.
To return to the main Cloud DLP page, click the Back arrow in the GCP Console.
Protocol
It's useful to note that an inspection template is simply a reusable inspection
configuration plus some metadata. In API terms, the
InspectTemplate
object is effectively an
InspectConfig
object that includes a few more fields of metadata, such as a display name and
a description. Therefore, to create a new inspection template, the basic steps
are:
- Start with an
InspectConfigobject. - Call or POST the
createmethod of either theprojects.inspectTemplatesororganizations.inspectTemplatesresource, including in your request anInspectTemplateobject that contains a display name, a description, and thatInspectConfigobject.
The returned InspectTemplate will be ready for use immediately. You can
reference it in other calls or jobs by its name. You can list the existing
templates by calling the *.inspectTemplates.list method. To view a specific
template, call the *.inspectTemplates.get method. Note that the limit for the
number of templates you can create is 1000.
If you've already had some experience inspecting text, images, or structured
content for sensitive content using Cloud DLP, you've already
created an
InspectConfig
object. One additional step turns it into an
InspectTemplate
object.
The following JSON is an example of what you can send to the
projects.inspectTemplates.create
method. (Try it for yourself in
APIs Explorer.)
This JSON creates a new template with the given display name and description,
and scans for matches on the infoTypes PHONE_NUMBER and
US_TOLLFREE_PHONE_NUMBER. It will include in its findings up to 100 matches
whose likelihoods are at least POSSIBLE, and will include a snippet of
context for each.
JSON Input:
POST https://dlp.googleapis.com/v2/projects/[PROJECT_ID]/inspectTemplates?key={YOUR_API_KEY}
{
"inspectTemplate":{
"displayName":"Phone number inspection",
"description":"Scans for phone numbers",
"inspectConfig":{
"infoTypes":[
{
"name":"PHONE_NUMBER"
},
{
"name":"US_TOLLFREE_PHONE_NUMBER"
}
],
"minLikelihood":"POSSIBLE",
"limits":{
"maxFindingsPerRequest":100
},
"includeQuote":true
}
}
}
JSON Output:
The response JSON looks like the following:
{
"name":"projects/[PROJECT_ID]/inspectTemplates/[JOB_ID]",
"displayName":"Phone number inspection",
"description":"Scans for phone numbers",
"createTime":"2018-11-30T07:26:28.164136Z",
"updateTime":"2018-11-30T07:26:28.164136Z",
"inspectConfig":{
"infoTypes":[
{
"name":"PHONE_NUMBER"
},
{
"name":"US_TOLLFREE_PHONE_NUMBER"
}
],
"minLikelihood":"POSSIBLE",
"limits":{
"maxFindingsPerRequest":100
},
"includeQuote":true
}
}
Java
Node.js
Python
Go
PHP
C#
Listing inspection templates
To list all inspection templates that have been created in the current project or organization:
Console
In the GCP Console, open Cloud DLP.
Click the Templates tab.
The console displays a list of all inspection templates for the current project.
Protocol
Use one of the *.*.list methods:
Java
Node.js
Python
Go
PHP
C#
Deleting inspection templates
To delete an inspection template:
Console
In the GCP Console, open Cloud DLP.
Click the Templates tab. The console displays a list of all templates for the current project.
In the Actions column for the template you want to delete, click the three vertical dots, and then click Delete.
Alternatively, from the list of templates, click the name of the template you want to delete. On the template's detail page, click Delete.
Protocol
Use one of the *.*.delete methods:
With each *.*.delete method, you include the resource name of the template to
be deleted.
Java
Node.js
Python
Go
PHP
C#
