Sensitive Data Protection には、データの検査、変換（匿名化）、検出、分類に使用できる、さまざまなタイプのメソッドが含まれています。このようなメソッドを使用して、 Google Cloud の内外でデータをスキャンし、さまざまなタイプのワークロードに対して Sensitive Data Protection の動作を最適化できます。
ハイブリッド メソッドは、実質すべてのソースから送信されたデータのペイロードをスキャンし、その結果を Google Cloudに保存できるようにする一連の非同期 API メソッドです。ハイブリッド メソッドは、コンテンツ メソッドと似ていますが、検査対象のデータが 1 つ以上の検査リクエストに含まれている点が異なります。ただし、コンテンツ メソッドと異なり、ハイブリッド メソッドは API レスポンスで検査結果を返しません。代わりに、検査結果はサーバー側で非同期的に処理され、結果が表にまとめられ、ストレージ メソッドに似た方法で保存されます。
ハイブリッド検査を有効にするには、dlpJobs リソースを使用して機密データの保護ジョブを作成します。各ハイブリッド ジョブは、検査リクエストをリッスンし、検出結果の保存や公開などの機密データの保護アクションを実行するマネージド サービスとして実行されます。これらのオプションのアクションに加えて、機密データの保護は、ジョブのステータス、スキャンしたバイト数、infoType ごとの検出結果の概要など、ジョブの詳細を作成して保存します。Google Cloud コンソールの DLP API または機密データの保護を使用してジョブを管理できます。
検出を構成して、BigQuery、Cloud SQL、Cloud Storage、Vertex AI などのシステムに保存されているデータをスキャンできます。 Google Cloud Security Command Center Enterprise が有効になっている場合は、Sensitive Data Protection を使用して他のクラウド プロバイダのデータをスキャンすることもできます。
検出スキャンごとに機密データの保護で実行するアクションを指定できます。たとえば、スキャン結果を Security Command Center や Google Security Operations などの他のGoogle Cloud サービスに送信して、組織のデータ セキュリティ体制の可視性を高めることができます。プロファイリングされたリソースにタグを付けて、それらのリソースに対する IAM アクセスを自動的に許可または拒否するように、検出サービスを構成できます。データ プロファイルを BigQuery にエクスポートすることもできます。エクスポートしたプロファイルを Looker に接続して、事前作成されたレポートを表示できます。独自のカスタムクエリとレポートを作成することもできます。
検出を有効にするには、DiscoveryConfig リソースを作成します。検出は、検出構成で設定したスコープと頻度に基づいて実行されます。Sensitive Data Protection が生成されたプロファイルを保存する場所については、データ所在地に関する検討事項をご覧ください。
検出構成、データ プロファイル、Cloud SQL 接続は、DLP API または Google Cloud コンソールを使用して管理できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[],[],null,["# Method types\n\nSensitive Data Protection includes different types of methods that you can use to\ninspect, transform (*de-identify*), discover, and classify data. Using these\nmethods, you can scan data both on and off Google Cloud and optimize the\nbehavior of Sensitive Data Protection for different types of workloads.\n\nSensitive Data Protection provides the following method types:\n\n- [Content methods](#content-methods)\n- [Storage methods](#storage-methods)\n- [Hybrid methods](#hybrid-methods)\n- [Discovery methods](#discovery-methods)\n\nInspection and de-identification methods\n----------------------------------------\n\nThis section describes the methods that you can use to locate and, optionally,\nde-identify each piece of data that matches an [information\ntype](/sensitive-data-protection/docs/infotypes-reference) listed in your your [inspection\nconfiguration](/sensitive-data-protection/docs/reference/rest/v2/InspectConfig).\n\n### Content methods\n\n*Content methods* are synchronous, stateless methods. The data to be inspected\nor transformed is sent directly in the request to the DLP API.\nSensitive Data Protection inspection findings or transformed data is returned in\nthe API response. Request data is encrypted in transit and is not stored.\n\nTo learn more, explore the REST API reference for content methods:\n\n- [`content.inspect`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect)\n- [`content.deidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/deidentify)\n- [`content.reidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/reidentify)\n- [`image.redact`](/sensitive-data-protection/docs/reference/rest/v2/projects.image/redact)\n\n### Storage methods\n\n*Storage methods* are designed to inspect data stored on Google Cloud in systems\nlike [Cloud Storage](/storage), [BigQuery](/bigquery), and\n[Firestore in Datastore mode (Datastore)](/datastore). To enable storage inspection, you create a\nSensitive Data Protection job using the\n[`dlpJobs`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs)\nresource. Each job runs as a managed service to inspect data and then perform\n[Sensitive Data Protection actions](/sensitive-data-protection/docs/concepts-actions) such as save or publish findings. In\naddition to these optional actions, Sensitive Data Protection creates and stores\ndetails about the job including job status, bytes scanned, and summary findings\nper infoType. You can manage jobs using the DLP API or\nSensitive Data Protection in the [Google Cloud console](https://console.cloud.google.com/security/sensitive-data-protection).\n\nTo learn more, explore the REST API reference for the\n[`projects.dlpJobs`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs) resource. You specify the\nstorage details in the\n[`StorageConfig`](/sensitive-data-protection/docs/reference/rest/v2/InspectJobConfig#storageconfig) object.\n\n### Hybrid methods\n\n*Hybrid methods* are a set of asynchronous API methods that allow you to scan\npayloads of data sent from virtually any source for sensitive information and\nstore the findings in Google Cloud. Hybrid methods are similar to\n[content methods](#content-methods) in that the data you want to inspect is\nincluded in one or more inspection requests; however, unlike\n[content methods](#content-methods), *hybrid methods* do not return inspection\nresults in the API response. Instead, inspection results are processed\nserver-side asynchronously and results are tabulated and stored in a\nmanner similar to [storage methods](#storage-methods).\n\nTo enable hybrid inspection, you create a Sensitive Data Protection job using the\n[`dlpJobs`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs)\nresource. Each *hybrid* job runs as a managed service to listen for inspection\nrequests and performs [Sensitive Data Protection actions](/sensitive-data-protection/docs/concepts-actions) such as\nsave or publish findings. In addition to these optional actions,\nSensitive Data Protection creates and stores details about the job including job\nstatus, bytes scanned, and summary findings per infoType. You can manage jobs\nusing the DLP API or Sensitive Data Protection in the\n[Google Cloud console](https://console.cloud.google.com/security/sensitive-data-protection).\n\nTo learn more, explore the REST API reference for the\n[`projects.dlpJobs`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs) resource. You specify the\ndata source in the `hybridOptions` field of the\n[`StorageConfig`](/sensitive-data-protection/docs/reference/rest/v2/InspectJobConfig#storageconfig) object.\n\nDiscovery methods\n-----------------\n\n*Discovery methods* allow you to configure [sensitive data\ndiscovery](/sensitive-data-protection/docs/data-profiles) to generate *data profiles*. Data\nprofiles provide insights to help you determine where sensitive data reside in\nyour organization, what kind of sensitive data you are storing, and whether that\ndata has access controls in place.\n\nYou can configure discovery to scan data stored on Google Cloud in systems like\nBigQuery, Cloud SQL, Cloud Storage, and Vertex AI. If you\nhave a Security Command Center Enterprise activation, you can also use\nSensitive Data Protection to scan data from other cloud providers.\n\nYou can specify actions that you want Sensitive Data Protection to perform after\neach discovery scan. For example, you can send scan results to other\nGoogle Cloud services---like Security Command Center and\nGoogle Security Operations---to increase your visibility into your\norganization's data security posture. You can configure the discovery service to\ntag your profiled resources to automatically grant or deny IAM\naccess to those resources. You can also export the data profiles to\nBigQuery. You can connect the exported profiles to Looker to\n[view the premade\nreport](/sensitive-data-protection/docs/analyze-data-profiles#use_a_premade_report). You can\nalso create your own custom queries and reports.\n\nTo enable discovery, you create a\n[`DiscoveryConfig`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.discoveryConfigs)\nresource. Discovery runs based on the scope and frequency that you set in the\ndiscovery configuration. For information about where Sensitive Data Protection\nstores the generated profiles, see [Data residency\nconsiderations](/sensitive-data-protection/docs/data-profiles#data-residency).\n\nYou can manage the discovery configurations, data profiles, and Cloud SQL\nconnections using the DLP API or the\n[Google Cloud console](https://console.cloud.google.com/security/sensitive-data-protection).\n\nTo learn more, explore the REST API reference for the following:\n\n- Discovery configurations\n\n - [`organizations.locations.discoveryConfigs`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.discoveryConfigs)\n - [`projects.locations.discoveryConfigs`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.discoveryConfigs)\n- Connections\n\n Connections are relevant only to [discovery for\n Cloud SQL](/sensitive-data-protection/docs/data-profiles#cloud-sql).\n - [`organizations.locations.connections`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.connections)\n - [`projects.locations.connections`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.connections)\n- Data profiles\n\n - [`organizations.locations.projectDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.projectDataProfiles)\n - [`projects.locations.projectDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.projectDataProfiles)\n - [`organizations.locations.fileStoreDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.fileStoreDataProfiles)\n - [`projects.locations.fileStoreDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.fileStoreDataProfiles)\n - [`organizations.locations.tableDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.tableDataProfiles)\n - [`projects.locations.tableDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.tableDataProfiles)\n - [`organizations.locations.columnDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.columnDataProfiles)\n - [`projects.locations.columnDataProfiles`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.columnDataProfiles)\n\nWhat's next\n-----------\n\n- Read the how-to guides to get started with inspecting text and images for sensitive data, as well as redacting sensitive data from text and images:\n - [Inspecting text for sensitive data](/sensitive-data-protection/docs/inspecting-text)\n - [Inspecting structured text for sensitive\n data](/sensitive-data-protection/docs/inspecting-structured-text)\n - [Inspecting images for sensitive data](/sensitive-data-protection/docs/inspecting-images)\n - [Redacting sensitive data from\n images](/sensitive-data-protection/docs/redacting-sensitive-data-images)\n - [De-identifying sensitive data](/sensitive-data-protection/docs/deidentify-sensitive-data)\n- For more information about inspecting storage and how to use actions, see [Inspecting storage and databases for sensitive\n data](/sensitive-data-protection/docs/inspecting-storage).\n- For more information about sensitive data discovery, see [Data\n profiles](/sensitive-data-protection/docs/data-profiles)\n- Review [pricing](/sensitive-data-protection/pricing)."]]
