Stop writing DLP patterns from scratch

1337+ community-built regex patterns for detecting sensitive data — PII, PHI, financial records, government IDs. Tested, documented, and ready to export to Microsoft Purview. No account needed.

1337 patterns · 78 jurisdictions · 327 regulations

Getting started

• Filter by scope — Use the Scope filter to find patterns that match your precision needs.
• Start with collections — Collections group patterns by compliance framework.
• Build custom bundles — Pick exactly the patterns you need and export a single Purview XML file.
• Check confidence — Every pattern has a confidence rating and false positive notes.

How it works

1. Find — Search by jurisdiction, regulation, or data type.
2. Review — Every pattern has test cases, false-positive notes, and confidence ratings.
3. Export — Download as Purview XML, GCP DLP JSON, Macie JSON, or raw regex.

Why does this exist?

Every security team writing DLP rules hits the same wall. You need a Medicare number regex. A passport pattern. A credit card detector. So you write it from scratch. Test it. Find the false positives. Fix them. Repeat. The team down the road is doing the exact same thing.

SIEM teams share Sigma rules. Malware analysts share YARA signatures. IDS teams share Snort rules. DLP teams had nothing to share. That's what TestPattern fixes.

Export formats

• Microsoft Purview XML — Ready to import via PowerShell. Valid RulePack format.
• GCP DLP JSON — Native InspectTemplate format for Google Cloud DLP.
• AWS Macie JSON — Custom data identifier format for Amazon Macie.
• Raw Regex & YAML — Copy the regex or grab the full YAML for automation.

Collections

• AI Threat Classifiers — Classifiers for attacks on and misuse of AI assistants and agents: prompt injection and goal hijacking, indirect injection hidden in documents, jailbreak personas, system prompt disclosure, RAG source and memory poisoning, risky MCP connectors, agent action misuse, data exfiltration markers, and sensitive data or secrets placed in prompts or returned in output. Each maps to the OWASP Top 10 for LLM Applications, the NIST AI RMF Generative AI Profile and MITRE ATLAS. The collection also includes the OpenAI, AWS access key and GCP API key detectors, because several AI classifiers rely on them to find credentials inside AI context.
• Americas Government IDs — Government identifier detection patterns for the Americas (excluding US). Covers Canada, Brazil, Mexico, Chile, and Argentina.
• APAC Government IDs — Government identifier detection patterns for Asia-Pacific jurisdictions including Japan, Singapore, South Korea, China, and India.
• Australian Domestic and Family Violence Records — Classifiers for records that identify people affected by domestic and family violence, across all Australian jurisdictions and sectors: refuge and confidential addresses, protection orders and police directions, police incidents and referrals, criminal offence records, sexual assault counselling records, risk assessments and safety plans, case-record disclosures, and family and domestic violence leave. Every classifier requires a populated person, case or reference field before it enforces, so policy, guidance, statistics and blank forms stay at discovery level.
• Australian Government IDs — Comprehensive Australian government identifier detection. Covers tax, healthcare, immigration, welfare, education, and business identifiers.
• Australian Healthcare Identifiers — Healthcare-specific identifiers for Australian health data protection under the My Health Records Act 2012 and Privacy Act 1988.
• Australian Privacy Act Essentials — Core PII detection patterns for Australian Privacy Act 1988 compliance. Covers government identifiers, healthcare numbers, business identifiers, and personal contact information.
• Australian Public Sector Tuned Identifiers — Australian public-sector identifier and payment classifiers tuned for precision: checksum-validated TFN, Medicare and IHI numbers, ABN, BSB and account references, Centrelink CRN, USI and driver licence numbers, and bulk payroll and superannuation files. Controls for phone-number overmatch and common test or sentinel values keep false positives down in government document stores.
• Cloud Credentials & API Keys — Detects leaked credentials, API keys, access tokens, and private key material across major cloud providers (AWS, Azure, GCP), developer platforms (GitHub, GitLab, Docker Hub, package registries), SaaS and AI services (OpenAI, Anthropic, Slack, Stripe, Twilio, and more), crypto exchanges, and generic secret formats (private keys, JWTs, bearer tokens, session cookies, credential combolists).
• Company & Business Registry Identifiers — Detects business and legal-entity registry identifiers: company registration numbers (UK Companies House, Australian ACN, Brazilian CNPJ, Japanese Corporate Number), business register numbers (Australian ABN, New Zealand NZBN, Polish REGON), entity tax/VAT registrations (EU VAT, India GSTIN, Turkish VKN), and the global Legal Entity Identifier (LEI). Useful for identifying documents about specific business entities in M&A, vendor onboarding, KYB, and procurement contexts.
• Database Connection Strings — Detects database connection strings and embedded credentials across SQL Server, MySQL, PostgreSQL, MongoDB, Redis, Azure, Oracle, Elasticsearch, and Kubernetes.
• Coverage Phase 1 Priority Identifiers — High-value national, tax and financial identifiers for the UK, Canada, India, Singapore, China, Mexico, Indonesia, Brazil, Saudi Arabia, the Philippines and Vietnam, plus the global National Drug Code (NDC). Each classifier uses a Purview-safe regex with specific corroborative keywords, and carries a risk rating and sensitivity labels for Australian (PSPF / QGISCF), US, UK, NZ and Canadian schemes.
• Cryptocurrency Wallet Addresses — Detects cryptocurrency wallet addresses across major networks — Bitcoin (legacy and Bech32), Ethereum, Solana, XRP, Litecoin, Tron, Cardano, Dogecoin, and Monero.
• European National IDs — National identifier detection patterns for EU and UK jurisdictions. Covers identity cards, tax IDs, social security numbers, and national registration numbers.
• GDPR Personal Data Kit — Detection patterns for personal data identifiers covered under the EU General Data Protection Regulation. Includes financial identifiers, national IDs, contact information, and payment card data.
• High-Confidence Starter Pack — A curated set of high-confidence, low false-positive detection patterns. The best starting point for organizations new to DLP pattern deployment. Covers major jurisdictions and credential types.
• Network & Device Identifiers — Network addresses, device identifiers, and infrastructure patterns. Covers IP addresses, MAC addresses, IMEI, SIM cards, and vehicle identification.
• NZ Protective Markings — New Zealand Protective Security Requirements (PSR) classification detection. Covers both PSR families: policy-and-privacy markings (IN-CONFIDENCE, SENSITIVE) and national-security markings (RESTRICTED, CONFIDENTIAL, SECRET, TOP SECRET). UNCLASSIFIED is not a current PSR classification level and is intentionally excluded.
• PCI-DSS Card Data — Payment card and financial instrument detection patterns for PCI-DSS compliance. Covers all major card networks, IBAN, and SWIFT/BIC codes.
• Government Protective Markings — Detects government security classification markings and banners across allied jurisdictions: Australia (PSPF), New Zealand (PSR), the United Kingdom (GSCP), the United States (EO 13526 classification banners and CUI banner markings), Canada (Directive on Security Management), the European Union (EUCI RESTREINT UE), and NATO. Intended for identifying classified or officially marked material moving outside approved government environments.
• Snaffler Parity — Credential & Secret Files — Content-based Purview SITs replicating Snaffler's sensitive-file detections. Complements filename-based hunting by detecting the same secrets by content, everywhere M365 reaches.
• US Healthcare Compliance — Healthcare identifier and code detection for US HIPAA compliance. Covers provider numbers, beneficiary IDs, and medical coding systems.