Pattern Collections
22 curated collections grouping patterns by compliance framework, jurisdiction, or data category.
All collections
Classifiers for attacks on and misuse of AI assistants and agents: prompt injection and goal hijacking, indirect injection hidden in documents, jailbreak personas, system prompt disclosure, RAG source and memory poisoning, risky MCP connectors, agent action misuse, data exfiltration markers, and sensitive data or secrets placed in prompts or returned in output. Each maps to the OWASP Top 10 for LLM Applications, the NIST AI RMF Generative AI Profile and MITRE ATLAS. The collection also includes the OpenAI, AWS access key and GCP API key detectors, because several AI classifiers rely on them to find credentials inside AI context.
- Jurisdictions
- global
- Frameworks
- OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
- Patterns
- 17
Government identifier detection patterns for the Americas (excluding US). Covers Canada, Brazil, Mexico, Chile, and Argentina.
- Jurisdictions
- ca, br, mx, cl, ar
- Regulations
- PIPEDA, LGPD, LFPDPPP (Mexico)
- Patterns
- 7
Government identifier detection patterns for Asia-Pacific jurisdictions including Japan, Singapore, South Korea, China, and India.
- Jurisdictions
- jp, sg, kr, cn, in
- Regulations
- APPI, PDPA (Singapore), PIPA (South Korea), PIPL (China), Digital Personal Data Protection Act 2023 (India)
- Patterns
- 6
Classifiers for records that identify people affected by domestic and family violence, across all Australian jurisdictions and sectors: refuge and confidential addresses, protection orders and police directions, police incidents and referrals, criminal offence records, sexual assault counselling records, risk assessments and safety plans, case-record disclosures, and family and domestic violence leave. Every classifier requires a populated person, case or reference field before it enforces, so policy, guidance, statistics and blank forms stay at discovery level.
- Jurisdictions
- au
- Regulations
- Domestic and Family Violence Protection Act 2012 (Qld), Privacy Act 1988 (Cth), Fair Work Act 2009 (Cth)
- Patterns
- 10
Comprehensive Australian government identifier detection. Covers tax, healthcare, immigration, welfare, education, and business identifiers.
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth)
- Patterns
- 14
Healthcare-specific identifiers for Australian health data protection under the My Health Records Act 2012 and Privacy Act 1988.
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), My Health Records Act 2012 (Cth)
- Patterns
- 5
Core PII detection patterns for Australian Privacy Act 1988 compliance. Covers government identifiers, healthcare numbers, business identifiers, and personal contact information.
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth)
- Patterns
- 9
Australian public-sector identifier and payment classifiers tuned for precision: checksum-validated TFN, Medicare and IHI numbers, ABN, BSB and account references, Centrelink CRN, USI and driver licence numbers, and bulk payroll and superannuation files. Controls for phone-number overmatch and common test or sentinel values keep false positives down in government document stores.
- Jurisdictions
- au
- Regulations
- Privacy Act 1988 (Cth), Taxation Administration Act 1953 (Cth), Financial Accountability Act 2009 (Qld)
- Patterns
- 12
Detects leaked credentials, API keys, access tokens, and private key material across major cloud providers (AWS, Azure, GCP), developer platforms (GitHub, GitLab, Docker Hub, package registries), SaaS and AI services (OpenAI, Anthropic, Slack, Stripe, Twilio, and more), crypto exchanges, and generic secret formats (private keys, JWTs, bearer tokens, session cookies, credential combolists).
- Jurisdictions
- global
- Patterns
- 75
Detects business and legal-entity registry identifiers: company registration numbers (UK Companies House, Australian ACN, Brazilian CNPJ, Japanese Corporate Number), business register numbers (Australian ABN, New Zealand NZBN, Polish REGON), entity tax/VAT registrations (EU VAT, India GSTIN, Turkish VKN), and the global Legal Entity Identifier (LEI). Useful for identifying documents about specific business entities in M&A, vendor onboarding, KYB, and procurement contexts.
- Jurisdictions
- global, uk, eu, au, nz, br, pl, in, jp, tr
- Patterns
- 11
Detects database connection strings and embedded credentials across SQL Server, MySQL, PostgreSQL, MongoDB, Redis, Azure, Oracle, Elasticsearch, and Kubernetes.
- Jurisdictions
- global
- Patterns
- 12
High-value national, tax and financial identifiers for the UK, Canada, India, Singapore, China, Mexico, Indonesia, Brazil, Saudi Arabia, the Philippines and Vietnam, plus the global National Drug Code (NDC). Each classifier uses a Purview-safe regex with specific corroborative keywords, and carries a risk rating and sensitivity labels for Australian (PSPF / QGISCF), US, UK, NZ and Canadian schemes.
- Jurisdictions
- global, uk, ca, in, sg, cn, mx, id, br, sa, ph, vn, us
- Regulations
- GDPR, UK GDPR, PIPEDA, Digital Personal Data Protection Act 2023 (India), PDPA (Singapore), PIPL (China), LGPD, HIPAA
- Patterns
- 15
Detects cryptocurrency wallet addresses across major networks — Bitcoin (legacy and Bech32), Ethereum, Solana, XRP, Litecoin, Tron, Cardano, Dogecoin, and Monero.
- Jurisdictions
- global
- Patterns
- 9
National identifier detection patterns for EU and UK jurisdictions. Covers identity cards, tax IDs, social security numbers, and national registration numbers.
- Jurisdictions
- eu, uk, de, fr, it, es, nl, be, pl, se
- Regulations
- GDPR, Data Protection Act 2018 (UK)
- Patterns
- 15
Detection patterns for personal data identifiers covered under the EU General Data Protection Regulation. Includes financial identifiers, national IDs, contact information, and payment card data.
- Jurisdictions
- eu
- Regulations
- GDPR
- Patterns
- 12
A curated set of high-confidence, low false-positive detection patterns. The best starting point for organizations new to DLP pattern deployment. Covers major jurisdictions and credential types.
- Jurisdictions
- au, us, eu, global
- Regulations
- Privacy Act 1988 (Cth), HIPAA, GDPR
- Frameworks
- PCI-DSS
- Patterns
- 10
Network addresses, device identifiers, and infrastructure patterns. Covers IP addresses, MAC addresses, IMEI, SIM cards, and vehicle identification.
- Jurisdictions
- global
- Patterns
- 6
New Zealand Protective Security Requirements (PSR) classification detection. Covers both PSR families: policy-and-privacy markings (IN-CONFIDENCE, SENSITIVE) and national-security markings (RESTRICTED, CONFIDENTIAL, SECRET, TOP SECRET). UNCLASSIFIED is not a current PSR classification level and is intentionally excluded.
- Jurisdictions
- nz
- Frameworks
- PSR
- Patterns
- 5
Payment card and financial instrument detection patterns for PCI-DSS compliance. Covers all major card networks, IBAN, and SWIFT/BIC codes.
- Jurisdictions
- global
- Frameworks
- PCI-DSS
- Patterns
- 4
Detects government security classification markings and banners across allied jurisdictions: Australia (PSPF), New Zealand (PSR), the United Kingdom (GSCP), the United States (EO 13526 classification banners and CUI banner markings), Canada (Directive on Security Management), the European Union (EUCI RESTREINT UE), and NATO. Intended for identifying classified or officially marked material moving outside approved government environments.
- Jurisdictions
- au, nz, uk, us, ca, eu, nato
- Frameworks
- PSPF, PSR, GSCP, Policy on Government Security, EUCI, NATO Security Policy
- Patterns
- 16
Content-based Purview SITs replicating Snaffler's sensitive-file detections. Complements filename-based hunting by detecting the same secrets by content, everywhere M365 reaches.
- Patterns
- 22
Healthcare identifier and code detection for US HIPAA compliance. Covers provider numbers, beneficiary IDs, and medical coding systems.
- Jurisdictions
- us
- Regulations
- HIPAA, CCPA/CPRA
- Patterns
- 7