Pattern Collections
21 curated collections grouping patterns by compliance framework, jurisdiction, or data category.
All collections
The Aairii AI-attack classifier library (AI-SIT-001..014) as TestPattern definitions, mapped to OWASP LLM Top 10 / NIST AI RMF GenAI Profile / MITRE ATLAS. Besides the 14 AI-SIT patterns, the collection intentionally includes three global credential SITs - global-openai-key, global-aws-access-key, and global-gcp-api-key - as the delegated detectors that the SIT-re-scope classifiers (004/005/010/011) rely on. The 17-member export is therefore intentional, not an error.
- Jurisdictions
- global
- Regulations
- OWASP LLM Top 10 2025, NIST AI RMF GenAI Profile
- Patterns
- 17
Government identifier detection patterns for the Americas (excluding US). Covers Canada, Brazil, Mexico, Chile, and Argentina.
- Jurisdictions
- ca, br, mx, cl, ar
- Regulations
- pipeda, lgpd, lfpdppp
- Patterns
- 7
Government identifier detection patterns for Asia-Pacific jurisdictions including Japan, Singapore, South Korea, China, and India.
- Jurisdictions
- jp, sg, kr, cn, in
- Regulations
- appi, pdpa, pipa, pipl, dpdp-act-2023
- Patterns
- 6
Comprehensive Australian government identifier detection. Covers tax, healthcare, immigration, welfare, education, and business identifiers.
- Jurisdictions
- au
- Regulations
- privacy-act-1988
- Patterns
- 14
Healthcare-specific identifiers for Australian health data protection under the My Health Records Act 2012 and Privacy Act 1988.
- Jurisdictions
- au
- Regulations
- privacy-act-1988, my-health-records-act-2012
- Patterns
- 5
Core PII detection patterns for Australian Privacy Act 1988 compliance. Covers government identifiers, healthcare numbers, business identifiers, and personal contact information.
- Jurisdictions
- au
- Regulations
- privacy-act-1988
- Patterns
- 9
Precision-tuned Australian public-sector identifier and payment patterns using the current validated TestPattern definitions, regional phone-number overmatch controls, checksum-backed identifiers, and sentinel/test-value filters.
- Jurisdictions
- au
- Regulations
- privacy-act-1988, tax-admin-act-1953, financial-accountability-act-2009-qld
- Patterns
- 13
Detects leaked credentials, API keys, access tokens, and private key material across major cloud providers (AWS, Azure, GCP), developer platforms (GitHub, GitLab, Docker Hub, package registries), SaaS and AI services (OpenAI, Anthropic, Slack, Stripe, Twilio, and more), crypto exchanges, and generic secret formats (private keys, JWTs, bearer tokens, session cookies, credential combolists).
- Jurisdictions
- global
- Regulations
- general-data-protection
- Patterns
- 75
Detects business and legal-entity registry identifiers: company registration numbers (UK Companies House, Australian ACN, Brazilian CNPJ, Japanese Corporate Number), business register numbers (Australian ABN, New Zealand NZBN, Polish REGON), entity tax/VAT registrations (EU VAT, India GSTIN, Turkish VKN), and the global Legal Entity Identifier (LEI). Useful for identifying documents about specific business entities in M&A, vendor onboarding, KYB, and procurement contexts.
- Jurisdictions
- global, uk, eu, au, nz, br, pl, in, jp, tr
- Regulations
- general-data-protection
- Patterns
- 11
Detects database connection strings and embedded credentials across SQL Server, MySQL, PostgreSQL, MongoDB, Redis, Azure, Oracle, Elasticsearch, and Kubernetes.
- Jurisdictions
- global
- Regulations
- general-data-protection
- Patterns
- 12
High-value national and financial identifiers from the Phase-1 coverage backlog (UK/CA/IN/SG/CN/MX/ID/BR/SA/PH/VN + global NDC). Mature SITs with Purview-safe regexes, specific corroborative keywords, risk ratings, and multi-framework sensitivity_labels for QGISCF/PSPF pack workbooks.
- Jurisdictions
- global, uk, ca, in, sg, cn, mx, id, br, sa, ph, vn, us
- Regulations
- GDPR, UK GDPR, PIPEDA, DPDPA, PDPA (SG), PIPL (China), LGPD, HIPAA
- Patterns
- 15
Detects cryptocurrency wallet addresses across major networks — Bitcoin (legacy and Bech32), Ethereum, Solana, XRP, Litecoin, Tron, Cardano, Dogecoin, and Monero.
- Jurisdictions
- global
- Regulations
- general-data-protection
- Patterns
- 10
National identifier detection patterns for EU and UK jurisdictions. Covers identity cards, tax IDs, social security numbers, and national registration numbers.
- Jurisdictions
- eu, uk, de, fr, it, es, nl, be, pl, se
- Regulations
- gdpr, uk-dpa-2018
- Patterns
- 15
Detection patterns for personal data identifiers covered under the EU General Data Protection Regulation. Includes financial identifiers, national IDs, contact information, and payment card data.
- Jurisdictions
- eu
- Regulations
- gdpr
- Patterns
- 12
A curated set of high-confidence, low false-positive detection patterns. The best starting point for organizations new to DLP pattern deployment. Covers major jurisdictions and credential types.
- Jurisdictions
- au, us, eu, global
- Regulations
- privacy-act-1988, hipaa, gdpr, pci-dss
- Patterns
- 10
Network addresses, device identifiers, and infrastructure patterns. Covers IP addresses, MAC addresses, IMEI, SIM cards, and vehicle identification.
- Jurisdictions
- global
- Regulations
- general-data-protection
- Patterns
- 6
New Zealand Protective Security Requirements (PSR) classification detection. Covers both PSR families: policy-and-privacy markings (IN-CONFIDENCE, SENSITIVE) and national-security markings (RESTRICTED, CONFIDENTIAL, SECRET, TOP SECRET). UNCLASSIFIED is not a current PSR classification level and is intentionally excluded.
- Jurisdictions
- nz
- Regulations
- protective-security-requirements
- Patterns
- 5
Payment card and financial instrument detection patterns for PCI-DSS compliance. Covers all major card networks, IBAN, and SWIFT/BIC codes.
- Jurisdictions
- global
- Regulations
- pci-dss
- Patterns
- 4
Detects government security classification markings and banners across allied jurisdictions: Australia (PSPF), New Zealand (PSR), the United Kingdom (GSCP), the United States (EO 13526 classification banners and CUI banner markings), Canada (Directive on Security Management), the European Union (EUCI RESTREINT UE), and NATO. Intended for identifying classified or officially marked material moving outside approved government environments.
- Jurisdictions
- au, nz, uk, us, ca, eu, nato
- Regulations
- protective-security-requirements
- Patterns
- 16
Content-based Purview SITs replicating Snaffler's sensitive-file detections. Complements filename-based hunting by detecting the same secrets by content, everywhere M365 reaches.
- Patterns
- 22
Healthcare identifier and code detection for US HIPAA compliance. Covers provider numbers, beneficiary IDs, and medical coding systems.
- Jurisdictions
- us
- Regulations
- hipaa, ccpa
- Patterns
- 7