High-Confidence Starter Pack

A curated set of high-confidence, low false-positive detection patterns. The best starting point for organizations new to DLP pattern deployment. Covers major jurisdictions and credential types.

Jurisdictions
au, us, eu, global
Regulations
Privacy Act 1988 (Cth), HIPAA, GDPR
Frameworks
PCI-DSS
Patterns
10

Patterns in this collection

Australia Medicare Card Identifier

Identifies Australian Medicare card numbers (10-11 digits, first digit 2-6). Filters same-digit sequences. Requires corroborative health-scheme keywords for reliable detection.

Type
regex
Confidence
medium

Australian Taxation Identifier

Identifies Australian Tax File Numbers (TFNs) — unique nine-digit identifiers issued by the Australian Taxation Office. Uses an inline mod-11 Checksum validator with AllDigitsSameFilter and TextMatchFilter to exclude known test values.

Type
regex
Confidence
high

SIN

Detects SIN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type
regex
Confidence
medium

International Bank Account Number (IBAN)

Detects International Bank Account Numbers (IBANs) used across European and global banking systems. IBANs consist of a two-letter country code, two check digits, and up to 30 alphanumeric characters representing the domestic bank account number. This pattern matches IBANs with or without space or hyphen delimiters between digit groups.

Type
regex
Confidence
high

AWS Access Key

Detects AWS Access Key patterns.

Type
regex
Confidence
high

Electronic Mail Address

Identifies electronic mail addresses in local-part@domain.tld form using a pragmatic RFC 5322 / WHATWG HTML Living Standard subset: bounded local-part (64 characters, per RFC 5321) and domain-label quantifiers, not the full RFC 5322 address-list grammar (no quoted-string local parts, comments, or domain literals). Unlike the WHATWG "valid e-mail address" definition, a dotted domain ending in an alphabetic (or xn-- punycode) top-level label is required, so dotless intranet values such as user@localhost are deliberately excluded. Retina image asset names (logo@2x.png) are rejected in the primary. Absorbs the former global-email-address classifier.

Type
regex
Confidence
high

Github Pat

Detects Github Pat patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type
regex
Confidence
high

Payment Card PAN

Identifies payment card Primary Account Numbers (PANs) for Visa, Mastercard (including 2-series BINs), American Express, Discover, JCB, Diners Club and UnionPay, in contiguous and space/hyphen-separated forms. Uses Func_credit_card Luhn validator with AllDigitsSameFilter.

Type
regex
Confidence
high

National Insurance Number

Detects National Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type
regex
Confidence
medium

US Social Security Number

Detects US Social Security Numbers (SSNs) in both formatted (XXX-XX-XXXX) and unformatted (XXXXXXXXX) representations. The pattern excludes invalid SSN ranges including area numbers 000, 666, and 900-999, group numbers 00, and serial numbers 0000, in accordance with SSA assignment rules. SSNs are critical PII used across healthcare, financial, and government contexts.

Type
regex
Confidence
high