Packages / Database And Connection Credentials
Database passwords, authenticated connection strings, service accounts, and data-platform secrets.
Detects Azure Cosmos DB account access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DocumentDB (now Cosmos DB) authentication key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IaaS database and Azure SQL connection string patterns containing credentials. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cache for Redis connection string password patterns extracted from connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cache for Redis connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SQL Database connection string patterns specifically targeting the .database.windows.net domain. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Elasticsearch URI with Credentials patterns.
Detects database connection URLs with embedded user:password@host credentials, restricted to database schemes (mongodb/mongodb+srv, postgres/postgresql, mysql, redis/rediss, mssql/sqlserver, oracle, jdbc). Placeholder passwords and localhost/example hosts are rejected; non-database credential URLs (AMQP, LDAP, FTP) belong to a separate service-URL credential classifier.
Detects Mongodb patterns.
Detects Mysql patterns.
Detects Oracle Connection String patterns.
Detects Postgresql patterns.
Detects Redis patterns.
Detects Snowflake OAuth access and refresh tokens, which carry the recognizable ver:1-hint: / ver:2-hint: prefix used by Snowflake authentication. These tokens (and programmatic access tokens used in their place) grant query and data access to a Snowflake account.
Detects SQL Server patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Identifies database connection strings with credentials patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects PostgreSQL .pgpass file entries containing hostname, port, database, username, and password in colon-separated format. Mirrors Snaffler rule KeepDbMgtConfigByName.
Detects database connection credentials embedded in source code across Java (JDBC), PHP, Perl, Ruby, and Python. Matches database driver connect() calls containing credentials inline. Mirrors Snaffler rules KeepJavaDbConnStrings, KeepPhpDbConnStrings, KeepPerlDbConnStrings, KeepRubyDbConnStrings, KeepPyDbConnStrings.
Detects SQL statements that create database user accounts or logins with embedded passwords, covering SQL Server CREATE LOGIN, MySQL CREATE USER IDENTIFIED BY, and PostgreSQL CREATE USER WITH PASSWORD. Mirrors Snaffler rule KeepSqlAccountCreation.