Packages / Device And Network Identifiers
Device And Network Identifiers
Device, host, IP, network, infrastructure, and technical environment identifiers.
- Patterns
- 28
- As primary component
- 11
Patterns in this package
Telecommunications provider account records that identify a customer or end-user as an "affected person" under the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025 (F2025L00664). Covers the agreed communication method recorded under s 10, the privacy, safety and security protections put on the account under ss 11-12 (PIN or password, verification code to a safe number or email, a new account not linked to the perpetrator), holds on and urgent reversal of a service limiting action under s 13, non-disclosure instructions under ss 25 and 27, privacy breach notifications to the affected person and the ACMA under s 29, and the record of the type of evidence sought, provided and sighted under ss 14 and 30-31. Most of the Standard commenced on 1 January 2026 (1 April 2026 for small providers); some provisions commenced on 1 July 2025. This is the telco counterpart of au-energy-family-violence-customer-record, with telco account structure (account or customer number, service or mobile number, MSISDN).
Integrated Public Number Database (IPND) data exchanged between carriage service providers, Data Providers, Data Users and the IPND Manager (Telstra): fixed-width upload and download files (HDR header record with an IPND file type, 905-character customer records, TRL trailer record), IPND file names (IPNDUP upload, IPNDES/LA/DI/LD/RS/EW download) and IPND extracts or reject reports listing public numbers with their List Code. List Code UL (Unlisted Number) and SA (Suppressed Address) records are protected by Telecommunications Act 1997 Part 13 (s 276 disclosure offence; s 285 permitted IPND uses exclude unlisted numbers). "Silent number" is an informal synonym for an unlisted number, not IPND terminology, and is used only as weak corroboration.
Records that carriers and carriage service providers must make of disclosures of protected information (Telecommunications Act 1997 (Cth) Part 13, s 276 primary offence) to law enforcement and enforcement agencies: the s 306 record (made within 5 days of the disclosure and kept for 3 years) and the s 306A record for prospective authorisations. A populated record gives the name of the person who disclosed the information, the date of disclosure, the grounds (for example s 280 authorised by law, s 313 assistance), warrant or authorisation details including authorisations under ss 178, 179 or 180 of the Telecommunications (Interception and Access) Act 1979, the authorising officer and date, the requesting agency and request date, the service disclosed and the s 187AA data-set items. The same fields appear in agency authorisation / request notices received by the provider. OAIC guidance, the Acts, ACMA and TIA Act annual report statistics and blank templates are decoys. Overlaps with lawful-interception-warrant, which covers interception and stored communications warrants (TIA Act secrecy) rather than Part 13 disclosure records; a record that cites the TIA Act next to a service number may also fire that classifier.
Detects Azure Machine Learning web service API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SignalR Service access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects mobile advertising identifiers - Apple's IDFA and Google's Advertising ID (GAID, also called AAID) - when they appear labelled with an advertising-ID keyword. These IDs are UUIDs in the canonical 8-4-4-4-12 hexadecimal form. Although resettable, advertising IDs are persistent cross-app device identifiers treated as personal data under GDPR and CCPA/CPRA, and their disclosure enables cross-context tracking and re-identification.
Detects ICCID patterns.
Detects IMEI patterns.
Detects IPv4 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects IPv6 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Kubernetes Internal Service URL patterns.
Detects Mac Address patterns.
SIM / USIM personalisation and key files exchanged between SIM vendors, mobile network operators and HSS/AuC provisioning: a header row naming subscriber key columns (Ki, OPc, ADM1, KIC1/KID1/KIK1, EKI) next to ICCID or IMSI, followed by populated rows that pair an ICCID (ITU-T E.118, MII 89, e.g. Australian issuer prefixes 8961 and 8967210 on the ACMA register) and an IMSI (3GPP TS 23.003, MCC + MNC + MSIN, at most 15 digits; Australia MCC 505) with 128-bit key values (32 hex characters, per 3GPP TS 35.206 K and OPc). The file layout is vendor-proprietary; the pySim card-key CSV and pysim-perso column sets are used only as shapes. Excludes the published 3GPP TS 35.208 test-set values, "Test Set" / "35.208" text, test networks (MCC 001) and pySim / Open5GS tutorial or documentation text.
Identifies documents containing references to device imei numbers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations. Detection is phrase-level concept matching anchored on explicit IMEI, TAC, and equipment-identity vocabulary; it does not parse or Luhn-validate 15-digit IMEI values.
Identifies system architecture diagrams patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies endpoint detection telemetry patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies sensitive network topology diagrams patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects endpoint-management policy profiles: Intune/MDM/GPO profile wording with machine policy artefacts (OMA-URI, payload keys, policy registry paths, Graph types) and populated profile fields. Topic wording alone is discovery-only.
Detects DNS zone files: $ORIGIN/$TTL/SOA directives with resource record lines, especially internal zones with private addresses and internal hostnames. A directive alone is discovery-only.
Identifies service dependency maps patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects URL patterns.
Detects Vehicle Identification Number patterns. Excludes I, O, Q characters
Detects telecommunications interception warrants, stored communications warrants and the intercept product they produce (call transcripts, line / session logs, intercepted communications) under the Telecommunications (Interception and Access) Act 1979 (Cth). Disclosure of the existence of an interception warrant or of interception product is a criminal offence under the TIA Act and alerts targets to switch to unmonitored channels. Absorbs the former lawful-intercept-transcripts classifier.
Detects Microsoft Defender for Identity (MDI) SensorConfiguration.json files containing DirectoryServicesAccount credentials and Microsoft Defender for Endpoint (MDE) mdatp_managed.json files containing onboardingInfo blobs, both of which represent high-value security tool configuration secrets. Mirrors Snaffler rule KeepDefenderConfigByName.
Detects passwords stored in FTP server and client configuration files, including FileZilla server/client recentservers.xml base64-encoded passwords, proftpd-style shadow passwd lines with hashed credentials, and sftp-config.json plaintext password fields. Mirrors Snaffler rules KeepFtpServerConfigByName and KeepFtpClientConfigConfigByName.
Detects MediaWiki LocalSettings.php files containing database passwords ($wgDBpassword), secret keys ($wgSecretKey), and upgrade keys ($wgUpgradeKey). These are high-value secrets that grant database and administrative access to a MediaWiki installation. Mirrors Snaffler rule KeepPhpByName.
Detects passwords and credentials stored in remote access configuration files including RDCMan .rdg files (logonCredentials blocks), mRemoteNG confCons.xml (Node Password attributes), and OpenVPN .ovpn files with embedded auth directives. MobaXterm .ini files are a Snaffler filename target only — passwords are stored obfuscated (proprietary XOR cipher) with no plaintext fingerprint detectable by content regex. Mirrors Snaffler rules KeepRemoteAccessConfByExtension and KeepRemoteAccessConfByName.