Packages / Government Operations
Cabinet, public-sector administration, agency operations, official records, and statutory material.
Detects documents containing intelligence holdings, surveillance methods, evidence gaps, and investigative strategy against active criminal investigation targets. These target packages reveal the full picture of what police know and do not know about a suspect, enabling counter-surveillance and evidence destruction if disclosed.
Detects pre-release adoption records including birth parent identities, adoptee matching assessments, placement recommendations, relinquishment consents, and contact vetoes under the Adoption Act 2009 (Qld). These records contain information that individuals have a legal right to control — premature or unauthorised disclosure can cause profound emotional harm and breach court-sealed orders.
Detects Emirates Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects UAE passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects agent tool-misuse / high-risk action instructions in AI/agent context: destructive or irreversible action language coupled with a high-impact target or an approval-bypass clause (OWASP LLM06 / Agentic Top 10). The action verb and target must co-occur to suppress IT-runbook false positives.
Detects Cuit Cuil patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Documento Nacional de Identidad patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Argentine passport numbers issued by the Registro Nacional de las Personas (RENAPER). Since the 2012 biometric passport series, every booklet carries a unique alphanumeric number of exactly three uppercase letters followed by six digits (e.g. AAC382190). The number is independent of the holder's DNI. Special three-letter series are reserved for travel documents issued to stateless persons (ZZA) and refugees (ZZX) under RENAPER Disposicion 904/2021.
Detects Austria driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Personalausweis patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Austria passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Sozialversicherungsnummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Austria Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Australian Financial Services Licence (AFSL) numbers issued by ASIC to authorised financial services providers.
Detects ASIC registered agent numbers used by agents who lodge company documents with the Australian Securities and Investments Commission. The number is a short (typically 3-6 digit) identifier issued to a registered agent and quoted on ASIC forms and lodgements.
Detects Australian Director Identification Numbers (director IDs / DIN) issued by the Australian Business Registry Services (ABRS). A director ID is a 15-digit number beginning with Australia's ISO 3166 country code 036, followed by an 11-digit unique identifier and a single check digit, often written with spaces or hyphens between groups.
Detects candidate Centrelink Customer Reference Numbers consisting of 9 digits followed by a letter. The bare shape is not unique and requires a CRN/Centrelink label for enforcement.
Detects Australian Citizenship Certificate number patterns including prefixed formats (ACC, CDM, ACS, CAS followed by 4-8 digits) and numeric-only formats (0 + 10 digits).
Detects Australian Company Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects populated compliance assessment and audit reports: the report title (compliance assessment / audit / review report, regulatory compliance assessment, gap analysis report) together with populated finding, control, status, rating and remediation fields.
Detects client, tenant, patient or customer case records that record a disclosure of domestic and family violence (DFV): case notes, intake assessments, service referrals and payment applications that name or number an individual and state that they have disclosed, experienced, fled or are at risk of DFV, coercive control or intimate partner violence. Sector-neutral: the same shape appears in housing, human services, health, education, justice and Commonwealth support records (Leaving Violence Program, the legacy Escaping Violence Payment, and Crisis Payment for extreme circumstances family and domestic violence). Also covers information-sharing requests and disclosures under Part 5A of the Domestic and Family Violence Protection Act 2012 (Qld) - s 169D (assessing a domestic violence threat), s 169E (responding to a serious domestic violence threat) and s 169F (police referral to a specialist DFV service provider) - made or received by prescribed entities (for example state schools, Hospital and Health Services, housing, corrections and police) and specialist DFV service providers, when the record names the requesting or disclosing entity, the person at risk or the person using violence, the information shared, the reason and the date. The Department of Education's Part 5A Instrument of Authorisation, which quotes s 169D verbatim, and the DFV Information Sharing Guidelines are decoys.
Detects records that disclose where a person at risk of domestic and family violence (DFV) is living or sheltering: refuge, shelter, safe house and crisis accommodation addresses, addresses flagged as confidential, suppressed or not to be disclosed, and silent elector entries. This is the highest-harm DFV disclosure, because it tells a person using violence where to find the victim-survivor. Sector-neutral: it applies to housing, human services, health, education, court, police, electoral and payroll records.
Detects charge sheets, court briefs, court lists, criminal histories and corrections records for domestic and family violence offences against an identified person: Queensland coercive control (Criminal Code s334C, from 26 May 2025) and engaging in domestic violence to aid a respondent (s179A); NSW abusive behaviour towards current or former intimate partners (Crimes Act s54D, from 1 July 2024); Tasmanian persistent family violence (Criminal Code s170A), economic abuse and emotional abuse or intimidation (Family Violence Act 2004 ss8-9); SA coercive control (Criminal Law Consolidation Act s20C, not yet proclaimed); contraventions of protection, intervention and restraining orders in every jurisdiction; and "domestic violence offence" notations (Qld Criminal Code s1 and Penalties and Sentences Act s12A; NSW Crimes (Domestic and Personal Violence) Act s12).
Detects police domestic and family violence (DFV) incident records and the referrals police send to specialist and government services: Queensland QPRIME DV occurrences, Victoria Police L17 Family Violence Reports, NSW DV events, and DFV incident, call-out and attendance records in other jurisdictions. These records travel beyond police to housing, child safety, health, education and specialist DFV services, so they turn up in general agency mailboxes and file shares.
Detects domestic and family violence protection orders, police-issued notices and directions, and applications for them, in every Australian jurisdiction, when the document names the parties. Covers Qld protection orders, temporary protection orders, Police Protection Notices and Police Protection Directions; NSW apprehended domestic violence orders (including provisional orders); Vic family violence intervention orders and family violence safety notices; WA family violence restraining orders; SA intervention orders; Tas police family violence orders and family violence orders; ACT family violence orders (interim and after-hours); NT domestic violence orders; and recognised DVOs under the National Domestic Violence Order Scheme. Complements the Queensland-specific domestic-violence-order-application classifier.
Detects completed domestic and family violence (DFV) risk assessments, safety plans and multi-agency risk meeting records for an identified person, across Australian frameworks: Qld Common Risk and Safety Framework (CRASF), QPS Domestic Violence Protective Assessment Framework (DV-PAF) and High Risk Teams; NSW Domestic Violence Safety Assessment Tool (DVSAT) and Safety Action Meetings; Vic MARAM; WA CRARMF; SA and NT Family Safety Framework meetings and Positive Action Plans; NT RAMF Common Risk Assessment Tool; and generic DFV risk assessments and safety plans.
Catalogue reference for the Microsoft Purview built-in Australia Driver's License Number sensitive information type. Microsoft recommends medium confidence (75) for the built-in entity. This YAML-only record supports registry search and discovery without reproducing Microsoft's built-in regular expressions, keyword dictionaries, or XML.
Detects Freedom of Information Act exemption section references (sections 33-38 and 42-47) in Australian government documents. Requires FOI/freedom of information keyword context.
Detects Individual Healthcare Identifier (IHI) patterns. The IHI is a 16-digit number starting with the prefix 800360; the official format carries a Luhn check digit (not enforced here).
Detects the Australian Government OFFICIAL protective marking (PSPF / QGISCF) in both email forms ([SEC=OFFICIAL] subject markings, X-Protective-Marking headers) and visible document banners. Excludes UNOFFICIAL and OFFICIAL: Sensitive (handled by au-marking-sensitive). Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively so the lowercase English word "official" does not trigger.
Detects the Australian Government PROTECTED protective marking (PSPF / QGISCF) in both email and document forms, sweeping up its IMM/caveat variants (Personal-Privacy, Legal-Privilege, Legislative-Secrecy, CABINET, NATIONAL-CABINET). SECRET and TOP SECRET roll up here so they receive at-least-PROTECTED handling. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
Detects the Australian Government SECRET and TOP SECRET security classifications in both email and document forms. Intended to surface content that should not be stored on the platform (these classifications roll up to the PROTECTED label in au-marking-protected for handling, while this SIT flags them for remediation). Matched case-sensitively.
Detects the Australian Government SENSITIVE tier in both email and document forms: Commonwealth OFFICIAL: Sensitive (including its IMM/caveat variants such as Personal-Privacy, Legal-Privilege, Legislative-Secrecy) and the Queensland (QGISCF) standalone SENSITIVE marking. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
Identifies Australian Medicare card numbers (10-11 digits, first digit 2-6). Filters same-digit sequences. Requires corroborative health-scheme keywords for reliable detection.
Detects Australian Medicare card numbers, which are issued to Australian citizens and permanent residents for access to subsidised healthcare under the Medicare system. The number consists of 10 digits: the first digit is between 2 and 6, followed by 8 additional digits and a single check digit. Numbers are commonly formatted as groups of 4-5-1 digits separated by spaces or hyphens.
Detects Medicare Provider Number patterns. An 8-character code consisting of 6 digits, a location character, and a check character. Validated by location and check character sets.
Discovery-only compatibility coverage for Australian driver's licence number candidates across all states and territories. The stable au-motor-vehicle-permit slug is retained for catalogue, collection, workbook, and package compatibility. State and territory enforcement belongs to the eight au-*-driver-licence-number SITs. Microsoft Purview tenants can instead select the free built-in Australia Driver's License Number entity (1cbbc8f5-9216-4392-9eb5-5ac2298d1356); this compatibility pattern is not a custom clone of that built-in.
Detects NDIS Participant Number patterns. A 9-digit number starting with the prefix 43.
NDIS records for a named participant: access requests (Access Request Form, Supporting Evidence Form), NDIS plans and budgets (Core, Capacity Building, Capital supports), plan reassessments, service agreements, support coordination and plan management records.
Detects five implemented Australian standard number-plate shapes for NSW, Victoria, Queensland, South Australia, and Western Australia. It does not validate issuance and excludes personalised plate formats; registration and transport-agency evidence controls enforcement.
Detects PBS Prescriber Number patterns. A 7-digit number whose check digit uses weights [0,5,8,4,2,1], mod 11 (checksum NOT enforced in this regex-only pattern; structural detection only).
Detects Nationally Coordinated Criminal History Check (National Police Check) certificate and application reference numbers issued through the ACIC National Police Checking Service. Matches a police check phrase near a reference / certificate / receipt value that identifies a specific check.
Detects Australian property title and plan references used across state and territory land-title systems, including Lot/DP, Lot/SP, Lot/PS, Lot/LP, Lot/CP, title references, and folio identifiers. Requires land-registry context for enforcing tiers.
Detects Queensland blue card (working with children check) applications, renewals and screening outcomes for a named applicant - blue card application or renewal records, positive or negative notices and exemption cards - when the phrase sits with populated applicant identifiers and application fields.
Detects QLD Bond Loan applications for rental assistance and financial hardship support.
Identifies Queensland building approvals, permits, certifications, development applications and decision notices. Topic phrases are retained for discovery; enforcement requires populated approval-record fields (applicant, property, certifier, decision date, application number), and high confidence adds a second field plus decision or authority context.
Notifications to the Crime and Corruption Commission of suspected corrupt conduct (Crime and Corruption Act 2001 s38), s40 direction assessments and internal corrupt-conduct assessment and investigation records that name the subject officer.
Queensland Corrective Services statutory orders and decisions about a named prisoner: safety orders (including temporary and consecutive), maximum security orders, separate confinement orders, breach of discipline, transfer orders, leave of absence, discharge orders and security classification decisions under the Corrective Services Act 2006.
Council agenda reports, attachments and minutes for business closed to the public under Local Government Regulation 2012 s254J: CEO or staff appointment, discipline or dismissal; rating concessions; commercial negotiations; land acquisition; legal advice and other confidential matters.
Register of interests entries and lodgement forms for a Queensland local government's chief executive officer, senior executive employees, councillor advisors and persons related to them (spouse or dependent), kept under Local Government Regulation 2012 (Qld) ss 289-291 and schedule 5 (shareholdings and controlling interests, executive officer roles, trusts, self managed superannuation funds, land, liabilities, gifts, sponsored travel and other particulars). Unlike a councillor's register, which may be inspected by the public (s 293(1)) and is published as an extract (s 295), these registers are open only to councillors, the CEO and persons permitted by law (s 293(2)-(3)); access must be applied for in writing and logged (s 294), and disclosure outside those persons is an offence (s 297(2)). The public councillor register, its published extracts and councillor declarations in minutes are decoys.
Complaints, assessments, investigations and referrals about councillor conduct handled by the Office of the Independent Assessor (OIA), councils and the Councillor Conduct Tribunal: conduct breaches, misconduct, unsuitable meeting conduct, conflicts of interest and release of confidential information.
Notices ending a tenancy interest because of domestic and family violence (RTA Form 20, R20 for rooming accommodation), bond refunds for people experiencing DFV (Form 4a) and the supporting Domestic and Family Violence Report, identifying the tenant, the rental premises and the evidence of violence.
Detects completed Queensland driver licence application, renewal and replacement forms (Transport and Main Roads, e.g. F3000) containing populated applicant fields.
Post-election elector participation data ("election and elector information") that the Electoral Commission of Queensland releases on request to registered political parties, independent members and, for council elections, councillors: for each elector who voted, their name and address, whether they voted in person, by post or in another way, and the polling booth location (Electoral Act 1992 s 133A; LG Fact Sheet 04). Also marked-roll extracts that record which electors voted. The data may be used only for an election-related purpose (s 133A(6), maximum 200 penalty units) and never includes silent electors (s 133A(5)). Booth-level results, turnout statistics, results by vote type and the fact sheet are decoys.
Extracts and copies of the Queensland electoral roll or a council voters roll: the certified copies and electronic roll data that the Electoral Commission of Queensland (ECQ) must give candidates, registered political parties, members of the Legislative Assembly and local governments (Electoral Act 1992 s 61; Local Government Electoral Act 2011 s 21), and AEC Electoral Roll Access (ERA) data files. The roll holds each elector's surname, given names, address, sex, occupation, date of birth, identifying number and enrolment date (s 58(3); Electoral Regulation 2024 s 3). Only name and address are in the publicly available part (sch 1; Regulation s 5), so a copy that carries date of birth, sex, occupation, enrolment date or an elector ID is restricted information whose misuse is an offence (s 177; Commonwealth Electoral Act 1918 s 91B). Enrolment figures, public inspection guidance, party and candidate registers and fact sheets are decoys.
Completed electoral enrolment and update-of-enrolment forms, and the enrolment transaction records that ECQ and the AEC hold under the joint roll arrangement (Electoral Act 1992 (Qld) s 62). A claim for enrolment carries the elector's name, date of birth, residential, postal and previous addresses, and evidence of identity: an Australian driver's licence number, an Australian passport number, Medicare card details or a citizenship certificate number (Commonwealth Electoral Act 1918 ss 98, 98AA; AEC form ER022ESw_QLD Q2, Q3, Q6 and Q7). Queensland enrolment and provisional enrolment of 16 and 17 year olds run under Electoral Act 1992 ss 65 and 66. Date of birth, sex, occupation and enrolment date are restricted information that is never in the publicly available part of the roll (Electoral Regulation 2024 s 5), and Electoral Act s 33 makes the information confidential in the hands of anyone administering the Act. The "Enrol or update your enrolment" guidance, blank forms and published enrolment figures are decoys.
Detects QLD Government tender documents including procurement evaluations, pricing schedules, and evaluation criteria.
Detects QLD Health clinical handover documents containing patient status, medications, and treatment plans.
Detects Queensland public health medical records - patient files, clinical and health records, discharge summaries, progress notes and ieMR extracts - when the record phrase sits with populated patient identifiers (URN/MRN, name, DOB, Medicare) and clinical record fields.
Detects completed Queensland patient consent records - informed, treatment, surgical and anaesthetic consent forms, advance health directives and enduring power of attorney (health) documents - when the consent phrase sits with populated patient identifiers and consent form fields.
Identifies Queensland heavy-vehicle access permit applications and issued permit records for oversize, overmass, Class 1, B-double, and road-train movements. Queensland topic context is discovery-only; enforcement requires operator, vehicle, route, or access-condition fields, while high confidence also requires a labelled permit/application reference and NHVR authority context.
Detects Queensland home education registration records for a named child - home education registration or provisional registration applications and reports, and exemptions from compulsory schooling - when the phrase sits with populated child/parent identifiers and registration fields.
Detects populated Queensland social / public housing applications and housing register records: a housing application or housing register phrase combined with a named applicant or household member, household income, household size or current address. Phrase-only mentions stay discovery-only.
Completed records under the Queensland Mandatory Notification of Data Breach (MNDB) scheme in chapter 3A of the Information Privacy Act 2009 (Qld), as inserted by the Information Privacy and Other Legislation Amendment Act 2023: the s 51 statement to the Information Commissioner, the s 53 notice to affected individuals, s 52 further information, and entries in the s 72 register of eligible data breaches. The scheme has applied to Queensland government agencies since 1 July 2025 and to local government since 1 July 2026. A populated record names the agency and gives the date of the breach, the type of eligible data breach (unauthorised access, unauthorised disclosure or loss, s 47), the kinds of personal information involved, the number of individuals affected or notified, and the containment and mitigation steps. OIC guidance, the Act, published MNDB statistics and blank templates are decoys. Overlaps with au-data-breach-report, which is framed around the Commonwealth Notifiable Data Breaches scheme (Privacy Act 1988 Part IIIC); Commonwealth NDB signals are excluded from this classifier's enforce tiers.
Detects QLD marine vessel registration documents and operator licence details.
Detects Queensland mental health assessment and involuntary treatment records - psychiatric assessments and evaluations, mental state examinations, examination and treatment authorities, forensic orders, recommendations for assessment and Mental Health Review Tribunal matters - when the phrase sits with populated patient identifiers and assessment fields.
Elector-level records from ECQ's compulsory voting enforcement process: apparent failure to vote notices issued after a State or local government election (Electoral Act 1992 (Qld) s 134), elector responses giving a valid and sufficient reason for not voting or saying that they did vote and giving the details, payment records (s 135), infringement notices for failing to vote (s 186; LGEA 2011 ss 165, 166, 168), and referrals of unpaid notices to the State Penalties Enforcement Registry (SPER). ECQ's published process is apparent failure to vote notice, then infringement notice, then SPER referral. Excuses often disclose health conditions, hospital admissions, disability, bereavement, travel, religious duty (s 186(2)) or family circumstances. The "Do I have to vote?" page, penalty unit value statements, aggregate non-voter statistics and blank response forms are decoys.
Detects Queensland notifiable condition reports - notifiable condition or disease notifications, communicable disease reports and public health notifications made under the Public Health Act 2005 (Qld) - when the phrase sits with populated case identifiers and notification fields.
Parole applications, Parole Board Queensland decisions and parole orders for a named prisoner: court ordered and board ordered parole, exceptional circumstances parole, conditions, show-cause notices and amendment, suspension or cancellation orders.
Elector-level postal and declaration voting records held by ECQ and returning officers: postal vote applications (Electoral Act 1992 (Qld) s 119, which require the address to which ballot papers are to be sent), the record of posted voting papers (s 119(7)), declaration envelope records that are signed and witnessed (ss 117, 119(8)), declaration envelopes for uncertain identity (s 121), the register of special postal voters (s 68; grounds in s 114(2)), and late-vote registers. Silent electors are automatically special postal voters (s 114(2)(b)), so the special postal voter register and dispatch lists hold silent-elector addresses. Declaration envelopes are stored for at least a year (s 136). Local government elections have parallel provisions (LGEA 2011 ss 21A, 79, 81, 82). The ECQ postal voting web page, the declaration envelope count procedure, postal vote statistics and blank forms are decoys.
Tenancy enforcement records for named social housing tenants: Antisocial Behaviour Policy warnings and strikes, Acceptable Behaviour Agreements, Notice to remedy breach (Form 11), Notice to leave (Form 12) and termination and QCAT tenancy applications.
Public interest disclosures under the Public Interest Disclosure Act 2010 (Qld) and the records that identify the discloser: assessments, reprisal risk assessments, referrals to a proper authority and investigation files. Disclosure of a discloser's identity is an offence and exposes them to reprisal.
Case records for access applications under the Right to Information Act 2009 (Qld): the s 24 access application (including the combined Right to Information and Information Privacy Access Application form), s 37 consultation with a relevant third party, and the s 54 decision notice giving reasons, with refusal grounds under s 47(3) - exempt information (s 48, schedule 3) and contrary to public interest information (s 49, schedule 4) - plus internal review (s 80) and external review by the Information Commissioner (s 85). A populated record carries the applicant's name, the application reference, dates received/decided, the documents sought, page counts, third parties consulted, the decision maker and the outcome. Published disclosure logs (s 78A) are public and treated as decoys, as are the Act, OIC/RTI guidance and blank forms. Overlaps with au-foi-exemption-references, which matches Commonwealth FOI Act exemption section references (ss 33-47) and does not cover Queensland schedule 3/4 grounds. India's Right to Information Act 2005 applications are excluded.
Detects Queensland school incident and student behaviour records for a named student - school/student incident reports, behaviour incident records, behaviour support plans and disciplinary absence (suspension/exclusion) records - when the phrase sits with populated student identifiers and incident fields.
Principal decision notices and records to suspend, exclude or cancel the enrolment of a named student at a Queensland state school under the Education (General Provisions) Act 2006 (ss281-283 suspension, charge-related suspension, exclusion, s316 cancellation of enrolment), including the grounds, behaviour and student details.
Records that identify a silent elector: completed AEC silent elector registrations (form ER022ESw_QLD, used for Queensland enrolment under the joint roll arrangement), silent elector registers, roll entries flagged silent, silent enrolment confirmations and special postal voter register entries for silent electors. A silent elector is a person whose address the Electoral Commission of Queensland has kept off the public roll because showing it would put the personal safety of the person or their family at risk (Electoral Act 1992 s 58(5) and sch 1; Commonwealth Electoral Act 1918 s 104, backed by a statutory declaration). Silent electors are automatically special postal voters (s 114(2)(b)), and council voters rolls must omit their address (LGEA s 19(2)). Nomination form guidance, fact sheets, AEC guidance, blank forms, legislation and news are decoys.
Applications for social housing and supporting records for a named household: Application for Social Housing, additional applicants, medical report (PH068), support statement (PH076), change of tenancy request (PH058), changes to household (PH127), transfer and mutual exchange applications, and Housing Service Centre assessments of housing need.
Detects special education and special needs learning plans for a named student - personalised learning plans, individual curriculum/education/support plans, Education Adjustment Program profiles and student support plans with disability, adjustment and goal details - when the plan phrase sits with populated student identifiers and plan fields.
Detects completed Queensland student enrolment forms and applications - student, school or prep enrolment forms, applications for enrolment and SEF-1 records with child and family details - when the phrase sits with populated student identifiers and enrolment fields.
Identifies Queensland vehicle registration application, transfer, renewal, and certificate forms. Queensland form topics are discovery-only; enforcement requires multiple registration-record fields, while high confidence also requires an official F3518/F3520 form number and a populated VIN, registration-number, or plate-number field.
Completed applications for financial assistance under the Victims of Crime Assistance Act 2009 (Qld) ss 51-52, made on the Victim Assist Queensland "Financial Assistance Application Form: Primary victim" (Form 1, Version 5, effective 14 September 2023) or recorded in Victim Assist case files: the primary victim's name and date of birth, the act of violence (what happened, key dates, offender name), police report details (reference number, station, investigating officer) or special primary victim report details (for example a domestic violence worker), injuries, recognition payment (special assistance) and recovery expense claims, and safe contact arrangements. Acts of violence include domestic and family violence, sexual offences and child abuse. The blank form, qld.gov.au application guidance and media coverage are decoys.
Identifies SOCI Act, critical infrastructure resilience and AESCSF compliance or maturity assessments that record an entity's own results. Assessment titles alone are discovery-only; enforcement requires AESCSF practice IDs, maturity indicator levels or security profiles, or populated compliance status rows. CIRMP records and reports are handled by au-soci-risk-management-program-record.
Documents that are "relevant information" under s 5A of the Security of Critical Infrastructure Act 2018 (Cth): a critical infrastructure risk management program (CIRMP, s 30AC) and the annual CIRMP report (s 30AG: up-to-date statement for a financial year, board or governing body approval, hazards with a significant relevant impact; LIN 23/006 and LIN 26/075 terms), Register of Critical Infrastructure Assets submissions (s 6 interest and control information, s 7 operational information), and Systems of National Significance enhanced cyber security obligation documents (incident response plan s 30CD, cyber security exercise evaluation reports s 30CQ / 30CR, vulnerability assessment report s 30CZ, system information reporting notices s 30DB / 30DC). There is no statutory marking for this material, so the classifier does not anchor on "PROTECTED" or any other label.
Specialist Homelessness Services (SHS) client records and SHS collection extracts for named or linkable clients: homelessness status, reasons for seeking assistance, services provided and the statistical linkage key (SLK-581) built from name, date of birth and sex.
Identifies Australian Tax File Numbers (TFNs) — unique nine-digit identifiers issued by the Australian Taxation Office. Uses an inline mod-11 Checksum validator with AllDigitsSameFilter and TextMatchFilter to exclude known test values.
Identifies documents containing references to legal full name in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to social security number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to taxpayer identification number in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to lawful intercept transcripts in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies candidate Australian passport numbers using a broad one- or two-letter prefix followed by seven digits. The regex does not validate an issued passport series; Australian travel-document and issuing-nation evidence are required for enforcement.
Detects Unique Student Identifier (USI) patterns. A 10-character alphanumeric code (uppercase letters and digits) mandatory since January 2023 for higher education in Australia. The Purview design inventories the broad bare shape at 65, enforces a labelled value in education context at 75, and reserves 85 for labelled values with authoritative USI/VET record context.
Detects Working With Children Check (WWCC) clearance numbers across Australian states. Covers the NSW structural format (WWC + 7 digits + check letter, e.g. WWC1234567E) and the labelled VIC / WA / generic forms where a WWCC or working-with-children phrase precedes a card or clearance number. The Queensland Blue Card is handled by a separate classifier.
Detects Azure App Service deployment passwords in configuration files and publish profiles. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Batch account shared access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Bot Framework secret key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Bot Service application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cognitive Search (AI Search) API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cognitive Services subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Container Registry (ACR) access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cosmos DB account access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Databricks personal access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DevOps application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DevOps personal access token (PAT) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DocumentDB (now Cosmos DB) authentication key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) client access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) client secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) user credential patterns including username/password combinations targeting Microsoft login endpoints. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Event Grid access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Functions master key and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IaaS database and Azure SQL connection string patterns containing credentials. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IoT Hub connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IoT Hub shared access key patterns outside of connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Logic App shared access signature (SAS) URL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Machine Learning web service API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Maps subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure publish settings file password patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cache for Redis connection string password patterns extracted from connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cache for Redis connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure shared access key and webhook token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SignalR Service access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SQL Database connection string patterns specifically targeting the .database.windows.net domain. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage account access key patterns in connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects generic Azure Storage account key patterns including keys assigned to variables or configuration properties. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage account key patterns outside of full connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Account Shared Access Signature (SAS) patterns for high-risk resources with write or delete permissions. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Account Shared Access Signature (SAS) patterns for standard resources. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure subscription management certificate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects bail condition documents including bail undertakings, surety arrangements, and conditions imposed on accused persons under the Bail Act 1980 (Qld). These documents contain personal details of accused persons, reporting obligations, curfew details, exclusion zones, and no-contact conditions.
Detects government bank account details (BSB + account number) combined with payment authorisation credentials, approval tokens, or signing authorities that together enable the initiation of payments.
Detects Belgium driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Rijksregisternummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Belgium passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Bulgaria driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Bulgaria passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Единен граждански номер (ЕГН) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Brazilian driver licence numbers (CNH - Carteira Nacional de Habilitação). The CNH register number is 11 digits. Structural detection alone is ambiguous with CPF length, so corroborative CNH keywords are required for reliable use.
Detects CNPJ patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects CPF patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Registro Geral patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Canada Revenue Agency (CRA) Business Numbers (BN). The core BN is nine digits assigned to a business. Program accounts append a two-letter program identifier (RC, RM, RP, or RT) and a four-digit reference, for example 123456789RC0001 for a corporate income-tax account.
Detects Canada driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Canada Health Service Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Government of Canada protective markings under the Treasury Board Standard on Security Categorization (Appendix J of the Directive on Security Management): the Canada-distinctive "Protected" designations Protected A / Protected B / Protected C (information whose compromise could injure interests outside the national interest), and the classified levels Confidential / Secret / Top Secret (injury to the national interest). "Protected A/B/C" is unique to Canada and matched at high confidence in both title-case and ALL-CAPS renderings; the classified words are shared vocabulary with other nations and are matched only at lower, Canada-government-context-gated tiers. Rendering verified directly against the Treasury Board Standard on Security Categorization; matched case-sensitively.
Detects Ontario Health Insurance Plan (OHIP) numbers: 10 digits often grouped 4-3-3 with a two-letter version code.
Detects Canada passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Canada Personal Health Identification Number (PHIN) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects North American Numbering Plan (NANP) telephone numbers in Canadian contexts: the domestic NPA-NXX-XXXX form (bracketed, hyphenated, dotted, spaced, or bare, with an optional leading trunk "1") and the international +1 NPA-NXX-XXXX form. Area-code (NPA) and exchange-code (NXX) groups are constrained to a leading digit of 2-9 with the N11 service-code shape (211/311/411/511/611/711/811/911) excluded from both groups, per NANPA's published format rules. This pattern is structurally identical to us-phone-number because NANP area codes are drawn from a single pool shared by the US, Canada, and Caribbean member territories — the digit sequence itself cannot distinguish a Canadian number from a US one. This is the sibling of us-phone-number; the two are differentiated by jurisdiction/regulation metadata and country-specific corroborative evidence keywords only, not by regex — see us-phone-number's description for the documented family convention.
Detects SIN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects financial submissions to the QLD Cabinet Budget Review Committee (CBRC) containing agency funding bids, savings proposals, capital expenditure requests, and fiscal strategy options.
Detects legal annexures to Cabinet submissions containing privileged legal analysis supporting Cabinet decision-making. These documents carry dual protection: Cabinet confidentiality (Westminster convention) and legal professional privilege. Disclosure breaches both simultaneously with no remediation possible.
Detects draft monetary policy decisions and pre-announcement rate recommendations: a rate value (percentage, basis points or per cent) near a central bank / Reserve Bank reference and a recommendation line proposing a rate action. Published RBA statements, media commentary and forecasts are excluded.
Detects Swiss passport numbers issued by fedpol (Federal Office of Police). Passports of the 2003, 2006 and 2010 series carry an eight-character number consisting of one uppercase letter followed by seven digits (e.g. E1234567); the 2010 series always begins with the letter X. The letters O and I are never used, to avoid confusion with the digits 0 and 1. The 2022 series (the only series issued since October 2022) has no published fixed structure — fedpol deliberately keeps the numbering rules non-public — so 2022-series numbers may not match this shape. Only the documented 2010-and-earlier format is covered.
Detects AHV-Nummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects documents containing child exploitation investigation case files including victim identification data, offender network intelligence, and investigative techniques used against CSAM distribution networks. QPS Task Force Argos is the primary Queensland unit. Disclosure re-victimises children and compromises active rescue operations.
Detects child safety investigation case files containing child identifiers, harm notifications, investigation outcomes, child protection orders, and out-of-home care placements under the Child Protection Act 1999 (Qld). These files contain highly sensitive information about vulnerable children including substantiated abuse details — unauthorised disclosure endangers child safety and compromises ongoing investigations.
Detects RUT patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects defence strategy documents for class action proceedings against the State or State entities. These documents reveal the State's vulnerability assessment and defence approach for claims potentially affecting thousands of claimants. Note: trainable classifier recommended for production using class action document structural features.
Detects People's Republic of China passport numbers. The current ordinary (e-)passport uses an 'E' prefix followed by one letter (excluding I and O) and 7 digits, or 'E' plus 8 digits. Older series use a 'G' prefix plus 8 digits, and earlier passports used 'P', 'D' (diplomatic) or 'S' (service) prefixes plus 8 digits. The short, loosely structured format means corroborative keyword proximity is strongly recommended.
Detects Resident Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Mainland China Unified Social Credit Codes (统一社会信用代码) assigned to legal persons and other organisations. The code is 18 characters using a restricted alphabet (digits and selected letters excluding I, O, Z, S, V), with an embedded administrative division code in positions 3-8.
Detects Cédula de Ciudadanía patterns. Detects this pattern using regex with corroborative keyword evidence.
Detects Colombia Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects draft legal submissions to Commissions of Inquiry established under the Commissions of Inquiry Act 1950 (Qld). Disclosure prejudices the State's participation and may breach statutory confidentiality.
Detects community-based corrections orders including probation orders, parole conditions, and community service orders issued under the Corrective Services Act 2006 (Qld). These documents contain offender details, supervision conditions, approved addresses, and compliance assessments by Queensland Corrective Services.
Detects documents containing the identities of police informants (confidential human sources, confidential / registered informants, registered sources) embedded within criminal organisations. Informant identity is the single most sensitive category of law enforcement information globally. Disclosure has historically resulted in murders and creates immediate lethal risk. Absorbs the former confidential-informant-identities classifier.
Detects financial models for mergers, acquisitions, or divestments containing actual valuations, synergy estimates, deal structures, and price ranges. Disclosure constitutes insider information under securities law.
Detects controlled operation authorisations under PPRA 2000 (Qld) Part 5. Controlled operations involve officers in criminal activity under legal authority. Disclosure reveals officers and operational scope.
Detects published coronial findings and recommendations under the Coroners Act 2003 (Qld). Although coronial findings are public documents, they contain sensitive details about the circumstances and cause of death, manner of death, and identity of deceased persons. Government agencies handling these documents should classify them as SENSITIVE Legal due to the distressing nature of the content.
Detects draft government submissions to coronial inquests before filing. These submissions address deaths in government settings (custody, hospitals, child safety) and reveal the State's candid position on systemic failures before formal filing.
Detects pre-publication coronial investigation files including evidence, witness statements, and draft findings. Published coronial findings are SENS_Law, not PROT_Law.
Detects documents containing prison intelligence reports including gang assessments, inmate risk ratings, informant identities within correctional facilities, and security threat group (STG) analyses. Disclosure endangers correctional staff, informant inmates, and undermines facility security.
Detects documents containing terrorism threat assessments, persons of interest profiles, and counter-terrorism operational capabilities. Disclosure enables counter-surveillance by terrorist subjects and compromises national security monitoring. Includes JCTT (Joint Counter Terrorism Team) and QPS Security and Counter-Terrorism Group documents.
Detects court filing references from Queensland courts (Magistrates Court, District Court, Supreme Court) containing proceeding numbers, party names, and registry details. Unpublished filings contain personal details of parties, allegations, and evidence that are not yet in the public domain.
Detects documents containing the true identities of undercover law enforcement officers deployed within criminal organisations. These records link assumed identities (legends) to real identities and are among the most life-critical records in law enforcement. Disclosure directly endangers the lives of deployed operatives and destroys years of infiltration work.
Detects documents containing intelligence shared between Australian and international law enforcement agencies under formal exchange agreements. Disclosure damages international trust relationships, violates originator control (ORCON) principles, and compromises joint operations.
Detects privileged legal opinions issued by the Queensland Crown Solicitor or Office of the Crown Solicitor. These documents constitute the highest level of legal professional privilege in Queensland Government and their disclosure permanently waives privilege under Evidence Act 1977 (Qld) s.14.
Detects Cyprus driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Δελτίο Ταυτότητας patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Cyprus passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Cyprus Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects cybercrime investigation technical evidence including digital forensics, malware analysis, cryptocurrency tracing, dark web investigations, and covert online personas. Disclosure enables cybercriminals to develop countermeasures.
Detects Czech driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Czech Republic passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Rodné číslo patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects German driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Personalausweis patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects German passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects German mobile telephone numbers per the Bundesnetzagentur's (BNetzA) Nummernplan für Mobile Dienste: the (0)15, (0)16, and (0)17 mobile sub-ranges, in both the domestic (leading trunk "0") and international (+49, leading 0 dropped) forms. BNetzA's own published length table shows the national significant number (the digits after the leading 0, including the "1" of "15/16/17") is 10 digits for most 016x/017x allocations and 11 digits for the 015x range and the 1609/176 exceptions — every quantifier below is bounded to this documented 10-11 digit span rather than left open-ended. The 10-11 bound is applied as a single envelope across all three ranges (the regex cannot pin 015x to exactly 11 and non-exception 016x/017x to exactly 10 without per-sub-range length alternation), so a 10-digit 015x or an 11-digit non-exception 016x/017x rendering is accepted — a deliberate, documented over-acceptance kept small by the envelope itself. Beyond the DIN 5008:2020 space-grouped form, two widespread legacy DIN 5008 renderings of the mobile prefix are covered: the slash form "0171/3920045" and the parenthesised form "(0171) 3920045" — both deprecated by the current DIN 5008 (which prescribes plain space grouping) but still common in signatures and letterheads — plus the "+49 (0)171 ..." letterhead form (nonstandard per ITU-T E.123, but ubiquitous). Geographic (Ortsnetz) landline numbers are intentionally out of scope (so the landline renderings "030/12345678" and "(030) 12345678" are likewise not matched): BNetzA states area codes run 2-5 digits and new allocations are capped at 11 significant digits (10 for the Berlin/Hamburg/Frankfurt/Munich two-digit-code exception), but does not publish a verified minimum length for the existing stock of legacy numbers, so a low-end bound would be invented rather than sourced — mirroring in-phone-number's decision to scope out India's similarly under-specified STD/landline numbers.
Detects Steuer Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Denmark driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Denmark passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects CPR-nummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects domestic violence order applications and conditions under the Domestic and Family Violence Protection Act 2012 (Qld). These documents contain details of aggrieved persons, respondent details, allegations of domestic violence, ouster conditions, and protection order terms. Disclosure could endanger the aggrieved person.
Detects donor conception records including donor identity information, recipient details, offspring matching, and assisted reproductive technology treatment records under the Status of Children Act 1978 (Qld). These records contain the most sensitive reproductive information — donor identities, recipient medical details, and biological parentage links. Unauthorised disclosure can permanently alter family relationships and breach legal confidentiality protections.
Detects documents containing drug trafficking investigation intelligence including targets, supply chain mapping, precursor chemical tracking, clandestine laboratory intelligence, and cross-border interdiction plans. QPS Drug and Serious Crime Group is the primary unit. Disclosure enables traffickers to destroy evidence, alter supply routes, and eliminate informants.
Detects Cédula de Identidad patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Estonia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Estonia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Isikukood patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects DNI patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Spain driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects NIE patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Spain passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Spanish national telephone numbers per Spain's closed 9-digit numbering plan (Plan Nacional de Numeración Telefónica, administered under CNMC oversight): mobile numbers (segment N=6 in full, plus N=7 partially opened for mobile use in the 71/72/73/74 sub-ranges by the SETSI Resolución de 12 de marzo de 2010, BOE-A-2010-5251; the first 7-prefixed mobile numbers entered service from late 2010/2011 once the then-regulator CMT assigned the new ranges to operators) and geographic numbers (leading 8 or 9, with the second digit constrained to never be 0 — a constraint that incidentally excludes the 900/901/902/905 toll-free and premium-rate service ranges, whose second digit is 0). Spain has no domestic trunk prefix, so the +34 international form carries the same 9 significant digits as the domestic form, just with the +34 prefix in place of nothing.
Detects Número de la Seguridad Social patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Spain Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects deployer-side fundamental rights impact assessments (FRIA) under Article 27 of the EU AI Act (Regulation (EU) 2024/1689). A FRIA is performed before deploying certain high-risk AI systems by public bodies, private providers of public services, and deployers of credit-scoring and life/health-insurance pricing systems (Annex III points 5(b) and (c)). Completed FRIAs contain candid assessments of risks of harm to specific categories of natural persons and are sensitive before notification and remediation.
Detects Article 11 / Annex IV technical documentation for high-risk AI systems under the EU AI Act (Regulation (EU) 2024/1689). This documentation must demonstrate compliance of the high-risk AI system before placing on the market and contains commercially sensitive material — system architecture, design specifications, training-data datasheets, risk management findings, and known limitations — whose uncontrolled disclosure exposes trade secrets and the provider's compliance posture.
Detects EU driver's license number patterns across all EU member states. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects European Union Classified Information (EUCI) protective markings as defined in Article 2(2) of Council Decision 2013/488/EU: the four bilingual French/English classification levels rendered together as a single marking — RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET and TRÈS SECRET UE/EU TOP SECRET (the slash carries no surrounding spaces and TRÈS carries a grave accent, per the primary source). Named historically for RESTREINT but scopes the full EUCI ladder. The single-language French components (RESTREINT UE, CONFIDENTIEL UE, SECRET UE, TRÈS SECRET UE) are matched at a lower tier. Marking syntax verified directly against the Council Decision text; matched case-sensitively.
Detects references to EU National Identification Number using keyword matching. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects EU passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation. This is a broad, multi-country SIT that aggregates passport number detection across EU member states.
Detects references to EU Social Security Number (SSN) or Equivalent ID using keyword matching. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects EU Tax Identification Number (TIN) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. EU TIN formats vary by member state; this keyword list provides tax-related terminology for supplementary matching across EU jurisdictions.
Detects EU VAT identification numbers for all 27 member states in a single consolidated pattern, built branch-by-branch from the per-country structures published in the European Commission VIES FAQ (Q11). Covers the Greek quirk (Greece prefixes with EL, not GR) and Northern Ireland's XI prefix, which remains checkable in VIES for goods traders under the Windsor Framework — XI is included with the UK 9-digit, 12-digit and GD/HA government/health-authority forms; plain GB numbers are NOT included because Great Britain left the VIES scheme after Brexit. This pattern is a superset alongside the existing per-country detectors (at/be/de/fr/hu/it-vat-number), which stay untouched for deployed-GUID stability — the same document may fire both, following the global-iban / eu-iban precedent.
Detects Finland driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Finland European Health Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Henkilötunnus (HETU) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Finland passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects forensic evidence and chain-of-custody records for active criminal or security investigations, including exhibit registers, DNA/fingerprint/ballistics results, custody handovers, and formal chain-of-custody documentation.
Detects France driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects France Health Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Carte Nationale d'Identité patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects NIR Insee patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects France passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects French national telephone numbers per ARCEP's numbering plan: 10-digit numbers in the "0X XX XX XX XX" form covering geographic (01-05), mobile/personal (06-07), and polyvalent (09) leading digits, plus the +33 international form (10-digit domestic number with the leading 0 dropped, per ARCEP convention), including the widespread "+33 (0)6 39 98 45 67" letterhead rendering (a common-but-nonstandard practice — ITU-T E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous on French letterheads and email signatures, so it is matched for detection purposes). The 09 polyvalent range is in scope because it is predominantly personal PII in practice: 09 is the standard residential VoIP home-line range, auto-issued with consumer internet boxes to millions of French households; only the small 0937-0939 sub-range carries ARCEP's newer "technical platform" category (app-to-driver ephemeral numbers and similar). Numbers beginning 08 (value-added services) remain intentionally out of scope — organizational/service numbers rather than personal PII, mirroring how uk-phone-number scopes out non-geographic service ranges.
Detects France Tax Identification Number (numéro SPI.) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects medical records related to gender transition including hormone therapy prescriptions, surgical records, gender identity assessments, change of sex descriptor applications, and recognised sex certificates under Queensland law. These records reveal deeply personal information about gender identity that is subject to anti-discrimination protections — disclosure can cause severe harm including discrimination, harassment, and violence.
Detects documents containing genetic or genomic test results linked to identifiable patients, including pathogenic variant findings, hereditary risk assessments, and pharmacogenomic reports. Genetic data reveals predisposition to diseases, carrier status, and family lineage — disclosure enables genetic discrimination in insurance, employment, and relationships.
Detects Australian Health Practitioner Regulation Agency (AHPRA) registration numbers used to identify registered health practitioners across 16 professions.
Detects documents containing credential-related terminology. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based bundled detector that aggregates multiple credential SITs. This keyword-based version flags documents that may contain credentials for further review.
Detects All Medical Terms And Conditions patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects ASP.NET Machine Key patterns in configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects AWS Secret Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Binance API keys, which are 64-character case-sensitive alphanumeric strings with no distinctive prefix. Because a bare 64-char alphanumeric token is generic (it collides with any random token of that length), this pattern is context-gated: it requires a nearby Binance label and an assignment (= or :) before the value. A leaked key grants API access to the account (trading and, if enabled, withdrawal).
Detects date-of-birth references across common date formats (numeric slash/dot/hyphen, written month, ISO) when birth-record labels or personal-record context are present. Covers Australian and global document styles; business dates (invoice, due, expiry) and template samples are suppressed.
Detects Blood Test Terms patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects populated board papers and board resolutions: a board paper / board memorandum / board resolution phrase combined with populated paper metadata (paper number, agenda item, meeting date), a named author or sponsor, or a formal 'That the Board...' recommendation. Phrase-only mentions stay discovery-only.
Detects Brand Medication Names patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects budget proposals, financial forecasts, and expenditure planning documents.
Identifies substantive Australian federal and state Cabinet submissions, memoranda, approval papers, and Cabinet briefs, briefing notes and briefing books. Topic phrases are retained for discovery; enforcement requires purpose, recommendation, financial, consultation, implementation, risk, regulatory, key-issues, talking-points or decision-sought sections, and high confidence also requires a formal Cabinet marking, minute, decision, or submission identifier. Absorbed global-top500-492-cabinet-briefing-books (2026-09-24).
Detects documents containing client secret and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad bundled detector. This keyword-based version flags documents that may contain client secrets or API keys for further review.
Detects Coinbase Developer Platform (CDP) API key names, which use the distinctive resource-path form organizations/{org-uuid}/apiKeys/{key-uuid}. This key name is paired with an EC/ECDSA (or Ed25519) signing secret and is used to mint ES256 JWTs for the Coinbase API. A leaked CDP key can grant programmatic access to accounts, trading and funds. The associated EC PRIVATE KEY PEM secret is detected separately by global-ec-private.
Detects Diseases patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects Department of Veterans' Affairs (DVA) file numbers used to identify Australian veterans and eligible dependants for health and support services.
Detects GCP Api Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects general password patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain passwords for further review.
Detects general symmetric encryption key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain symmetric keys for further review.
Detects Generic Medication Names patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects GitHub Fine-Grained PAT patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Github Pat patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects GitLab deploy tokens (gldt- prefix). Deploy tokens grant read/write access to a project's repository, container registry and package registry; a leak enables artifact theft or tampering.
Detects HTTP Authorization header patterns containing Bearer tokens, Basic credentials, and other authentication schemes. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects ICD-10 Cm patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects International Classification of Diseases (ICD-9-CM) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Lab Test Terms patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects ISO 17442 Legal Entity Identifiers (LEIs) — the 20-character uppercase alphanumeric codes issued under the Global LEI System (GLEIF) that uniquely identify legal entities in financial transactions. Structure: characters 1-4 are the LEI-issuer (LOU) prefix, characters 5-6 are reserved and set to "00", characters 7-18 are the entity-specific part, and characters 19-20 are numeric check digits (ISO 7064 MOD 97-10). Requiring the literal "00" at positions 5-6 and two digits at positions 19-20 makes the format far more distinctive than a generic 20-character alphanumeric run. Known recall cost: pre-2013 CICI-era legacy LEIs — interim identifiers issued before the "00" reservation, grandfathered into the GLEIF system and still live and checksum-valid — do not carry "00" at positions 5-6 and are NOT matched. This class includes major counterparties such as Microsoft (INR2EJN1ERAN0W5ZP974), Deutsche Bank (7LTWFZYICNSX8D621K86) and Apple (HWUPKR0MPOU8FGXBT394), so documents dealing with such entities' LEIs will be missed. This is a deliberate precision-over-recall trade-off: dropping the "00" anchor would widen the pattern to any 20-character uppercase alphanumeric run ending in two digits.
Detects Lifestyles That Relate To Medical Conditions patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects Medical Specialties patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects Microsoft Bing Maps API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Identifies substantive Australian ministerial, Director-General, secretary, and executive briefing documents. Topic phrases are retained for discovery; enforcement requires issue, recommendation, option, risk, financial, stakeholder, communications, decision, or implementation content, and high confidence also requires a formal brief reference or decision/approval signal.
Detects bounded npm access-token values (npm_ prefix, fixed 36-character body) and credential-bearing .npmrc authToken assignments; documentation and placeholder examples remain excluded. These tokens authenticate to the npm registry and can publish, unpublish or grant access to packages; a leak enables supply-chain attacks via malicious publishes.
Detects Okta API-token candidates, which begin with 00 and are followed by 40 base64url characters. Okta or SSWS context is required for enforcement because the 42-character shape can represent unrelated identifiers; the bare value shape surfaces only as discovery inventory. A leaked token grants Okta admin API access.
Identifies populated Australian question-time briefs (QTB), Senate Estimates briefs, parliamentary question responses and parliamentary correspondence briefs: the brief type together with populated brief header fields (Minister, portfolio, issue, division, contact officer, cleared by, date, question or brief number).
Detects the Machine-Readable Zone (MRZ) of an ICAO 9303 travel document, the OCR-B text printed at the bottom of passport data pages and scanned at border control. This pattern focuses on the TD3 passport format (two lines of 44 characters): line 1 begins 'P' + document subtype + 3-letter issuing state + the holder's names, and line 2 packs the document number, check digits, nationality, date of birth, sex and expiry. MRZ leakage via scans, photocopies and OCR exports is one of the highest-value passport data exposure vectors because it concentrates every identity field in a single fixed-width block.
Detects international telephone numbers in ITU-T E.164 form: a leading "+" (the international prefix symbol defined by ITU-T E.123, the companion notation recommendation) followed by a country code and national significant number totalling no more than 15 digits, per E.164's own numbering-space limit (country code 1-3 digits, subscriber number up to 12 digits, 15 digits maximum overall). This pattern covers only the "+"-prefixed international representation — it is the global counterpart to the country-specific domestic-format patterns (us-phone-number, ca-phone-number, uk-phone-number, in-phone-number, and the EU national patterns), which additionally match each country's bare domestic formatting conventions. Real-world renderings commonly use spaces or hyphens between digit groups even though E.123 formally prescribes spaces only; both are accepted here. The "+CC (0)..." letterhead rendering (e.g. "+44 (0)20 7946 0958") is deliberately NOT matched by this pattern: it is not an E.164 representation (E.123 explicitly advises against the parenthesised trunk digit in international notation), and the country-specific patterns whose plans actually use a trunk 0 (uk/de/fr/nl) each cover it themselves — keeping this global pattern strictly E.164-shaped.
Detects Slack Token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Snowflake OAuth access and refresh tokens, which carry the recognizable ver:1-hint: / ver:2-hint: prefix used by Snowflake authentication. These tokens (and programmatic access tokens used in their place) grant query and data access to a Snowflake account.
Detects SQL Server patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Surgical Procedures patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Identifies personal records that link a person to previous legal names or aliases (former, maiden, birth or assumed names, deed-poll name changes, also-known-as entries) with populated identity fields.
Identifies documents containing references to biometric identifiers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to handwritten signatures in Australian contexts. This remains a concept detector over manual/wet/ink/specimen signature wording — it does not inspect handwriting pixels or capture a signature image. Bare "signed by" attribution (common in electronic/typed signature text) is corroborating evidence only, not a primary indicator.
Identifies documents containing references to marital status in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to gender or sex marker in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to disability status in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to genetic data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies records about a deceased person that carry cultural-sensitivity handling requirements (for example Aboriginal and Torres Strait Islander name and image restrictions): a deceased-person record with populated person fields and explicit cultural-protocol evidence.
Identifies documents containing references to birth certificate number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to death certificate number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to marriage certificate number in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to equity grant details in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects employee payroll bank account details: a payroll/salary account or direct-deposit phrase combined with a BSB, a bank account number or a named employee/payee field. Phrase-only mentions (policies, scam warnings) stay discovery-only.
Detects completed employee tax withholding declarations and elections: ATO Tax file number declaration (NAT 3092) and withholding declaration (NAT 3093), US Form W-4 and UK starter checklist, with the payee identified and a TFN/SSN, residency or tax-free threshold answer, filing status or payer ABN.
Detects completed employer payroll tax and withholding filings: Queensland (state) payroll tax returns and annual reconciliations, PAYG withholding annual reports, Single Touch Payroll pay events/finalisation summaries and US Form 941/940 returns, with populated wage/withholding totals and an employer identifier or reporting period.
Detects completed employee tax and superannuation forms: PAYG payment summaries and employee income statements, superannuation standard choice form (NAT 13080), US Form W-2 and UK P60/P45, with the payee identified and TFN/SSN, gross payments or tax withheld amounts, USI/member number, payer ABN or financial year.
Detects completed contractor tax forms and reports: ATO taxable payments annual report (TPAR) rows, PAYG withholding voluntary agreements, statements by a supplier (no-ABN withholding), US Form 1099-NEC/W-9 and contractor payment statements, with a named payee plus payment amounts or ABN.
Detects payroll deduction records for an identified employee: deduction authorisations, salary sacrifice agreements, union fee, child support, health fund, workplace giving and novated lease deductions, with the deduction amount.
Detects wage garnishee notices and earnings attachment orders served on an employer for an identified employee: ATO garnishee notices (TAA 1953 Sch 1 s 260-5), Services Australia child support and debt garnishee notices, court attachment of earnings / income withholding orders, with the amount owing or amount to deduct.
Detects superannuation / retirement contribution records for an identified employee or member: SG and salary sacrifice contribution reports, SuperStream contribution files, employer pension contribution schedules and 401(k) contribution records, with contribution amounts.
Detects pension, annuity and retirement income stream account identifiers: a labelled pension/annuity/policy/member number with a populated value, optionally with the account holder name or date of birth.
Detects dependant-related tax credit and family benefit claims for an identified person: Family Tax Benefit claims, dependant (invalid and carer) tax offset claims, US child tax credit / Schedule 8812, with dependant names or dates of birth, number of children or claimed amounts.
Detects employee childcare benefit claims processed through payroll: childcare salary packaging and reimbursement claims, employer-sponsored childcare applications and dependent care FSA reimbursements, with the child or provider details and claimed amounts.
Detects employee expense reimbursement claims: expense claim forms, travel claims and acquittals, mileage and per diem claims and corporate card acquittals for an identified claimant, with itemised or total amounts.
Detects payroll journal postings: pay-run journals, wages journals, payroll accruals and payroll GL exports with populated ledger lines (wages expense, PAYG withholding payable, superannuation payable, net wages payable, payroll clearing) and a journal reference or posting/period date. Aggregate ledger data, capped at 75.
Detects correspondence from a tax authority to an identified taxpayer: ATO notices of (amended) assessment, audit and review letters, QRO notices, IRS CP notices and HMRC letters, with taxpayer identifiers and amounts payable, penalties or response dates.
Detects payroll exception and variance reports that list identified employees: pay run exception reports, payroll variance/error reports and pre-pay-run validation reports with the exception reason or pay amounts.
Detects Australian superannuation identifiers with populated values: USI (unique superannuation identifier), fund member/account numbers, fund or SMSF ABN and SMSF electronic service address (ESA), optionally with the member or employee name.
Detects salary and wage overpayment recovery records for an identified employee: overpayment notifications, recovery letters and repayment agreements, with the overpaid amount, repayment instalments or overpayment period.
Detects off-cycle and ad hoc payroll payment requests and approvals for an identified employee: off-cycle pay requests, manual/special pay runs, final pay and termination pay calculations, with payment amounts or payment date.
Detects compensation arrears and back-pay records for an identified employee: salary/wage arrears calculations, back-pay schedules, underpayment remediation calculations and retrospective pay increases, with arrears amounts or arrears periods.
Detects exported payroll system access and audit logs: timestamped log lines showing a user logging in, viewing, changing or exporting payroll records, with a populated user field. Operational security data, capped at 75.
Detects references to consumer bank account numbers in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to bank routing numbers in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to IBAN and international bank account number topics in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Topic-level phrase detection only; it does not parse or mod-97-validate IBAN values.
Detects references to SWIFT or BIC codes in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level payment-rail concept detection anchored on explicit SWIFT/BIC vocabulary; it does not parse 8- or 11-character BIC values.
Detects references to payment card primary account numbers in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to card verification values in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on explicit card-verification vocabulary; it does not parse 3- or 4-digit CVV values.
Detects references to card expiration dates in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation. Phrase-level concept detection anchored on card-specific expiry vocabulary; it does not parse MM/YY or month-year values.
Detects references to cardholder names linked to accounts in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to mobile payment account ids in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to merchant acquiring credentials in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to direct debit mandate data in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to ach company and originator ids in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to remittance instructions in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to card dispute case records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to wire transfer instructions in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to escrow account details in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to treasury cash position reports in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to cash flow forecast assumptions in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to payment fraud investigation files in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to credit bureau reports in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to credit scores in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to loan application files in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to mortgage underwriting packets in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to collateral valuation reports in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to debt collection records in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to bankruptcy case records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to insurance policy records in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to insurance claim records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to underwriting decision rationales in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to know-your-customer profiles in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to anti-money-laundering alerts in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to suspicious activity reports in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to sanctions screening matches in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to beneficial ownership declarations in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to guarantor identity and financial data in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to loan covenant compliance records in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to reinsurance contract terms in financial and compliance documents. Commonly found in international regulatory filings, transaction records, and audit documentation.
Detects references to premium payment histories in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Detects references to claim settlement negotiation notes in financial and compliance documents. Commonly found in Australian regulatory filings, transaction records, and audit documentation.
Identifies documents containing references to procurement fraud investigation files in international contexts. These are investigative and procurement-sensitive records that may contain personal allegations; the category is not blanket personally identifiable information.
Identifies substantive responses and submissions addressing regulatory, supervisory, prudential, or compliance examinations and findings. Topic phrases are retained for discovery; enforcement requires response, finding, root-cause, remediation, ownership, due-date, evidence, dispute, or control-gap content, and high confidence also requires a formal examination/finding reference or response due date.
Identifies inventories and registers of trade-secret assets — register, inventory-entry, and asset-record structures as well as the topic label — in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
Identifies oauth client secrets patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies references to secrets-vault exports and backups. Product or operation phrases are discovery-only; structured export-record fields support medium confidence and a populated secret entry plus export-manifest metadata supports high.
Identifies grant peer-review comments and assessment records containing substantive reviewer observations, scores, or funding outcomes. Grant-review and application phrases are retained for discovery at 65; populated assessment fields raise confidence to 75, while formal proposal or reviewer references plus an explicit funding outcome raise confidence to 85.
Identifies individual welfare, social-assistance, and income-support eligibility decisions. Topic phrases are retained for discovery; enforcement requires applicant, household, income, dependant, means-test, benefit-category, outcome, review-right, or effective-date fields, and high confidence also requires a formal case/application reference or recorded eligibility decision.
Identifies individual unemployment-benefit, unemployment-insurance, JobSeeker, and re-employment assistance claims and determinations. Topic phrases are retained for discovery; enforcement requires claimant, employer, separation, earnings, job-search, obligation, benefit-period, payment-rate, or sanction fields, and high confidence also requires a formal claim reference or recorded decision.
Identifies documents containing references to public housing assistance files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to foster care placement records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies individual pension entitlement records, benefit calculations, eligibility decisions, and payment determinations. Topic phrases are retained for discovery; enforcement requires member, service, retirement-date, salary, contribution, accrued-benefit, beneficiary, payment-frequency, gross-pension, or commutation fields, and high confidence also requires a formal member/claim reference or recorded entitlement decision.
Identifies individual civil-status and vital-record amendments, including corrections to birth, death, marriage, and legal-name entries. Civil-registry topics are retained for discovery at 65; populated amendment fields raise confidence to 75, while a formal registry reference and personal status fields raise confidence to 85.
Identifies land-title and cadastral ownership records containing populated proprietor, tenure, parcel, legal-description, or encumbrance fields. Land-registry topics are retained for discovery at 65; populated register fields raise confidence to 75, while a formal title or parcel reference plus substantive ownership-interest evidence raise confidence to 85.
Identifies business and trade licence application records, including renewal and variation applications. Topic phrases are retained for discovery; enforcement requires at least two populated applicant, enterprise, premises, activity, or licence fields, and high confidence also requires a formal application, licence, or permit reference.
Identifies building, construction, development/planning, occupancy, and site-operating permit application records across jurisdictions. Topic phrases are discovery-only; enforcement requires multiple application fields, while high confidence also requires a labelled application, permit, case, or file reference plus authority or decision context.
Identifies documents containing references to inspection and enforcement records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to emergency aid request files in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to constituent service case notes in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to forensic dna profile records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies documents containing references to offensive cyber capability documentation in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies matrices that map data or information categories to classification levels and handling controls. Topic phrases are retained for discovery; enforcement requires multiple matrix-column or control headings, and high confidence also requires a populated category-to-classification mapping.
Identifies pre-submission draft responses, reports, and submissions prepared for a regulator or supervisory authority. Topic phrases are retained for discovery; enforcement requires reporting-period, event, proposed-disclosure, affected-record, data-quality, control, corrective-action, legal-review, or outstanding-evidence content, and high confidence also requires approval, submission, clearance, comment, deadline, or regulator-reference workflow evidence.
Identifies documents containing references to election incident response records in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.
Identifies operational government media war-room plans used to coordinate monitoring, rapid response, approvals, rebuttals, and spokesperson activity. War-room plan topics are retained for discovery; enforcement requires independent government-office context and multiple operational workflow elements, and high confidence also requires populated assignments, times, or issue references.
Detects Types Of Medication patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
Detects user login credential patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain login credentials for further review.
Detects X.509 certificate private key PEM headers. This is a broad pattern covering RSA, EC, PKCS#8, and OpenSSH private key formats. This pattern is based on a Microsoft Purview built-in sensitive information type. For more specific detection, see global-rsa-private, global-ec-private, global-pkcs8-private, and global-openssh-private.
Detects internal or QAO (Queensland Audit Office) audit findings identifying material weaknesses in financial controls before public tabling. Disclosure enables exploitation of identified control gaps.
Detects whole-of-government or agency-level insurance coverage schedules, self-insurance reserves, indemnity limits, and excess/deductible structures, and quantified contract liability and insurance schedules (liability caps, limits of liability, required professional indemnity and public liability cover), that reveal the State's financial exposure limits. Absorbed global-top500-178-indemnity-and-liability-schedules (2026-09-24).
Detects sealed pricing schedules submitted by tenderers as part of government procurement processes, held in confidence until evaluation is complete.
Detects internal government revenue projections including tax revenue, royalties, mining/gas receipts, and stamp duty forecasts before public release in budget papers or MYFER.
Detects Greece driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Αστυνομική Ταυτότητα patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Greece passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects ΑΜΚΑ patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Greek Tax identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects internal scoring sheets, panellist rankings, weighted criteria assessments, and funding recommendations for competitive government grant programs before public announcement.
Detects 香港身份證 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Hong Kong Special Administrative Region (HKSAR) passport numbers issued by the Immigration Department under the HKSAR Passports Ordinance (Cap. 539). HKSAR passport numbers are nine characters: the current series is the letter H followed by 8 digits; earlier biometric series used K followed by 8 digits, and KJ (48-page jumbo booklets) followed by 7 digits.
Detects Croatia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Osobna iskaznica patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Croatia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Osobni identifikacijski broj (OIB) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Hungary driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Hungary passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Személyi szám patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects TAJ szám patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Hungary Tax identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Indonesia drivers license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Kartu Tanda Penduduk (KTP) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Indonesian taxpayer identification numbers (NPWP). Classic NPWP is 15 digits commonly formatted 01.234.567.8-012.000; newer 16-digit forms align with NIK for individuals under tax reform.
Detects Indonesia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Ireland driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Ireland passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Uimhir PSP patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Teudat Zehut patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Aadhaar patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects India driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects India GST Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects PAN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Indian passport numbers issued by the Ministry of External Affairs. The standard format is a single letter (A-Z excluding Q, X and Z, which are not used as the leading character) followed by 7 digits, sometimes printed with a space between the letter and the digits (e.g. 'K1234567' or 'K 1234567'). Corroborative keyword proximity is strongly recommended because the body is only 7 digits.
Detects Indian mobile telephone numbers per the Department of Telecommunications' National Numbering Plan 2003 (as amended): 10-digit mobile numbers with a constrained leading digit (6-9, expanded from 7-9 to include 6 when DoT authorized 6-series allocation in 2017), in both the bare domestic form and the +91 international form (leading 0 dropped). Landline/STD (Subscriber Trunk Dialling) numbers are intentionally out of scope: STD codes vary 2-8 digits with no verified structural rule constraining their leading digit, so a regex loose enough to cover them (just "10 digits after a leading 0") would be barely tighter than matching any 11-digit sequence — far too high a digit-collision risk to ship without a genuinely verified constraint. See false_positives.
Detects Employees Provident Fund Organisation (EPFO) Universal Account Numbers (UAN). UAN is a 12-digit number assigned to employees to link multiple PF member IDs across employers. Leading digit is non-zero.
Detects Electoral Photo Identity Card (EPIC) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Codice Fiscale patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Italy driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Italy passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Italian mobile telephone numbers per AGCOM's national numbering plan (Delibera n. 8/15/CIR, Allegato A): the mobile/personal-communications block, structurally defined as "3XYZ" plus six further digits (a 10-digit total for numbering assigned under the current plan), in both the domestic and +39 international forms. The delibera permits already-assigned legacy 9-digit mobile numbering to persist, so any surviving legacy 9-digit mobile numbers are a known potential false negative of this 10-digit regex — kept at 10 digits deliberately, since evidence that live 9-digit stock persists today is inconclusive and loosening the length bound would raise digit collision for every match. Geographic (landline) numbers are intentionally out of scope: the AGCOM plan family bounds geographic numbers at a 10-11 digit total (11 maximum), but within that bound the "0" block's second digit is structurally unconstrained and the minimum/per-prefix length variability across the legacy short-number stock is not verified from a primary source — a 0-prefixed regex spanning that length range with no second-digit constraint would be highly collision-prone — and Italian landline numbers are also the one well-known exception where the leading 0 is retained even in the +39 international form, a further formatting axis to model. Mobile numbers carry no such leading-0 quirk (they never had a leading 0 to begin with).
Detects Japan driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Japanese My Number Corporate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. The Corporate Number (法人番号) is a 13-digit identifier assigned to corporations and organisations in Japan by the National Tax Agency.
Detects My Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Japan passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects 在留カード番号 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects 住民票コード patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects 社会保険番号 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects government defence materials for judicial review of administrative decisions. These files contain the State's candid assessment of decision-making deficiencies and legal vulnerabilities. Disclosure directly prejudices the State's defence and may establish precedent affecting thousands of similar decisions.
Detects Kenya national identity card numbers (typically 7-8 digits).
Detects South Korea driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects South Korea passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects RRN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects telecommunications interception warrants, stored communications warrants and the intercept product they produce (call transcripts, line / session logs, intercepted communications) under the Telecommunications (Interception and Access) Act 1979 (Cth). Disclosure of the existence of an interception warrant or of interception product is a criminal offence under the TIA Act and alerts targets to switch to unmonitored channels. Absorbs the former lawful-intercept-transcripts classifier.
Detects internal assessments evaluating whether specific documents or communications attract legal professional privilege, including analysis of privilege vulnerabilities. These meta-privilege documents map where the State's privilege claims are strong and where they are vulnerable.
Detects Lithuania driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Lithuania passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Asmens kodas patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Luxembourg driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Numéro d'identification national (entités) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Numéro d'identification national patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Luxembourg passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Latvia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Latvia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Personas kods patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects legal opinions and due diligence reports for mergers, acquisitions, or privatisations involving Government Owned Corporations (GOCs) or government assets. Disclosure is market-sensitive and commercially prejudicial, potentially breaching continuous disclosure obligations.
Detects privileged litigation strategy documents and related case strategy materials, including high-exposure matters (significant financial exposure or systemic policy impact), defence strategy content, prospects assessments, and settlement posture. Covers both formal major-matter strategy packs and general litigation strategy document references in Australian legal contexts.
Detects Malta driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Karta tal-Identità patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Malta passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Malta Tax ID Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects CURP patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Mexican passport numbers issued by the Secretaría de Relaciones Exteriores (SRE). Older passports use a single letter followed by 7-8 digits; newer books carry an 8-9 character alphanumeric serial. Mixed alphanumeric serials are broad candidates that also match order IDs, booking codes, and product serials — they are not treated as Mexican passport numbers without issuer or passport-document evidence. Because the format is short and loosely structured, corroborative keyword proximity is strongly recommended to reduce false positives.
Detects Mexican RFC (Registro Federal de Contribuyentes) taxpayer identifiers in both official formats: the 13-character natural-person form (4-letter name stem + 6-digit date + 3-character homoclave) and the 12-character legal-entity form (3-character name stem, which may include Ñ or &, + 6-digit date + 3-character homoclave).
Detects MyKad patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Malaysia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Malaysian individual Tax Identification Numbers (TIN / Nombor Pengenalan Cukai) issued by the Inland Revenue Board of Malaysia (LHDN / HASiL). Since 2 January 2023 individual TINs use the prefix IG followed by 9-11 digits (11-13 characters total); the legacy individual prefixes SG (employment income) and OG (business income) with the same digit range remain in circulation in older records. Entity TINs (C, D, F, PT, TA and similar prefixes) are deliberately out of scope: single-letter prefixes over a digit run are too collision-prone and entity TINs are not personal data.
Detects legal strategy documents for native title negotiations, ILUAs, and compensation claims under the Native Title Act 1993 (Cth). Disclosure reveals the State's negotiation position on land rights with multi-generational consequences and multi-billion dollar implications.
Detects NATO security classification markings under the NATO security policy (C-M(2002)49): the spelled-out national-security levels NATO RESTRICTED (NR), NATO CONFIDENTIAL (NC) and NATO SECRET (NS), and the highest level COSMIC TOP SECRET (CTS) — where the codeword COSMIC attaches only to TOP SECRET. ATOMAL caveat markings (NATO CONFIDENTIAL ATOMAL, NATO SECRET ATOMAL, COSMIC TOP SECRET ATOMAL) are covered as suffixes of their parent level marking. Marking syntax verified directly against the International Programs Security Handbook (US-government primary source reproducing NATO security-directive marking rules) and corroborating NATO security briefings; matched case-sensitively so ordinary lowercase prose ("a nato secret") does not trigger it.
Detects Nigeria National Identification Numbers (NIN) — 11 digits from NIMC.
Detects BSN patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Netherlands driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Netherlands passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Dutch national telephone numbers per the ACM-administered numbering plan: 10-digit numbers (leading trunk 0 included) covering geographic numbers (area code first significant digit 1-5 or 7, e.g. 020 Amsterdam, 010 Rotterdam, 070 Den Haag) and mobile numbers (06 prefix), plus the +31 international form (leading 0 dropped), including the widespread "+31 (0)6 12345678" letterhead rendering (a common-but-nonstandard practice — ITU-T E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous on Dutch letterheads, so it is matched for detection purposes). Numbers beginning 08 (0800 free-of-charge service numbers, 088 non-geographic business lines) and 09 (0900/0906/0909 premium-rate information numbers) are intentionally out of scope — these are organizational/service numbers rather than personal PII, mirroring how uk-phone-number and fr-phone-number scope out their own non-geographic service ranges. Note this also excludes the 085 and 091 location-independent subscriber ranges (VoIP numbers ACM makes available to individuals as well as businesses): a personal 085/091 VoIP line is therefore a known false negative, accepted because the 085/088/091 block is predominantly organizational in practice and cannot be split from it structurally.
Detects Netherlands Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Fødselsnummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Norwegian passport numbers issued by the police (politiet). The 2020 series uses a nine-character document number: ordinary (C) and emergency (K) passports are one prefix letter plus two characters that may be letters or digits plus six digits (specimen CCC002251); diplomatic (FG), service (FH), special (FJ), travel-document (FK) and foreigner (FL) passports are a two-letter prefix plus one letter-or-digit plus six digits. Pre-2020 series passports (in circulation until October 2030) carry an eight-digit document number.
Detects New Zealand driver license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects New Zealand Inland Revenue number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects the New Zealand Government CONFIDENTIAL national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (CONFIDENTIAL//..., e.g. CONFIDENTIAL//NZEO) and a gated bracket form ([CONFIDENTIAL]). Deliberately narrow v1: no bare-word tier (CONFIDENTIAL is overwhelmingly common as generic business/legal boilerplate — NDAs, email footers, "STRICTLY CONFIDENTIAL", "PRIVATE AND CONFIDENTIAL" — and would swamp any bare-word detector), and the bracket tier is hard-gated by New Zealand government context because, unlike its sibling markings, [CONFIDENTIAL] is not a verified SEEMail trigger word. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects the New Zealand Government IN-CONFIDENCE protective marking under the Protective Security Requirements (PSR) classification system: endorsed forms (e.g. MEDICAL IN-CONFIDENCE, BUDGET: IN-CONFIDENCE), the legacy SEEMail bracket trigger-word convention ([IN-CONFIDENCE]), and the bare ALL-CAPS document-banner form. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
Detects the New Zealand Government RESTRICTED national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (RESTRICTED//..., e.g. RESTRICTED//REL TO NZL, GBR), the legacy SEEMail bracket trigger-word convention ([RESTRICTED]), and the bare ALL-CAPS document-banner form gated by New Zealand government context and a collocation-noise exclusion. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects the New Zealand Government SECRET and TOP SECRET national-security classifications under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator ((TOP )SECRET//..., e.g. SECRET//NZEO, TOP SECRET//REL TO NZL, FVEY), the TOP SECRET banner-words phrase (tolerant of a hyphen or PDF-line-wrap-inserted whitespace between TOP and SECRET), and a New Zealand government/PSR-context-gated bare SECRET banner. Deliberately omits a SEEMail square-bracket trigger-word tier: the complete SEEMail bracket trigger-word set is [SEEMAIL]/[TRUSTED]/[RESTRICTED]/[SENSITIVE]/[IN-CONFIDENCE], all at or below SEEMail's own RESTRICTED-tier service ceiling, so [SECRET]/[TOP SECRET] bracket forms are structurally implausible and unattested. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects the New Zealand Government SENSITIVE protective marking under the Protective Security Requirements (PSR) classification system: the legacy SEEMail bracket trigger-word convention ([SENSITIVE]), endorsed forms (e.g. BUDGET SENSITIVE, COMMERCIAL: SENSITIVE, CABINET SENSITIVE), and the bare ALL-CAPS document-banner form gated by New Zealand government context. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
Detects New Zealand Ministry of Health Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects New Zealand Social Welfare Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.
Detects documents containing strategic and tactical intelligence on organised crime networks including network mapping, financial flow analysis, key facilitator identification, and cross-jurisdictional cooperation intelligence. QPS Taskforce Maxima handles OMCG investigations. Disclosure enables criminal organisations to restructure and eliminate suspected informants.
Detects legal strategy for patent prosecution before filing, including prior art assessments, claim drafting strategy, and freedom-to-operate opinions. Disclosure destroys patent novelty or reveals prosecution strategy to competitors. Note: trainable classifier recommended for production deployment.
Detects bulk payroll data files containing employee names, Tax File Numbers (TFNs), bank account details, and salary information. Disclosure enables mass identity theft, fraudulent tax returns, and targeted social engineering.
Detects Peru Documento Nacional de Identidad (DNI) numbers — 8 digits.
Detects Philippine Identification System (PhilSys) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Philippines passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Philippines PhilHealth Identification Numbers (PIN) in the common dashed format ##-#########-# (12 digits). Used for national health insurance membership and claims.
Detects Philippines Social Security System (SSS) numbers in the common dashed format ##-#######-# (10 digits total). Continuous digit forms are intentionally out of scope to reduce collision with other national identifiers.
Detects Philippine Taxpayer Identification Numbers (TIN) issued by the Bureau of Internal Revenue (BIR) under Section 236(j) of the National Internal Revenue Code. The base TIN is a 9-digit number (the 9th digit is a check digit), usually written XXX-XXX-XXX. Registered businesses append a branch code — historically 3 digits (000 for the head office, 12 digits total) and, since eBIRForms v7.9.6.0 (RMC No. 36-2026, April 2026), up to 5 digits (14 digits total).
Detects UMID patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Poland driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Dowód osobisty patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Poland passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects PESEL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects REGON patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Poland Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects metadata records from police body-worn camera (BWC) systems including activation timestamps, officer identification, incident cross-references, and footage catalogue entries. This pattern targets the metadata and logs, NOT the footage itself. BWC metadata reveals which officers attended which incidents, activation patterns, and evidence chain-of-custody details.
Detects internal investigation documents of police use of lethal or serious force, including compelled officer statements under s.7.2 PPRA and Ethical Standards Command evidence before investigation completion.
Detects ministerial briefing notes or departmental submissions recommending specific grant funding decisions before public announcement.
Detects draft earnings guidance, profit warnings, or financial results before market disclosure. For QLD Government, this applies to GOCs subject to continuous disclosure obligations.
Detects weighted evaluation matrices scoring tender responses, including commercial pricing from multiple bidders in government procurement processes.
Detects Cartão de Cidadão patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Portugal driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Portugal passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Portugal Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects بطاقة الهوية القطرية patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects unreleased Queensland state budget allocation figures, forward estimates, and expenditure projections. These are market-moving documents that enable insider trading on government-linked securities if disclosed prematurely.
Detects Queensland Police Service (QPS) incident reports containing operational details about reported offences, informant information, and occurrence records. These are non-covert operational documents that are sensitive due to informant and victim details but do not involve covert methodology or life-safety risks.
Detects legal defence strategy prepared in response to regulatory investigations by bodies such as ACCC, ASIC, APRA, OAIC, and Queensland regulators (CCC, OIA). Disclosure reveals the target's assessment of its own regulatory exposure and defence approach.
Detects prosecution briefs prepared by Queensland regulatory bodies (Workplace Health and Safety, Environmental Protection Authority, Office of Fair Trading) for enforcement action. Disclosure compromises prosecution integrity and alerts enforcement targets.
Detects Romania driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Romania passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Cod Numeric Personal patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects draft submissions to Royal Commissions before formal tabling. Pre-tabling drafts reveal the State's narrative strategy, admissions under consideration, and positions not yet finalised. Disclosure prejudices the State's participation in proceedings of national significance.
Detects Russian domestic passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Russian international passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Russian Taxpayer Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Saudi Arabian Iqama (residence permit) numbers issued to expatriate residents. Iqama numbers are 10 digits and start with 2. Saudi national IDs start with 1 and are covered by sa-national-id.
Detects National Id patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects internal legal assessments evaluating compliance with sanctions regimes (DFAT, OFAC, EU). Disclosure reveals identified compliance gaps, risk exposures, and remediation strategies before implementation, exposing the organisation to criminal prosecution under the Autonomous Sanctions Act 2011.
Detects Sweden driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Sweden passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Personnummer patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Sweden Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects documents authorising settlement ranges, negotiation floors/ceilings, and approved concession parameters, and unexecuted draft settlement instruments (draft deeds of settlement/release, settlement agreements, terms of settlement) carrying a proposed settlement sum. Disclosure reveals the State's maximum position or proposed terms, destroying negotiation leverage and potentially costing tens of millions in lost bargaining position. Absorbed global-top500-166-settlement-agreement-drafts (2026-09-24).
Detects sexual assault counselling records and the legal material that seeks or protects them, for an identified person: counselling session notes, trauma counselling and victim/survivor support records, forensic medical examination referrals, specialist sexual assault service records (Queensland SARAS, Centres Against Sexual Assault, Yarrow Place, Sexual Assault Resource Centre, sexual assault response teams), and subpoena or privilege material about protected counselling communications — Qld sexual assault counselling privilege (Evidence Act 1977 Pt 2 Div 2A), NSW sexual assault communications privilege (Criminal Procedure Act 1986 ss295-306), Vic confidential communications (Evidence (Miscellaneous Provisions) Act 1958 Div 2A), and WA, SA, Tas, ACT and NT equivalents. These records are subject to strong statutory privilege and carry the highest privacy protections — disclosure can re-traumatise survivors, compromise criminal proceedings, and endanger safety.
Detects Singapore driving license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects NRIC patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Singapore passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Singapore Unique Entity Numbers (UEN) issued by ACRA and other agencies to businesses and other entities. Common forms are 8 or 9 digits plus a check letter (local companies) and the issued-year form TyyPQnnnnX / SyyPQnnnnX / RyyPQnnnnX used for other entities.
Detects Slovenia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Enotna matična številka občana (EMŠO) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Slovenia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Slovenia Tax Identification Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the numeric format, corroborative evidence keywords are essential for reliable detection.
Detects Slovakia driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Slovakia passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Rodné číslo patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects embedded credentials (username:password) in Git repository URLs. Mirrors Snaffler rule KeepGitCredsByName.
Detects MediaWiki LocalSettings.php files containing database passwords ($wgDBpassword), secret keys ($wgSecretKey), and upgrade keys ($wgUpgradeKey). These are high-value secrets that grant database and administrative access to a MediaWiki installation. Mirrors Snaffler rule KeepPhpByName.
Detects secret credentials embedded in Ruby on Rails configuration files: secret_token/secret_key_base assignments (config/initializers/secret_token.rb, config/secrets.yml), database passwords (config/database.yml), and Chef knife client keys (knife.rb). These files are frequently committed to source control and expose application secrets and infrastructure access. Mirrors Snaffler rule KeepRubyByName.
Detects QTC (Queensland Treasury Corporation) borrowing strategies, debt issuance timelines, yield curve management plans, and refinancing schedules. Premature disclosure enables bond market front-running.
Detects internal legal assessments quantifying the State's liability exposure on specific matters (tort, contract, statutory). Disclosure reveals the State's own estimate of its likely loss, undermining defence and settlement positions across multiple related matters. Note: trainable classifier recommended for production using liability document structural features.
Detects bulk superannuation member data including individual balances, employer contributions, TFN-linked records, and beneficiary nominations from government super schemes such as QSuper.
Detects surrogacy arrangement records including parentage orders, surrogacy agreements, birth mother medical records, and intended parent assessments under the Surrogacy Act 2010 (Qld). These records contain deeply personal information about reproductive choices, medical procedures, and legal parentage transfers — disclosure can cause severe emotional distress and breach court-sealed parentage orders.
Detects terrorism and national security watchlist entries including risk ratings, monitoring status, intelligence basis, and border alert configurations. Disclosure enables subjects to evade monitoring and compromises border security.
Detects Thai passport numbers issued by the Department of Consular Affairs, Ministry of Foreign Affairs of Thailand. Documented formats are one letter followed by six digits (older series, e.g. A123456), two letters followed by six digits (e.g. AA123456), or two letters followed by seven digits (current e-passport series, e.g. AA1234567, nine characters total matching the MRZ document-number field). Note: the legacy A123456 / AA123456 forms are documented by a single source (Thai Wikipedia); the current AA1234567 form is corroborated independently via the MRZ document-number field.
Detects เลขประจำตัวประชาชน patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects T.C. Kimlik Numarası patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Turkish (Türkiye) ordinary ("umuma mahsus", bordo/burgundy) passport numbers. New-generation ordinary passports, issued by the General Directorate of Civil Registration and Citizenship (Nüfus ve Vatandaşlık İşleri Genel Müdürlüğü, NVİ) since 2018, carry a nine-character document number consisting of the series letter "U" followed by eight digits (e.g. U12345678), printed in the top-right corner of the data page. Turkish sources report different series letters for the special/green (hususi, "S") and service/grey (hizmet, "Z") passports; those series are NOT covered by this pattern because their letter-plus-digit shape could not be independently corroborated. Ordinary bordo passports are by far the dominant variant.
Detects the Turkish tax identification number (Vergi Kimlik Numarası, VKN) issued by the Turkish Revenue Administration (Gelir İdaresi Başkanlığı, GİB). The VKN is a 10-digit number structured as a 3-digit alpha group code (001-999), a 6-digit sequence number and a single check digit. Since 1 July 2006 Turkish citizens use their 11-digit T.C. Kimlik Numarası as their tax number (covered by the separate tr-national-id pattern); the 10-digit VKN remains the tax identifier for legal entities, ordinary partnerships, foreign legal entities and foreign nationals without a Foreign Identity Number.
Detects proprietary trading algorithms, quantitative investment strategies, or systematic risk models used by government investment vehicles such as QIC (Queensland Investment Corporation). This deployable record is the keyword/regex fallback detector (basis-points anchor with quantitative and proprietary-marker evidence); any trainable ML classifier is a separate tenant artifact with an external identity and is not represented in this record.
Detects traffic camera and speed camera infringement records containing driver identification details, vehicle registration, and photographic evidence references, and automatic number plate recognition (ANPR / ALPR) read records that place a plate at a camera site, lane, direction and time. These records link specific vehicles and individuals to locations and traffic offences via camera evidence under the Transport Operations (Road Use Management) Act 1995 (Qld). Absorbs the former automated-plate-reader-data classifier.
Detects 國民身分證統一編號 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Taiwan passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects 外僑居留證 / 台灣地區居留證 patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Ukraine domestic passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Ukraine international passport number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects the Ukrainian individual tax number — the registration number of the taxpayer's account card (РНОКПП / RNOKPP, historically called RNTRC or ІПН), assigned by the State Tax Service of Ukraine to every individual taxpayer in the State Register of Individuals – Taxpayers. Per the OECD AEOI TIN description for Ukraine, the RNOKPP is a ten-digit numerical code (no letters, hyphens, or other symbols) with structure XXXXXNNNNK: a 5-digit birth-date registration sequence, a 4-digit account-card sequence, and a control digit.
Detects Scottish Community Health Index (CHI) 10-digit patient identifiers used by NHS Scotland.
>- This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation. Detects UK driving licence numbers. GB licences follow a 16-character format encoding surname, date of birth, and gender. Northern Ireland licences are 8-digit numbers.
Detects Electoral Roll Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects the UK Government Security Classifications Policy (GSCP) OFFICIAL classification and its -SENSITIVE marking, written OFFICIAL-SENSITIVE and applied immediately after the OFFICIAL classification per the current policy. Matches the verified structured "CLASSIFICATION - HANDLING INSTRUCTION[- DESCRIPTOR]" format (e.g. OFFICIAL-SENSITIVE - RECIPIENTS ONLY, OFFICIAL-SENSITIVE - COMMERCIAL) using the centrally-defined GSCP handling-instruction and descriptor vocabulary, the bare OFFICIAL-SENSITIVE banner, and — at a lower, UK-government-context gated tier — bare OFFICIAL alone, which is a common English word. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively so ordinary lowercase English use of "official"/"official-sensitive" does not trigger it.
Detects the UK Government Security Classifications Policy (GSCP) SECRET and TOP SECRET national-security classifications: the verified UK Prefix form (UK SECRET / UK TOP SECRET, applied to assets shared with foreign governments or international organisations), the classification followed by a verified National Caveat handling instruction (SECRET/TOP SECRET - UK EYES ONLY, - UK/US EYES ONLY, - FIVE EYES ONLY, per the GSCP's "CLASSIFICATION - HANDLING INSTRUCTION" additional-marking format — National Caveats apply only to SECRET and TOP SECRET, never OFFICIAL), the distinctive TOP SECRET banner-words phrase, and a UK-government-context-gated bare SECRET banner. Intended to surface content that should not reside on this platform. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively.
Detects National Insurance Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects NHS Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Passport patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects UK national telephone numbers per Ofcom's National Telephone Numbering Plan: geographic numbers (01/02 prefix) and mobile numbers (07 prefix, second digit restricted to 1-5 or 7-9, plus the 07624 Isle of Man mobile range — the one mobile block inside the otherwise-excluded 076 radiopaging range, allocated to Isle of Man operators under the UK plan; 070 personal-numbering and the rest of 076 remain excluded), both as 11-digit domestic strings (leading 0 + 10 significant digits), plus the +44 international form (10 significant digits, leading 0 dropped per ITU/Ofcom convention). Digit groups after the initial prefix use a flexible per-digit optional separator rather than a single fixed grouping, because Ofcom's numbering plan allows multiple valid group-length conventions (4+6, 3+7, 2+8, 5+5) that vary by area. Two additional conventional renderings are covered: the parenthesised-area-code national notation for geographic numbers, e.g. "(020) 7946 0958" / "(01632) 960960" (ITU-T E.123 national notation, parentheses marking the optionally-dialled area code, for 2-5 digit area codes), and the widespread "+44 (0)20 7946 0958" letterhead form (a common-but-nonstandard practice — E.123 advises against the parenthesised trunk digit in international notation, but it is ubiquitous in UK signatures and letterheads, so it is matched for detection purposes). Non-geographic service numbers (03/08/09) are intentionally out of scope — they are typically organizational/service numbers rather than personal PII, mirroring how au-fixed-line-telephone scopes to geographic numbers only.
Detects Unique Taxpayer Reference patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects United Kingdom (and Northern Ireland XI) Value Added Tax registration numbers. Standard trader numbers are GB followed by 9 digits; branch traders use GB plus 12 digits; government departments use GBGD### and health authorities GBHA###. Northern Ireland post-Brexit issues XI-prefixed numbers with the same body formats. Matching is uppercase letter prefixes as issued by HMRC.
Detects USCIS Alien Registration Numbers (A-Numbers). An A-Number is the unique identifier the Department of Homeland Security assigns to a noncitizen: the letter "A" followed by 7-9 digits, written compactly (A012345678) or grouped (A-123-456-789). A-Numbers appear on Green Cards, EADs, immigration court records, and Form I-9 / E-Verify data held by virtually every U.S. employer.
Detects U.S. national-security classification banner and portion markings (per Executive Order 13526 and the Intelligence Community marking system): a classification level — TOP SECRET, SECRET, CONFIDENTIAL — followed by one or more "//"-separated control or dissemination markings (SI, TK, HCS, SCI, SAP, NOFORN, ORCON, REL TO ...), or a parenthetical portion mark such as (S//NF) or (TS//SI). The bare words "secret" and "confidential" are far too common to match alone, so a match requires the "//" control structure or a parenthetical portion mark.
Detects Controlled Unclassified Information (CUI) banner and portion markings as defined by 32 CFR 2002.20 and the NARA CUI Registry. A CUI banner is the control marking "CUI" optionally followed by category markings (CUI//SP-PRVCY) and limited-dissemination controls (//NOFORN, //FEDCON, //FED ONLY, //NOCON, //DL ONLY, //REL TO ...), with elements separated by double slashes. The bare token "CUI" is too common to match alone, so a match requires either the "//" banner structure or the spelled-out phrase "Controlled Unclassified Information".
Detects DEA patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Impairments Listed In The U.S. Disability Evaluation Under Social Security patterns. This pattern is based on a Microsoft Purview built-in sensitive information type that identifies health and medical terminology in documents. Keyword matching is used to flag content containing medical language.
A multi-state helper for detecting U.S. driver's license numbers using the real structural formats of several high-population states, rather than the broad "letter + 7-12 digits" catch-all. Covers California, New York, Texas, Florida, New Jersey, and Illinois. This is a companion to the generic us-drivers-license pattern (which it does not replace); use it when you want tighter, state-aware matching for those jurisdictions.
Detects U.S. driver's license number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Employer Identification Number patterns.
Detects student identifiers that appear in education records protected under the Family Educational Rights and Privacy Act (FERPA). Student ID formats are institution-specific, so this pattern anchors on an explicit student/enrolment/SIS context label immediately preceding a 6-12 character alphanumeric ID, and relies on education-record keywords (transcript, GPA, enrollment, registrar) for corroboration.
Detects US Individual Taxpayer Identification Numbers (ITINs) issued by the IRS to individuals who are required to have a US taxpayer identification number but are not eligible for a Social Security Number. ITINs always begin with the digit 9, and the fourth and fifth digits fall in the range 70-99, distinguishing them from SSNs. The pattern matches both formatted (9XX-7X-XXXX) and unformatted (9XX7XXXXX) variants.
'Detects MBI patterns. Excluded letters: S, L, O, I, B, Z.' This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects US passport numbers in exactly two accepted formats: a nine-digit numeric value (older US passports), or a single uppercase letter followed by exactly eight digits (newer passport books and cards). Bare eight-digit values and letter-plus-nine-digit values are not valid US passport numbers. Due to the relatively simple format, corroborative keyword proximity is strongly recommended to reduce false positives. Keywords are US-scoped (passport / US passport / State Department); foreign-passport labels are not treated as US passport evidence.
Detects North American Numbering Plan (NANP) telephone numbers in US contexts: the domestic NPA-NXX-XXXX form (bracketed, hyphenated, dotted, spaced, or bare, with an optional leading trunk "1") and the international +1 NPA-NXX-XXXX form. Area-code (NPA) and exchange-code (NXX) groups are constrained to a leading digit of 2-9 with the N11 service-code shape (211/311/411/511/611/711/811/911) excluded from both groups, per NANPA's published format rules. NANP area codes are drawn from a single pool shared by the US, Canada, and Caribbean member territories — the digit structure itself cannot distinguish a US number from a Canadian one (see ca-phone-number for the sibling pattern). Differentiation between the two patterns is by jurisdiction/regulation metadata and country-specific corroborative evidence keywords only, not by regex — this is the documented convention for the whole NANP pair.
Detects US Social Security Numbers (SSNs) in both formatted (XXX-XX-XXXX) and unformatted (XXXXXXXXX) representations. The pattern excludes invalid SSN ranges including area numbers 000, 666, and 900-999, group numbers 00, and serial numbers 0000, in accordance with SSA assignment rules. SSNs are critical PII used across healthcare, financial, and government contexts.
Detects Vietnam Citizen Identity Card numbers (Căn cước công dân / CCCD). Modern chip-card numbers are 12 digits beginning with 0, embedding gender/century and place-of-birth codes.
Detects bulk payment authorisation files extracted from government ERP systems (SAP, Oracle, TechnologyOne) containing payee bank accounts, payment amounts, and authorisation codes for batch processing.
Detects documents containing witness protection program records including new identities, relocation details, and safe house locations for protected witnesses. Disclosure directly endangers the lives of witnesses and their families who have testified against violent criminals.
Detects Id Number patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects South African passport numbers issued by the Department of Home Affairs under the South African Passports and Travel Documents Act 4 of 1994. Passport numbers are nine characters: one uppercase prefix letter identifying the passport type — A (normal/tourist), M (maxi), E (official), D (diplomatic), T (travel document) — followed by eight digits (SARS documents current issuance as starting A0, M0, E0).
Detects South African income tax reference numbers (TIN) allocated by the South African Revenue Service (SARS) under section 24 of the Tax Administration Act, 2011. The number is ten digits, may only start with 0, 1, 2, 3 or 9, and its tenth digit is a check digit computed with a modulus-10 (Luhn-style) algorithm documented by SARS.