Packages / Security Operations
Incident response, threat, vulnerability, monitoring, and security operations records.
Detects agent tool-misuse / high-risk action instructions in AI/agent context: destructive or irreversible action language coupled with a high-impact target or an approval-bypass clause (OWASP LLM06 / Agentic Top 10). The action verb and target must co-occur to suppress IT-runbook false positives.
Completed records under the Queensland Mandatory Notification of Data Breach (MNDB) scheme in chapter 3A of the Information Privacy Act 2009 (Qld), as inserted by the Information Privacy and Other Legislation Amendment Act 2023: the s 51 statement to the Information Commissioner, the s 53 notice to affected individuals, s 52 further information, and entries in the s 72 register of eligible data breaches. The scheme has applied to Queensland government agencies since 1 July 2025 and to local government since 1 July 2026. A populated record names the agency and gives the date of the breach, the type of eligible data breach (unauthorised access, unauthorised disclosure or loss, s 47), the kinds of personal information involved, the number of individuals affected or notified, and the containment and mitigation steps. OIC guidance, the Act, published MNDB statistics and blank templates are decoys. Overlaps with au-data-breach-report, which is framed around the Commonwealth Notifiable Data Breaches scheme (Privacy Act 1988 Part IIIC); Commonwealth NDB signals are excluded from this classifier's enforce tiers.
Completed regulatory cyber incident reports made to the Australian Signals Directorate: mandatory cyber security incident reports under the Security of Critical Infrastructure Act 2018 (s 30BC critical incidents, 12 hours, written record within 84 hours of an oral report; s 30BD other incidents, 72 hours, written record within 48 hours), content entered in the ASD/ACSC "Report a cyber security incident" form (organisation, ABN, contact number, date and time the incident was identified, whether it is ongoing, incident type, Home Affairs consent), and ransomware payment reports under s 27 of the Cyber Security Act 2024. Distinct from global-security-incident-report and the OT cyber incident report classifiers, which cover internal incident and forensic reports; this one requires the regulatory reporting frame plus populated ASD form fields.
Documents that are "relevant information" under s 5A of the Security of Critical Infrastructure Act 2018 (Cth): a critical infrastructure risk management program (CIRMP, s 30AC) and the annual CIRMP report (s 30AG: up-to-date statement for a financial year, board or governing body approval, hazards with a significant relevant impact; LIN 23/006 and LIN 26/075 terms), Register of Critical Infrastructure Assets submissions (s 6 interest and control information, s 7 operational information), and Systems of National Significance enhanced cyber security obligation documents (incident response plan s 30CD, cyber security exercise evaluation reports s 30CQ / 30CR, vulnerability assessment report s 30CZ, system information reporting notices s 30DB / 30DC). There is no statutory marking for this material, so the classifier does not anchor on "PROTECTED" or any other label.
Content of an aviation industry participant's Transport Security Program (TSP, Aviation Transport Security Act 2004 s 16; disclosing TSP content without the participant's consent is an offence under Aviation Transport Security Regulations 2005 reg 2.06) and of maritime security plans, ship security plans and offshore security plans (Maritime Transport and Offshore Facilities Security Regulations 2003 regs 3.12, 4.115 and 5A.105 require them to be protected against unauthorised access, amendment and disclosure). Enforcement needs populated plan structure: named port / company / ship / offshore security officers (PSO, CSO, SSO), 24-hour security contact numbers, restricted and cleared zone or screening point tables, and executed Declarations of Security. Australian law has no "Security Sensitive Information" marking; US TSA Sensitive Security Information (49 CFR 1520) material is an explicit exclusion.
Detects NIS2 Article 21 cybersecurity risk-management measures documentation from essential and important entities — gap assessments, board approval papers, and the policies implementing the Article 21(2)(a)-(j) measures (incident handling, business continuity, supply chain security, cyber hygiene, cryptography, access control, multi-factor authentication). These documents catalogue an entity's security posture and unremediated gaps.
Identifies disaster recovery and IT continuity plans that contain populated recovery detail: numeric recovery objectives, system hosts/addresses, numbered recovery steps or recovery commands. Plan titles alone are discovery-only.
Identifies organisation-specific incident response plans with named role assignments, severity definitions or contact details. Plan titles alone are discovery-only.
Identifies IT runbooks, operational/security playbooks, SOPs and work instructions that contain executable operational detail: numbered steps, shell/admin commands, or internal hosts and addresses. Titles alone are discovery-only.
Identifies substantive internal network-infrastructure design and topology documents. Topic phrases are retained for discovery; enforcement requires segmentation, trust-boundary, routing, VLAN, DMZ, data-flow, or firewall-design content, and high confidence also requires a populated address, VLAN, port, device, or rule detail.
Identifies substantive operational-technology, SCADA, ICS, and industrial-control security assessments. Topic phrases are retained for discovery; enforcement requires findings, affected assets, evidence, remediation, attack paths, firmware, segmentation, credential, or remote-access weaknesses, and high confidence additionally requires a concrete technical indicator and severe exploit consequence.
Detects red team assessment reports and red team findings records revealing proven attack paths and security blind spots. A red-team / purple-team / adversary-simulation / threat-emulation title is discovery-only; enforcement requires attack-technique, ATT&CK technique ID, offensive-tool, or populated finding-record evidence, and high confidence requires a populated finding record (finding ID, severity, affected host) plus independent attack-path/TTP evidence.
Identifies populated risk registers, risk matrices and enterprise risk reports: risk IDs, rated likelihood/consequence/residual values and named risk owners. Titles alone are discovery-only.
Identifies system architecture diagrams patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies api interface specifications patterns in security and access control contexts. Detects potential exposure of sensitive security information in Australian systems.
Identifies CI/CD pipeline configuration files (GitHub Actions workflows, GitLab CI, Azure Pipelines, Jenkinsfiles, Bitbucket/CodeBuild/CircleCI configs) containing pipeline syntax, secret references or internal build/registry hosts. Pipeline topic wording alone is discovery-only.
Identifies Kubernetes/Helm/Compose deployment manifests with populated resource definitions: apiVersion/kind, container image and pod spec keys, namespaces or internal hosts. Manifest wording alone is discovery-only.
Identifies infrastructure-as-code files (Terraform, CloudFormation, ARM/Bicep, Ansible) with populated resource, provider, task or network definitions. IaC wording alone is discovery-only.
Identifies dependency / software composition analysis (SCA) vulnerability reports - npm/pip audit, Snyk, Dependabot, OWASP Dependency-Check, Trivy/Grype - with package coordinates, advisory IDs and installed/fixed versions. General vulnerability assessment reports are covered by global-vulnerability-assessment-report.
Identifies static application security testing (SAST) findings and exports - Semgrep, CodeQL, Checkmarx, Fortify, Veracode, SonarQube, Coverity, Bandit - with source file/line locations, rule or CWE IDs and severities.
Identifies dynamic application security testing (DAST) findings and scanner reports - OWASP ZAP, Burp Suite, Acunetix/Invicti, AppScan, WebInspect - with tested endpoints, parameters/payloads and alert IDs. Penetration test reports are covered by global-top500-252-penetration-testing-reports.
Identifies populated threat model documents (STRIDE, PASTA, attack trees) that enumerate threats against a named system: threat IDs, STRIDE category rows and trust-boundary / data-flow elements. "STRIDE" is only recognised in threat-model context, not as the English word "stride".
Identifies penetration testing reports patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies bug bounty and vulnerability disclosure programme (VDP) submissions - HackerOne, Bugcrowd, Intigriti, YesWeHack reports and researcher submissions - with report IDs, reproduction steps, affected endpoints and triage/bounty fields. General vulnerability reports are covered by global-vulnerability-assessment-report.
Identifies incident postmortems and post-incident reviews with populated incident detail: timestamped timeline entries, incident/problem references, impact metrics or affected hosts. Generic "timeline", "root cause" and "lessons learned" wording no longer matches.
Identifies operational, maintenance and on-call runbooks, operations manuals and troubleshooting guides containing numbered steps, shell/admin commands or internal hosts. Titles alone are discovery-only. Substantially overlaps global-it-runbook-playbook (same structures); candidate for merge.
Identifies environment and application configuration files (.env, appsettings.json, application.properties/yml, web.config) with populated configuration: environment variable assignments, connection/host values or config sections. Secret values themselves are handled by the credential classifiers.
Identifies telemetry schemas patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies hsm key management metadata patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies SIEM event data and exports - Splunk, Microsoft Sentinel, QRadar, Elastic Security alerts, notable events and security event logs - containing event IDs, security log fields, CEF/LEEF/syslog records or host addresses. These records typically contain personal information (usernames, IPs).
Identifies endpoint detection telemetry patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies intrusion detection alerts patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies firewall rule configurations patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies sensitive network topology diagrams patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies patch and vulnerability exception records (deferrals, waivers, exemptions) that name affected assets, deferred patches/CVEs, expiry dates or approvers. Generic risk register, asset owner and remediation plan wording no longer matches.
Detects populated indicator-of-compromise lists and packages: IOC wording together with concrete indicator values such as file hashes, C2 domains or IPs, defanged URLs, mutexes or registry keys. The IOC phrase alone is discovery-only.
Detects threat-intelligence subscription records - licence and account details, feed API keys, TAXII endpoints and collection IDs for commercial or community CTI feeds. Subscription wording alone is discovery-only.
Detects malware sample repository indexes and manifests: malware-sample wording with per-sample hashes, family names, file types, storage paths or archive passwords. Topic wording alone is discovery-only.
Detects sandbox detonation reports: sandbox or dynamic-analysis report wording with populated behaviour fields (verdict, task ID, spawned processes, dropped files, registry keys, network requests) and host artefacts. Topic wording alone is discovery-only.
Detects phishing simulation result exports: simulation-result wording with per-user outcome rows (email plus clicked/submitted/reported) and numeric campaign metrics. Discussions of phishing simulations are discovery-only.
Detects purple-team and adversary-emulation exercise plans that name ATT&CK techniques, targets, test windows, C2 infrastructure and expected detections. Exercise wording alone is discovery-only; tabletop exercises are out of scope.
Detects SOC analyst case notes: SOC case or analyst-notes wording with populated case fields (IDs, severity, affected host/user, disposition) and technical artefacts. Topic wording alone is discovery-only.
Detects incident timelines: timeline or chronology wording with timestamped entries and host, user or evidence-source artefacts. Timeline wording alone is discovery-only.
Detects forensic disk-image acquisition records: image or acquisition-log wording with evidence/exhibit numbers, examiner, device serials, image file names and verification hashes. Topic wording alone is discovery-only.
Detects volatile memory capture records and analysis output: memory-capture wording with capture metadata, memory image file names, Volatility plugin output and addresses. Topic wording alone is discovery-only.
Detects insider-threat investigation files: insider-risk or employee investigation wording with populated subject details (employee, position, case number, allegation) and user-activity evidence. Topic wording alone is discovery-only.
Detects backup catalogs and job reports: backup catalog/index wording with populated job, client, media and retention fields plus barcodes, paths, sizes or hosts. Topic wording alone is discovery-only.
Detects business continuity plans and business impact analyses with populated recovery objectives (RTO/RPO/MTPD values), crisis contacts and alternate sites. Topic wording alone is discovery-only.
Detects failover and high-availability architecture details: failover/DR/HA architecture wording with populated node, VIP, site and listener fields plus internal IPs or hostnames. Topic wording alone is discovery-only.
Identifies capacity planning models patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects IT asset inventory records: asset register/inventory wording with populated asset tags, serial numbers, hostnames, MAC/IP addresses and owners. Topic wording alone is discovery-only.
Detects CMDB relationship mappings: CMDB or dependency-map wording with relationship edges (ServiceNow relationship types or A -> B edges) and populated CI fields. Topic wording alone is discovery-only.
Identifies privileged account inventories patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects endpoint-management policy profiles: Intune/MDM/GPO profile wording with machine policy artefacts (OMA-URI, payload keys, policy registry paths, Graph types) and populated profile fields. Topic wording alone is discovery-only.
Detects remote administration tool settings: RDP connection files, TeamViewer/AnyDesk configuration, sshd directives and populated gateway/jump-host/access-password fields. Topic wording alone is discovery-only.
Detects DNS zone files: $ORIGIN/$TTL/SOA directives with resource record lines, especially internal zones with private addresses and internal hostnames. A directive alone is discovery-only.
Detects SLA breach analysis reports: SLA breach or service-credit wording with measured metrics against targets and populated contract, incident and credit fields. Topic wording alone is discovery-only.
Detects major outage root-cause analyses: RCA or post-incident review wording with populated outage fields and technical artefacts (incident/change numbers, hosts, timestamps). Topic wording alone is discovery-only.
Detects change management records: change request/CAB wording with populated change fields (owner, CI, planned window, risk, approval) and change artefacts. Topic wording alone is discovery-only.
Detects scheduled maintenance plans: maintenance-window wording with dated time windows and populated affected-system, downtime and change fields. Topic wording alone is discovery-only.
Detects configuration baseline snapshots: baseline/snapshot wording with actual device or OS configuration lines and populated snapshot metadata. Topic wording alone is discovery-only.
Identifies service dependency maps patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects completed vendor risk assessments: third-party risk assessment wording with populated vendor/contract fields and inherent/residual risk ratings, supported at high confidence by assurance evidence. Topic wording alone is discovery-only.
Detects vulnerability assessment reports, vulnerability scanner outputs (Nessus, Qualys, OpenVAS, Nexpose/InsightVM), and zero-day vulnerability write-ups containing CVE/CVSS details, scanner plugin/QID host-port rows, and unpatched or pre-disclosure status. Report and scanner titles alone are discovery-only; enforcement requires a concrete finding, CVE/CWE/CAPEC ID, CVSS vector or score, scanner output structure, or zero-day status evidence.