Azure Bot Framework Secret Key

Detects Azure Bot Framework secret key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: structurally constrained pattern with Bot Framework context keywords reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.
Detection quality: Partial
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Data categories: credentials, security
Scope: specific
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:botSecret|bot[._-]?framework[._-]?secret|directline[._-]?secret)\s*[:=]\s*"?[A-Za-z0-9_.\-~]{30,60}"?

Corroborative evidence keywords

Bot Framework, bot secret, Direct Line, Web Chat, bot service, Microsoft Bot, secret key, channel secret, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie (+44 more)

Proximity: 300 characters

Should match

botSecret=AAAA0000BBBB1111CCCC2222DDDD3333EEEE4444 — Bot Framework secret key
directline_secret: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef0123" — Direct Line channel secret
bot-framework-secret="00000000000000000000000000000000000000000000" — Bot Framework secret with placeholder value

Should not match

botName=mybot — Bot name, not a secret
botSecret="" — Empty secret value
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

Bot Framework documentation and tutorials containing example secret values. Mitigation: Check for common placeholder patterns and documentation file types.
Other service secrets that use similar alphanumeric formats. Mitigation: Require proximity to Bot Framework specific keywords to confirm context.

References

Azure Bot Framework secret key entity definition - Microsoft Learn