Security Incident Report

Detects populated cyber security incident reports: incident report / post-incident review titles together with incident record fields (incident ID, severity, detection time, affected hosts, source IPs) or technical artefacts (IPv4 addresses, CVE identifiers).

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium: incident-report titles also appear in policy, guidance and news, so enforcement requires populated incident fields or technical artefacts; 85 adds response/root-cause evidence.

Jurisdictions

global

Regulations

NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2

Data categories

security

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:security\s+incident\s+(?:report|analysis)|cyber\s*(?:security)?\s+incident|incident\s+(?:investigation|forensic)\s+report|post[\s-]?incident\s+(?:review|analysis))\b

Should match

• Security incident report - INC-2026-0412 Severity: High Detected: 12/08/2026 02:14 AEST Affected host: fin-app02.corp.internal (10.20.30.41) Source IP: 203.0.113.77 Root cause: unpatched CVE-2025-21298 allowed code execution; containment completed by isolating the host. — 85 - populated incident record with technical artefacts and root-cause/containment evidence
• Post-incident review Incident ID: SIR-0917 Reported by: Service Desk Two staff reported the same phishing email; no further action required. — 75 - populated incident fields without response or root-cause evidence
• Security incident report received for review. — 65 discovery - title only
• Security incident report: forensic analysis and root cause analysis findings — 65 discovery - title and topic words without populated fields

Should not match

• Security guard incident report — Physical security usage
• Minor traffic incident — Traffic usage
• Our incident response policy explains how a security incident report is written, reviewed and closed, and who approves containment actions. — Policy guidance - no populated incident fields (65 at most)
• Security incident report form Incident ID: ________ Severity: [select] Affected host: ________ Source IP: <address> — Blank report template - placeholder fields are rejected
• The council confirmed a cyber security incident on Monday and said a post-incident review would be published next month. — News item - no populated incident fields
• Sample template for documenting a cyber event, causal findings, and containment actions. — Adjacent template language is not a populated cyber-incident record
• Data breach report: OAIC notification sent to affected individuals. — Sibling breach-report language does not satisfy the security-incident primary

Known false positives

• Physical security or traffic incidents. Mitigation: Require cyber-specific terms like IOC, forensic analysis, or malware analysis.

References

• ASD ACSC - Report a cyber security incident
• Security of Critical Infrastructure Act 2018 (Cth)