Payroll system access logs

Name: Payroll system access logs
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects exported payroll system access and audit logs: timestamped log lines showing a user logging in, viewing, changing or exporting payroll records, with a populated user field. Operational security data, capped at 75.

Type: regex
Engine: boost_regex
Confidence: low
Confidence justification: Low: payroll system access logs are operational security records (timestamps, user IDs, actions) rather than payroll content; they identify system users and what they touched but not pay details. The pattern is capped at 75: it needs a timestamped event line with an action verb plus a populated user field near a payroll access-log phrase. It never claims 85 because the record is low sensitivity on its own; pair with security monitoring rather than DLP blocking.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
Frameworks: ISO 27001, ISM, PSPF
Data categories: security
Scope: wide
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:payroll\s+(?:system\s+)?(?:access|audit|activity|user\s+activity)\s+(?:logs?|trails?|reports?)|(?:access|audit)\s+(?:logs?|trail)\s+(?:for|-|of)\s+(?:the\s+)?payroll(?:\s+system)?|payroll\s+audit\s+trail(?:\s+export)?|payroll\s+(?:user\s+)?(?:login|logon)\s+(?:history|report))\b

Corroborative evidence keywords

timestamp, user ID, viewed, exported, bank details, failed login

Proximity: 300 characters

Should match

Payroll system access log 2026-09-18 09:14:22 user=jteston action=viewed employee=4471820 screen=Bank details 2026-09-18 09:15:03 user=jteston action=exported report=Pay run 2026-19 — 75: key=value payroll access log with viewed/exported events (capped at 75)
Payroll audit trail export 2026-09-20 22:41 | User ID: svc_payroll_admin | Event: failed login — 75: payroll audit trail export with failed login (capped at 75)
Access logs for the payroll system, week 38 2026-09-21T07:02:11Z username: mstaffson logged in 2026-09-21T07:05:40Z username: mstaffson modified super fund details — 75: access logs for the payroll system with login and modify events (capped at 75)
payroll system access logs — 65: bare phrase only - discovery tier

Should not match

Access to payroll systems should be logged, and payroll system access logs should be reviewed monthly. This policy statement sets out logging requirements. — Logging policy - must stay at or below 65
Payroll system access log Timestamp: __________ User ID: __________ Action: __________ — Blank log template - must stay at or below 65
2026-09-18 09:14:22 user=admin action=viewed page=/home — Generic web log without a payroll phrase - must not match
unrelated generic text without domain phrases — No relevant topic phrases present

Known false positives

Security policies and audit standards that require payroll access logging. Mitigation: Enforce requires timestamped event lines and populated user fields; logging-policy framing is excluded.
Blank forms, templates and system configuration screens. Mitigation: Blank lines, bracket placeholders, XXX and n/a/tbc values are rejected by the placeholder guard; template/fixture words are excluded by template-exclusion.
Application logs from other systems that mention payroll in a free-text message. Mitigation: Accepted; the pattern is capped at 75 and its sensitivity is low.