Backup catalogs

Detects backup catalogs and job reports: backup catalog/index wording with populated job, client, media and retention fields plus barcodes, paths, sizes or hosts. Topic wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated job field (job name/ID, client, backup server/set, policy, media/tape ID, repository, retention, restore point) or a backup artefact (LTO barcode, UNC path, GB/TB size, internal hostname, IPv4)), and 85 needs two distinct structures plus independent backup-type (full/incremental, offsite, immutable, air-gapped, tape) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic false positive

Jurisdictions

global

Regulations

Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:backup\s+(?:catalog(?:ue)?s?|index|inventory|job\s+(?:report|history|log))|media\s+(?:catalog|inventory)|restore\s+point\s+(?:list|catalog)|(?:Veeam|Commvault|NetBackup|Rubrik|Cohesity)\s+(?:catalog|job|report))\b

Corroborative evidence keywords

full backup, incremental, differential, offsite, immutable, air-gapped, deduplication, encryption, vault, tape

Proximity: 300 characters

Should match

• The backup catalog must be rebuilt after the media server upgrade. — Discovery probe (65)
• Veeam job report Job name: FIN-SQL-Nightly Repository: REPO-SYD-02 — Medium-tier probe (75) - populated job fields
• Backup catalog export - media server bkp01.harbour.internal Job name: FIN-SQL-Nightly Client: sql-fin-01 Tape barcode: HB0412L8 Retention: 35 days Size: 412.6 GB, incremental; weekly full backup copied offsite to the immutable vault. — High-tier probe (85) - several job fields, barcode/size/host artefacts, backup-type context

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: the backup catalog is reviewed monthly and retention follows the records schedule. — Policy text
• Backup catalog template Job name: ________ Client: [insert] — Blank template
• Course module 6: reading a NetBackup job report - Job name: TEST-01, Size: 10 GB. — Training framing

Known false positives

• Backup product documentation shows job fields. Mitigation: Fields must be populated; guidance/training framing is excluded.

References

• Information Security Manual (ISM)
• Emergency management (Department of Home Affairs)
• Disaster Assist
• APP Guidelines Chapter 11: APP 11 Security of personal information
• NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
• Security of Critical Infrastructure Act 2018 (Cth)