Failover architecture details

Detects failover and high-availability architecture details: failover/DR/HA architecture wording with populated node, VIP, site and listener fields plus internal IPs or hostnames. Topic wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated node field (VIP, primary/secondary/standby node or site, DR site, listener, cluster name, witness) or a network artefact (IPv4 address, internal hostname)), and 85 needs two distinct structures plus independent replication/HA-mechanics (sync/async replication, quorum, split-brain, cutover) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic false positive

Jurisdictions

global

Regulations

Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

7

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:failover\s+(?:architecture|design|configuration|runbook|plan|procedure|topology)|disaster\s+recovery\s+(?:architecture|topology|runbook)|high[\s-]availability\s+(?:architecture|design|configuration|topology|cluster))\b

Corroborative evidence keywords

replication, synchronous, asynchronous, quorum, split-brain, RPO, RTO, DNS cutover, Always On, Pacemaker

Proximity: 300 characters

Should match

• The failover architecture will be reviewed after the data-centre migration. — Discovery probe (65)
• Failover configuration - payroll DB Primary node: sqlpay01 Standby node: sqlpay02 — Medium-tier probe (75) - populated node fields
• High-availability cluster design - payroll Primary node: sqlpay01.harbour.internal (10.20.8.11) Standby node: sqlpay02.harbour.internal (10.40.8.11) Listener: sqlpay-lsn, VIP: 10.20.8.50 Synchronous replication inside the site, asynchronous to the DR site; file-share witness prevents split-brain; DNS cutover for manual failover. — High-tier probe (85) - several node fields, IPs/hostnames and replication context

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: tier 1 systems require a documented failover design with annual testing. — Policy text
• Failover configuration template Primary node: ________ VIP: [insert] — Blank template
• Webinar notes: a high-availability cluster uses a witness and synchronous replication to avoid split-brain. — Webinar framing

Known false positives

• Cloud vendor reference architectures describe HA designs. Mitigation: Enforcement needs populated node fields or internal addresses; guidance/training framing is excluded.

References

• Information Security Manual (ISM)
• Emergency management (Department of Home Affairs)
• Disaster Assist
• APP Guidelines Chapter 11: APP 11 Security of personal information
• NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
• Security of Critical Infrastructure Act 2018 (Cth)