Major outage root-cause analyses

Detects major outage root-cause analyses: RCA or post-incident review wording with populated outage fields and technical artefacts (incident/change numbers, hosts, timestamps). Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated outage field (outage start/end/duration, impacted services, incident/problem/change number, severity) or a technical artefact (ServiceNow INC/CHG/PRB number, IPv4, internal hostname, timestamp)), and 85 needs two distinct structures plus independent RCA-outcome (contributing factors, corrective/preventive actions, lessons learned) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:root[\s-]cause\s+analys[ie]s|RCA\s+(?:report|document|findings)|post[\s-]incident\s+(?:review|report)|post[\s-]mortem|major\s+(?:incident|outage)\s+(?:report|review))\b

Corroborative evidence keywords

contributing factor, corrective action, preventive action, customer impact, lessons learned, action owner, failover, rollback, detection, mitigation, SCADA, [object Object], [object Object], [object Object], Modbus, Modbus TCP, Modbus RTU, DNP3, OPC-UA, OPC Classic (+36 more)

Proximity: 300 characters

Should match

A root cause analysis will be circulated after the outage. — Discovery probe (65)
Post-incident review Incident number: INC0041187 Duration: 3h 12m — Medium-tier probe (75) - populated outage fields
Major incident report - payroll outage Incident number: INC0041187 Outage start: 2026-09-12 07:02 Duration: 3h 12m Impacted services: payroll, rostering Change CHG0031542 rotated the certificate on lb01.harbour.internal; contributing factor: no rollback step. Corrective action owner: Infrastructure; lessons learned recorded. — High-tier probe (85) - several outage fields, artefacts and RCA outcome context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: a root cause analysis is required for every priority 1 incident. — Policy text
Post-incident review template Incident number: ________ Duration: [insert] — Blank template
Press release: the provider published its post-mortem after a four-hour outage on 12/09/2026. — News framing

Known false positives

Public status-page post-mortems. Mitigation: News/press framing is excluded; enforcement needs populated outage fields or internal artefacts.