Scheduled maintenance plans

Name: Scheduled maintenance plans
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects scheduled maintenance plans: maintenance-window wording with dated time windows and populated affected-system, downtime and change fields. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a dated time window (date plus start-end time) or a populated scope field (affected systems/services/hosts, outage duration, change reference, engineer, rollback)), and 85 needs two distinct structures plus independent maintenance-activity (patching, firmware, reboot, failover, downtime) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:scheduled\s+maintenance|planned\s+(?:maintenance|outage)|maintenance\s+(?:window|plan|schedule|notification))\b

Corroborative evidence keywords

patching, firmware, reboot, failover, backout, downtime, service unavailable, read-only, cutover, upgrade

Proximity: 300 characters

Should match

Scheduled maintenance is planned for the payroll system next month. — Discovery probe (65)
Maintenance window Affected systems: payroll, rostering — Medium-tier probe (75) - populated scope field
Maintenance plan - core switching Window: 18/10/2026 22:00-02:00 Affected hosts: core-sw01, core-sw02 (10.20.0.1-2) Change ref: CHG0031611 Firmware upgrade with reboot; failover to core-sw02 during patching; expected downtime 15 minutes. — High-tier probe (85) - dated window, affected hosts, activity context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: planned maintenance must be notified to users five business days in advance. — Policy text
Maintenance notification template Window: ________ Affected systems: [insert] — Blank template
Media release: the bank will undertake scheduled maintenance on 18/10/2026 from 22:00 to 02:00; online banking will be unavailable. — Public media release

Known false positives

Public customer maintenance notices. Mitigation: News/press framing is excluded; 85 needs a window, affected systems and activity context. Public notices listing affected services can still reach 75.