Configuration baseline snapshots

Name: Configuration baseline snapshots
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects configuration baseline snapshots: baseline/snapshot wording with actual device or OS configuration lines and populated snapshot metadata. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a device or OS configuration line (hostname/interface/ip address/snmp-server/access-list, Junos set, password/lockout/UAC/sshd settings) or a populated snapshot metadata field (captured/snapshot date, baseline version, device, OS version, build, firmware)), and 85 needs two distinct structures plus independent compliance-drift (drift, deviation, compliant, hardening) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:configuration\s+baseline|baseline\s+(?:configuration|snapshot|build)|golden\s+(?:image|config(?:uration)?)|(?:CIS|STIG|SOE)\s+baseline|running[\s-]config(?:uration)?\s+(?:backup|snapshot)|config(?:uration)?\s+snapshot)\b

Corroborative evidence keywords

drift, deviation, non-compliant, compliant, hardening, approved baseline, CIS Benchmark, checksum, version control, remediation

Proximity: 300 characters

Should match

The configuration baseline is reviewed after each major release. — Discovery probe (65)
Configuration baseline snapshot Device: core-sw01 OS version: IOS-XE 17.9.4 — Medium-tier probe (75) - populated snapshot metadata
Configuration baseline snapshot - core-sw01 Captured: 2026-09-18 02:00 OS version: IOS-XE 17.9.4 hostname core-sw01 interface GigabitEthernet1/0/1 ip address 10.20.0.1 255.255.255.0 snmp-server community H4rb0urRO RO Drift check: 2 deviations from the approved baseline (non-compliant). — High-tier probe (85) - several config lines, metadata and drift context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: all servers are built from the approved configuration baseline. — Policy text
Configuration baseline template Device: ________ OS version: [insert] — Blank template
Course module 5: a golden image baseline sets MinimumPasswordLength = 14 and PasswordComplexity = 1. — Training framing

Known false positives

Vendor hardening guides and CIS Benchmark documents quote settings. Mitigation: Guidance/training framing is excluded; 85 needs two configuration lines plus snapshot metadata.