Rail signaling configurations

Identifies substantive rail-signalling and train-control configuration records. Topic phrases are retained for discovery; enforcement requires interlocking, route-table, block, track-circuit, aspect, point-machine, or route-locking configuration content, and high confidence also requires a deployed control area, route, signal, track-circuit, station, or software reference.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence requires signalling configuration content rather than a rail-control topic alone. High confidence adds deployed route, signal, track, station, control-area, or software detail.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: GDPR
Data categories: security
Scope: wide
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:rail\s+signal(?:l)?ing\s+configuration|rail\s+signal\s+configuration|interlocking\s+configuration|route\s+setting\s+table|block\s+section\s+configuration|track\s+circuit\s+configuration|points\s+machine\s+configuration|aspect\s+sequence\s+table|ETCS\s+configuration|positive\s+train\s+control\s+configuration)\b

Corroborative evidence keywords

rail signaling configurations, rail, signaling, configurations, critical, infrastructure, systems

Proximity: 300 characters

Should match

rail signaling configuration — Low-tier probe - signalling topic without configuration content
Rail signaling configuration: interlocking table defines route locking, aspect sequence, block section, and point machine states — Medium-tier probe - substantive configuration content without deployed identifiers
Production rail signaling configuration for Central control area: route table entry R-17, signal ID S204, track circuit ID TC-12, overlap distance 180 m — High-tier probe - configuration content with deployed route, signal, track, and distance detail

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
placeholder value 12345 — Random text should not match topic-specific regex
rail signal configuration — Bare topic phrase surfaces only in discovery
The public signalling standard explains interlocking principles. — Public standard without deployed configuration content
Training example: production rail signaling configuration route R-17, signal ID S204, track circuit ID TC-12 — Explicit training content must not enforce

Known false positives

Rail standards, procurement documents, and signalling courses discuss interlocking, blocks, track circuits, point machines, routes, and aspects without exposing a deployed configuration. Mitigation: Keep topic-only matches discovery-only and require configuration-table or route-logic content for enforcement.
Training simulations can contain realistic route, signal, track-circuit, station, and software identifiers. Mitigation: Reject explicit template, demo, tutorial, sample-data, and training-example framing from enforcing tiers.

References

https://www.legislation.gov.au/C2018A00029/latest/text
https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism