Telecom core network configurations

Identifies substantive telecom core-network configuration records. Topic phrases are retained for discovery, while enforcement requires routing, subscriber, peering, node, or mobile-core configuration content; high confidence also requires evidence of a live network asset or identifier.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence requires configuration content rather than a carrier-architecture phrase alone. High confidence adds a live network, node, subscriber-domain, or production identifier, reducing matches on standards, vendor brochures, and public architecture material.

Detection quality

Topic false positive

Jurisdictions

global

Regulations

GDPR

Data categories

security

Scope

wide

Risk rating

10

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:telecom\s+core\s+network|mobile\s+core\s+network|core\s+network\s+configuration|subscriber\s+routing|EPC\s+configuration|5G\s+core|IMS\s+platform|signaling\s+gateway|telecom\s+network\s+element|backbone\s+network|peering\s+configuration)\b

Corroborative evidence keywords

telecom core network configurations, telecom, core, network, configurations, critical, infrastructure, systems, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data, bulk export, data dump (+12 more)

Proximity: 300 characters

Should match

• telecom core network configuration — Low-tier probe - carrier-core topic without configuration content
• 5G core configuration: subscriber routing, network slice policy, and Diameter peer settings — Medium-tier probe - substantive core configuration without a live asset identifier
• Production 5G core configuration for PLMN 50501: AMF node amf-prd-02, APN enterprise, Diameter peer 10.44.2.8 — High-tier probe - configuration content with production node and network identifiers

Should not match

• unrelated generic text without domain phrases — No relevant topic phrases present
• placeholder value 12345 — Random text should not match topic-specific regex
• telecom ims — Generic word pair from old broad template should not match
• The 3GPP guide describes a generic 5G core architecture for university teaching. — Public architecture prose without configuration content
• Training example: production 5G core configuration for PLMN 50501 with APN and Diameter peer — Explicit training content must not enforce

Known false positives

• Telecom standards, vendor reference architectures, and university material discuss 5G core, EPC, IMS, and signaling components without exposing an operator configuration. Mitigation: Keep topic-only matches discovery-only and require routing, subscriber, peering, or service-configuration content for enforcement.
• Labs and worked examples can include realistic PLMN, APN, node, and peer values. Mitigation: Reject explicit template, demo, tutorial, sample-data, and training-example framing from enforcing tiers.

References

• https://www.legislation.gov.au/C2018A00029/latest/text
• https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism