Telecom core network configurations

Detects telecom core network configurations: mobile/IMS/EPC/5GC configuration wording with populated PLMN, APN, Diameter realm/peer, point-code and peer-address values, 3GPP realm FQDNs and core node names. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated network identifier (PLMN, MCC/MNC, TAC, APN/DNN, Diameter realm/host/peer, point code, global title, S-NSSAI, peer address) or a core artefact (3GPP realm FQDN such as epc.mncXXX.mccYYY.3gppnetwork.org, core node name like amf-prd-02, IPv4)), and 85 needs two distinct structures plus independent core-interface (N2/N3, S1-MME, S6a, Gx, SCTP, GTP-U, roaming, slicing) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth), Telecommunications Act 1997 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:mobile|telecom|packet|5G|4G|LTE|IMS|voice)\s+core\s+(?:network\s+)?(?:configuration|config|design|parameters?)|core\s+network\s+configuration|(?:EPC|5GC|HSS|UDM|MME|AMF|SMF|UPF|PGW|SGW|DRA|STP)\s+(?:configuration|config|parameters|dataset|export)|peering\s+configuration|interconnect\s+(?:configuration|parameters))\b

Corroborative evidence keywords

N2, N3, S1-MME, S6a, Gx, SCTP, GTP-U, roaming partner, interconnect, network slice, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data (+14 more)

Proximity: 300 characters

Should match

The mobile core configuration will be migrated to the new data centre. — Discovery probe (65)
5GC configuration - production PLMN ID: 505-01 DNN: enterprise.harbour — Medium-tier probe (75) - populated network identifiers
Mobile core configuration - production EPC PLMN ID: 505-01 APN: enterprise.harbour Diameter realm: epc.mnc001.mcc505.3gppnetwork.org Peer address: 10.44.2.8 (hss-prd-01) S6a over SCTP to the HSS; roaming partner interconnect via DRA dra-syd-01. — High-tier probe (85) - several identifiers, realm/node/IP artefacts and interface context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: core network configuration changes require security review under the carrier licence. — Policy text
Core network configuration template PLMN ID: ________ APN: [insert] — Blank template
Course module 5: a 5G core uses PLMN ID: 001-01 and the realm epc.mnc001.mcc001.3gppnetwork.org. — Training framing
telecom ims — Generic word pair

Known false positives

3GPP specifications and vendor training describe identifiers and interfaces. Mitigation: Guidance/training framing is excluded; 85 needs two populated identifiers plus a core artefact and interface context.