diff --git a/dlp-discovery-rules/beta_dlp_at_vat.yml b/dlp-discovery-rules/dlp_at_vat.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_at_vat.yml rename to dlp-discovery-rules/dlp_at_vat.yml index 15dce7969a0..83f5149d722 100644 --- a/dlp-discovery-rules/beta_dlp_at_vat.yml +++ b/dlp-discovery-rules/dlp_at_vat.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Austria VAT" +name: "DLP: Austria VAT" description: "Detects messages containing Austrian VAT numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_au_abn.yml b/dlp-discovery-rules/dlp_au_abn.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_au_abn.yml rename to dlp-discovery-rules/dlp_au_abn.yml index 22719d471da..8fccc2d32f1 100644 --- a/dlp-discovery-rules/beta_dlp_au_abn.yml +++ b/dlp-discovery-rules/dlp_au_abn.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Australia ABN" +name: "DLP: Australia ABN" description: "Detects messages containing Australian Business Numbers (ABN)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_au_bank_account.yml b/dlp-discovery-rules/dlp_au_bank_account.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_au_bank_account.yml rename to dlp-discovery-rules/dlp_au_bank_account.yml index ac859d44485..146538ad70d 100644 --- a/dlp-discovery-rules/beta_dlp_au_bank_account.yml +++ b/dlp-discovery-rules/dlp_au_bank_account.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Australia Bank Account" +name: "DLP: Australia Bank Account" description: "Detects messages containing Australian bank account numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_au_driver_license.yml b/dlp-discovery-rules/dlp_au_driver_license.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_au_driver_license.yml rename to dlp-discovery-rules/dlp_au_driver_license.yml index ee66a77ec5e..bc5dfd3992d 100644 --- a/dlp-discovery-rules/beta_dlp_au_driver_license.yml +++ b/dlp-discovery-rules/dlp_au_driver_license.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Australia Driver's License" +name: "DLP: Australia Driver's License" description: "Detects messages containing Australian driver's license numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_au_medicare.yml b/dlp-discovery-rules/dlp_au_medicare.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_au_medicare.yml rename to dlp-discovery-rules/dlp_au_medicare.yml index 6545b2f4bf7..30f51694600 100644 --- a/dlp-discovery-rules/beta_dlp_au_medicare.yml +++ b/dlp-discovery-rules/dlp_au_medicare.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Australia Medicare" +name: "DLP: Australia Medicare" description: "Detects messages containing Australian Medicare numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_au_passport.yml b/dlp-discovery-rules/dlp_au_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_au_passport.yml rename to dlp-discovery-rules/dlp_au_passport.yml index a01a0b6f214..2826aa62cbf 100644 --- a/dlp-discovery-rules/beta_dlp_au_passport.yml +++ b/dlp-discovery-rules/dlp_au_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Australia Passport Number" +name: "DLP: Australia Passport Number" description: "Detects messages containing Australian passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_au_tfn.yml b/dlp-discovery-rules/dlp_au_tfn.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_au_tfn.yml rename to dlp-discovery-rules/dlp_au_tfn.yml index 7a8caf64dd3..ef47bd7d26b 100644 --- a/dlp-discovery-rules/beta_dlp_au_tfn.yml +++ b/dlp-discovery-rules/dlp_au_tfn.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Australia Tax File Number" +name: "DLP: Australia Tax File Number" description: "Detects messages containing Australian Tax File Numbers (TFN)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_aws_access_key.yml b/dlp-discovery-rules/dlp_aws_access_key.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_aws_access_key.yml rename to dlp-discovery-rules/dlp_aws_access_key.yml index 6c5294b3753..6eb5a746a35 100644 --- a/dlp-discovery-rules/beta_dlp_aws_access_key.yml +++ b/dlp-discovery-rules/dlp_aws_access_key.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: AWS Access Key" +name: "DLP: AWS Access Key" description: "Detects messages containing AWS access keys." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_be_vat.yml b/dlp-discovery-rules/dlp_be_vat.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_be_vat.yml rename to dlp-discovery-rules/dlp_be_vat.yml index d31e9ee33e9..5043380e1df 100644 --- a/dlp-discovery-rules/beta_dlp_be_vat.yml +++ b/dlp-discovery-rules/dlp_be_vat.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Belgium VAT" +name: "DLP: Belgium VAT" description: "Detects messages containing Belgian VAT numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_ca_bank_account.yml b/dlp-discovery-rules/dlp_ca_bank_account.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_ca_bank_account.yml rename to dlp-discovery-rules/dlp_ca_bank_account.yml index 5e8f34304b8..aa82d350d98 100644 --- a/dlp-discovery-rules/beta_dlp_ca_bank_account.yml +++ b/dlp-discovery-rules/dlp_ca_bank_account.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Canada Bank Account" +name: "DLP: Canada Bank Account" description: "Detects messages containing Canadian bank account numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_ca_driver_license.yml b/dlp-discovery-rules/dlp_ca_driver_license.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_ca_driver_license.yml rename to dlp-discovery-rules/dlp_ca_driver_license.yml index b41b4bec252..ff8674eacda 100644 --- a/dlp-discovery-rules/beta_dlp_ca_driver_license.yml +++ b/dlp-discovery-rules/dlp_ca_driver_license.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Canada Driver's License" +name: "DLP: Canada Driver's License" description: "Detects messages containing Canadian driver's license numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_ca_health_service.yml b/dlp-discovery-rules/dlp_ca_health_service.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_ca_health_service.yml rename to dlp-discovery-rules/dlp_ca_health_service.yml index bad372e5289..0b504fbe5aa 100644 --- a/dlp-discovery-rules/beta_dlp_ca_health_service.yml +++ b/dlp-discovery-rules/dlp_ca_health_service.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Canada Health Service Number" +name: "DLP: Canada Health Service Number" description: "Detects messages containing Canadian health service numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_ca_passport.yml b/dlp-discovery-rules/dlp_ca_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_ca_passport.yml rename to dlp-discovery-rules/dlp_ca_passport.yml index 6ef454f40c4..22e612d4409 100644 --- a/dlp-discovery-rules/beta_dlp_ca_passport.yml +++ b/dlp-discovery-rules/dlp_ca_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Canada Passport Number" +name: "DLP: Canada Passport Number" description: "Detects messages containing Canadian passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_ca_phin.yml b/dlp-discovery-rules/dlp_ca_phin.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_ca_phin.yml rename to dlp-discovery-rules/dlp_ca_phin.yml index 90e2cdc90b6..d225f3acdda 100644 --- a/dlp-discovery-rules/beta_dlp_ca_phin.yml +++ b/dlp-discovery-rules/dlp_ca_phin.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Canada PHIN" +name: "DLP: Canada PHIN" description: "Detects messages containing Canadian Personal Health Identification Numbers (PHIN)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_canadian_sin.yml b/dlp-discovery-rules/dlp_canadian_sin.yml similarity index 95% rename from dlp-discovery-rules/beta_dlp_canadian_sin.yml rename to dlp-discovery-rules/dlp_canadian_sin.yml index c4910c4d97a..32a4e4e13de 100644 --- a/dlp-discovery-rules/beta_dlp_canadian_sin.yml +++ b/dlp-discovery-rules/dlp_canadian_sin.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Canadian Social Insurance Number (SIN)" +name: "DLP: Canadian Social Insurance Number (SIN)" description: "Detects messages containing Canadian Social Insurance Numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_clear_text_credentials_outbound.yml b/dlp-discovery-rules/dlp_clear_text_credentials_outbound.yml similarity index 100% rename from dlp-discovery-rules/beta_dlp_clear_text_credentials_outbound.yml rename to dlp-discovery-rules/dlp_clear_text_credentials_outbound.yml diff --git a/dlp-discovery-rules/beta_dlp_cn_prc_id.yml b/dlp-discovery-rules/dlp_cn_prc_id.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_cn_prc_id.yml rename to dlp-discovery-rules/dlp_cn_prc_id.yml index 3c26450b7bd..fc42abc82fa 100644 --- a/dlp-discovery-rules/beta_dlp_cn_prc_id.yml +++ b/dlp-discovery-rules/dlp_cn_prc_id.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: China Resident ID" +name: "DLP: China Resident ID" description: "Detects messages containing Chinese Resident Identity Card numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml b/dlp-discovery-rules/dlp_crypto_wallet_address.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml rename to dlp-discovery-rules/dlp_crypto_wallet_address.yml index dc138f813e4..63958bc2413 100644 --- a/dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml +++ b/dlp-discovery-rules/dlp_crypto_wallet_address.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Crypto Wallet Address" +name: "DLP: Crypto Wallet Address" description: "Detects messages containing cryptocurrency wallet addresses." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/dlp_de_driver_license.yml b/dlp-discovery-rules/dlp_de_driver_license.yml new file mode 100644 index 00000000000..e656aac0071 --- /dev/null +++ b/dlp-discovery-rules/dlp_de_driver_license.yml @@ -0,0 +1,47 @@ +name: "DLP: Germany Driver's License" +description: "Detects messages containing Germany driver's license numbers." +type: "dlp" +severity: "high" +attack_types: + - "DLP: Personal Data" +tags: + - "Personal data" + - "GDPR" + - "EU" + - "Germany" +source: | + // + // This rule makes use of a beta feature and is subject to change without notice + // using the beta feature in custom rules is not suggested until it has been formally released + // + // NOTE: This rule depends on the de_driver_license recognizer in Hydra — do not ship until recognizer is merged + // + type.outbound + and ( + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type == "de_driver_license" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type == "de_driver_license" and .confidence in ("medium", "high") + ) + or any(attachments, + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "de_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "de_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) + ) + ) +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "File analysis" + - "Optical Character Recognition" +id: "f1285490-ddcb-50f7-a638-2f60cfb4ed58" diff --git a/dlp-discovery-rules/beta_dlp_de_passport.yml b/dlp-discovery-rules/dlp_de_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_de_passport.yml rename to dlp-discovery-rules/dlp_de_passport.yml index 06c65d5756f..368873f56fc 100644 --- a/dlp-discovery-rules/beta_dlp_de_passport.yml +++ b/dlp-discovery-rules/dlp_de_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Germany Passport Number" +name: "DLP: Germany Passport Number" description: "Detects messages containing German passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_de_personalausweis.yml b/dlp-discovery-rules/dlp_de_personalausweis.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_de_personalausweis.yml rename to dlp-discovery-rules/dlp_de_personalausweis.yml index d2da46b60e9..3bf3b08e29e 100644 --- a/dlp-discovery-rules/beta_dlp_de_personalausweis.yml +++ b/dlp-discovery-rules/dlp_de_personalausweis.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Germany Identity Card (Personalausweis)" +name: "DLP: Germany Identity Card (Personalausweis)" description: "Detects messages containing German national identity card numbers (Personalausweis)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_de_tax_id.yml b/dlp-discovery-rules/dlp_de_tax_id.yml similarity index 95% rename from dlp-discovery-rules/beta_dlp_de_tax_id.yml rename to dlp-discovery-rules/dlp_de_tax_id.yml index 15454e6b3c4..681b2ad92b7 100644 --- a/dlp-discovery-rules/beta_dlp_de_tax_id.yml +++ b/dlp-discovery-rules/dlp_de_tax_id.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Germany Tax ID (Steueridentifikationsnummer)" +name: "DLP: Germany Tax ID (Steueridentifikationsnummer)" description: "Detects messages containing German tax identification numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_de_vat.yml b/dlp-discovery-rules/dlp_de_vat.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_de_vat.yml rename to dlp-discovery-rules/dlp_de_vat.yml index 11c92017d67..a0a42d2f96d 100644 --- a/dlp-discovery-rules/beta_dlp_de_vat.yml +++ b/dlp-discovery-rules/dlp_de_vat.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Germany VAT" +name: "DLP: Germany VAT" description: "Detects messages containing German VAT numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_es_bank_account.yml b/dlp-discovery-rules/dlp_es_bank_account.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_es_bank_account.yml rename to dlp-discovery-rules/dlp_es_bank_account.yml index a588a3377f1..28e4f555787 100644 --- a/dlp-discovery-rules/beta_dlp_es_bank_account.yml +++ b/dlp-discovery-rules/dlp_es_bank_account.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Spain Bank Account" +name: "DLP: Spain Bank Account" description: "Detects messages containing Spanish bank account numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_es_id.yml b/dlp-discovery-rules/dlp_es_id.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_es_id.yml rename to dlp-discovery-rules/dlp_es_id.yml index 2bc043251fd..ca135bd5063 100644 --- a/dlp-discovery-rules/beta_dlp_es_id.yml +++ b/dlp-discovery-rules/dlp_es_id.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID" +name: "DLP: Spain DNI/NIE / Passport / SSN / Tax ID" description: "Detects messages containing Spanish national identity, passport, social security, or tax identification numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_es_passport.yml b/dlp-discovery-rules/dlp_es_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_es_passport.yml rename to dlp-discovery-rules/dlp_es_passport.yml index 7b56dbf1187..693209b6240 100644 --- a/dlp-discovery-rules/beta_dlp_es_passport.yml +++ b/dlp-discovery-rules/dlp_es_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Spain Passport Number" +name: "DLP: Spain Passport Number" description: "Detects messages containing Spanish passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/dlp_fi_driver_license.yml b/dlp-discovery-rules/dlp_fi_driver_license.yml new file mode 100644 index 00000000000..15e3925daf1 --- /dev/null +++ b/dlp-discovery-rules/dlp_fi_driver_license.yml @@ -0,0 +1,47 @@ +name: "DLP: Finland Driver's License" +description: "Detects messages containing Finland driver's license numbers." +type: "dlp" +severity: "high" +attack_types: + - "DLP: Personal Data" +tags: + - "Personal data" + - "GDPR" + - "EU" + - "Finland" +source: | + // + // This rule makes use of a beta feature and is subject to change without notice + // using the beta feature in custom rules is not suggested until it has been formally released + // + // NOTE: This rule depends on the fi_driver_license recognizer in Hydra — do not ship until recognizer is merged + // + type.outbound + and ( + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type == "fi_driver_license" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type == "fi_driver_license" and .confidence in ("medium", "high") + ) + or any(attachments, + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fi_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fi_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) + ) + ) +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "File analysis" + - "Optical Character Recognition" +id: "06a2c875-075c-53ad-8b39-34ea7760e5fd" diff --git a/dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml b/dlp-discovery-rules/dlp_fi_european_health_insurance.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml rename to dlp-discovery-rules/dlp_fi_european_health_insurance.yml index cfb2a2f46a9..f4cb446c459 100644 --- a/dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml +++ b/dlp-discovery-rules/dlp_fi_european_health_insurance.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Finland European Health Insurance" +name: "DLP: Finland European Health Insurance" description: "Detects messages containing Finnish European Health Insurance card numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_fr_bank_account.yml b/dlp-discovery-rules/dlp_fr_bank_account.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_fr_bank_account.yml rename to dlp-discovery-rules/dlp_fr_bank_account.yml index fcadd902ac0..2ba453d5460 100644 --- a/dlp-discovery-rules/beta_dlp_fr_bank_account.yml +++ b/dlp-discovery-rules/dlp_fr_bank_account.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: France Bank Account" +name: "DLP: France Bank Account" description: "Detects messages containing French bank account numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_fr_cni.yml b/dlp-discovery-rules/dlp_fr_cni.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_fr_cni.yml rename to dlp-discovery-rules/dlp_fr_cni.yml index 00cc6db151d..fff85ffa938 100644 --- a/dlp-discovery-rules/beta_dlp_fr_cni.yml +++ b/dlp-discovery-rules/dlp_fr_cni.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: France National ID (CNI)" +name: "DLP: France National ID (CNI)" description: "Detects messages containing French national identity card numbers (CNI)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_fr_driver_license.yml b/dlp-discovery-rules/dlp_fr_driver_license.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_fr_driver_license.yml rename to dlp-discovery-rules/dlp_fr_driver_license.yml index 6afe6cf4d6a..6dd830b3f5d 100644 --- a/dlp-discovery-rules/beta_dlp_fr_driver_license.yml +++ b/dlp-discovery-rules/dlp_fr_driver_license.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: France Driver's License" +name: "DLP: France Driver's License" description: "Detects messages containing French driver's license numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_fr_insee.yml b/dlp-discovery-rules/dlp_fr_insee.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_fr_insee.yml rename to dlp-discovery-rules/dlp_fr_insee.yml index a14899acd0e..e288b9d4805 100644 --- a/dlp-discovery-rules/beta_dlp_fr_insee.yml +++ b/dlp-discovery-rules/dlp_fr_insee.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: France Social Security Number (INSEE)" +name: "DLP: France Social Security Number (INSEE)" description: "Detects messages containing French social security numbers (INSEE)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_fr_passport.yml b/dlp-discovery-rules/dlp_fr_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_fr_passport.yml rename to dlp-discovery-rules/dlp_fr_passport.yml index 1b8aed30661..42bc06cd7b7 100644 --- a/dlp-discovery-rules/beta_dlp_fr_passport.yml +++ b/dlp-discovery-rules/dlp_fr_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: France Passport Number" +name: "DLP: France Passport Number" description: "Detects messages containing French passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_fr_vat.yml b/dlp-discovery-rules/dlp_fr_vat.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_fr_vat.yml rename to dlp-discovery-rules/dlp_fr_vat.yml index 55e132700ba..4c0d589a59c 100644 --- a/dlp-discovery-rules/beta_dlp_fr_vat.yml +++ b/dlp-discovery-rules/dlp_fr_vat.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: France VAT" +name: "DLP: France VAT" description: "Detects messages containing French VAT numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_github_token.yml b/dlp-discovery-rules/dlp_github_token.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_github_token.yml rename to dlp-discovery-rules/dlp_github_token.yml index d7fd48b6180..6b182f617b5 100644 --- a/dlp-discovery-rules/beta_dlp_github_token.yml +++ b/dlp-discovery-rules/dlp_github_token.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: GitHub Token" +name: "DLP: GitHub Token" description: "Detects messages containing GitHub tokens." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_google_api_key.yml b/dlp-discovery-rules/dlp_google_api_key.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_google_api_key.yml rename to dlp-discovery-rules/dlp_google_api_key.yml index bee5998af6c..6259eb705f5 100644 --- a/dlp-discovery-rules/beta_dlp_google_api_key.yml +++ b/dlp-discovery-rules/dlp_google_api_key.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Google / GCP API Key" +name: "DLP: Google / GCP API Key" description: "Detects messages containing Google or GCP API keys." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/dlp_gr_driver_license.yml b/dlp-discovery-rules/dlp_gr_driver_license.yml new file mode 100644 index 00000000000..462fe714e68 --- /dev/null +++ b/dlp-discovery-rules/dlp_gr_driver_license.yml @@ -0,0 +1,47 @@ +name: "DLP: Greece Driver's License" +description: "Detects messages containing Greece driver's license numbers." +type: "dlp" +severity: "high" +attack_types: + - "DLP: Personal Data" +tags: + - "Personal data" + - "GDPR" + - "EU" + - "Greece" +source: | + // + // This rule makes use of a beta feature and is subject to change without notice + // using the beta feature in custom rules is not suggested until it has been formally released + // + // NOTE: This rule depends on the gr_driver_license recognizer in Hydra — do not ship until recognizer is merged + // + type.outbound + and ( + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type == "gr_driver_license" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type == "gr_driver_license" and .confidence in ("medium", "high") + ) + or any(attachments, + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "gr_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "gr_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) + ) + ) +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "File analysis" + - "Optical Character Recognition" +id: "e2ea2304-397e-5468-9234-4edec9f77199" diff --git a/dlp-discovery-rules/beta_dlp_http_authorization_header.yml b/dlp-discovery-rules/dlp_http_authorization_header.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_http_authorization_header.yml rename to dlp-discovery-rules/dlp_http_authorization_header.yml index d56b8f1c085..0f2f3f060cf 100644 --- a/dlp-discovery-rules/beta_dlp_http_authorization_header.yml +++ b/dlp-discovery-rules/dlp_http_authorization_header.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Basic Auth Header" +name: "DLP: Basic Auth Header" description: "Detects messages containing basic authentication headers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_hu_taj.yml b/dlp-discovery-rules/dlp_hu_taj.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_hu_taj.yml rename to dlp-discovery-rules/dlp_hu_taj.yml index 2b8af4f6309..5dc74e4efa2 100644 --- a/dlp-discovery-rules/beta_dlp_hu_taj.yml +++ b/dlp-discovery-rules/dlp_hu_taj.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Hungary TAJ" +name: "DLP: Hungary TAJ" description: "Detects messages containing Hungarian social security (TAJ) numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_hu_vat.yml b/dlp-discovery-rules/dlp_hu_vat.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_hu_vat.yml rename to dlp-discovery-rules/dlp_hu_vat.yml index 501ada3712f..a6221b6e7bc 100644 --- a/dlp-discovery-rules/beta_dlp_hu_vat.yml +++ b/dlp-discovery-rules/dlp_hu_vat.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Hungary VAT" +name: "DLP: Hungary VAT" description: "Detects messages containing Hungarian VAT numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_iban_code.yml b/dlp-discovery-rules/dlp_iban_code.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_iban_code.yml rename to dlp-discovery-rules/dlp_iban_code.yml index ce5656c0cfa..b2d699721c0 100644 --- a/dlp-discovery-rules/beta_dlp_iban_code.yml +++ b/dlp-discovery-rules/dlp_iban_code.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: IBAN Code" +name: "DLP: IBAN Code" description: "Detects messages containing IBAN codes." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/dlp_ie_driver_license.yml b/dlp-discovery-rules/dlp_ie_driver_license.yml new file mode 100644 index 00000000000..2383e4376bc --- /dev/null +++ b/dlp-discovery-rules/dlp_ie_driver_license.yml @@ -0,0 +1,35 @@ +name: "DLP: Ireland Driver's License" +type: "dlp" +severity: "high" +source: | + // NOTE: This rule depends on the ie_driver_license recognizer in Hydra — do not ship until recognizer is merged + // Ireland driver number: 9 digits (field 4d on plastic card). Field 5 format unknown. + // Do NOT use Purview's "6 digits + 4 letters" — contradicted by NDLS. + type.outbound + and ( + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type == "ie_driver_license" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type == "ie_driver_license" and .confidence in ("medium", "high") + ) + or any(attachments, + any(file.explode(.), + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ie_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ie_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) + ) +attack_types: + - "DLP: Personal Data" +tags: + - "Personal data" + - "GDPR" + - "Ireland" +id: "8946d1c2-e0da-577b-b481-391e1ca936a6" diff --git a/dlp-discovery-rules/beta_dlp_jp_driver_license.yml b/dlp-discovery-rules/dlp_jp_driver_license.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_jp_driver_license.yml rename to dlp-discovery-rules/dlp_jp_driver_license.yml index 63d0349ef9f..d0d5fe4eeba 100644 --- a/dlp-discovery-rules/beta_dlp_jp_driver_license.yml +++ b/dlp-discovery-rules/dlp_jp_driver_license.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Japan Driver's License" +name: "DLP: Japan Driver's License" description: "Detects messages containing Japanese driver's license numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_jp_my_number.yml b/dlp-discovery-rules/dlp_jp_my_number.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_jp_my_number.yml rename to dlp-discovery-rules/dlp_jp_my_number.yml index 597246f36da..834322dfcdf 100644 --- a/dlp-discovery-rules/beta_dlp_jp_my_number.yml +++ b/dlp-discovery-rules/dlp_jp_my_number.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Japan MyNumber ID" +name: "DLP: Japan MyNumber ID" description: "Detects messages containing Japanese My Number (Individual Number) identifiers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_jp_passport.yml b/dlp-discovery-rules/dlp_jp_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_jp_passport.yml rename to dlp-discovery-rules/dlp_jp_passport.yml index 6d8dbb163b1..092e45ab3e0 100644 --- a/dlp-discovery-rules/beta_dlp_jp_passport.yml +++ b/dlp-discovery-rules/dlp_jp_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Japan Passport Number" +name: "DLP: Japan Passport Number" description: "Detects messages containing Japanese passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_jwt.yml b/dlp-discovery-rules/dlp_jwt.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_jwt.yml rename to dlp-discovery-rules/dlp_jwt.yml index dcf0cf6748d..aa6ae29f68d 100644 --- a/dlp-discovery-rules/beta_dlp_jwt.yml +++ b/dlp-discovery-rules/dlp_jwt.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: JSON Web Token (JWT)" +name: "DLP: JSON Web Token (JWT)" description: "Detects messages containing JSON Web Tokens (JWT)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_kr_rrn.yml b/dlp-discovery-rules/dlp_kr_rrn.yml similarity index 95% rename from dlp-discovery-rules/beta_dlp_kr_rrn.yml rename to dlp-discovery-rules/dlp_kr_rrn.yml index 2cd3cccd56c..ff69ee27c15 100644 --- a/dlp-discovery-rules/beta_dlp_kr_rrn.yml +++ b/dlp-discovery-rules/dlp_kr_rrn.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: South Korea Resident Registration Number" +name: "DLP: South Korea Resident Registration Number" description: "Detects messages containing South Korean Resident Registration Numbers (RRN)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml b/dlp-discovery-rules/dlp_luxembourg_nonnatural_id.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml rename to dlp-discovery-rules/dlp_luxembourg_nonnatural_id.yml index 95094c434fb..66f78f5daf0 100644 --- a/dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml +++ b/dlp-discovery-rules/dlp_luxembourg_nonnatural_id.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Luxembourg Non-Natural ID" +name: "DLP: Luxembourg Non-Natural ID" description: "Detects messages containing Luxembourg non-natural person identification numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_mac_address.yml b/dlp-discovery-rules/dlp_mac_address.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_mac_address.yml rename to dlp-discovery-rules/dlp_mac_address.yml index d1f69d8acc0..36d39418d7c 100644 --- a/dlp-discovery-rules/beta_dlp_mac_address.yml +++ b/dlp-discovery-rules/dlp_mac_address.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: MAC Address" +name: "DLP: MAC Address" description: "Detects messages containing MAC addresses." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_nl_bsn.yml b/dlp-discovery-rules/dlp_nl_bsn.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_nl_bsn.yml rename to dlp-discovery-rules/dlp_nl_bsn.yml index 0a60daae890..67c545f769c 100644 --- a/dlp-discovery-rules/beta_dlp_nl_bsn.yml +++ b/dlp-discovery-rules/dlp_nl_bsn.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Netherlands BSN / Tax ID" +name: "DLP: Netherlands BSN / Tax ID" description: "Detects messages containing Dutch Burger Service Numbers (BSN) or tax identification numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/dlp_nl_driver_license.yml b/dlp-discovery-rules/dlp_nl_driver_license.yml new file mode 100644 index 00000000000..22739383b7e --- /dev/null +++ b/dlp-discovery-rules/dlp_nl_driver_license.yml @@ -0,0 +1,47 @@ +name: "DLP: Netherlands Driver's License" +description: "Detects messages containing Netherlands driver's license numbers." +type: "dlp" +severity: "high" +attack_types: + - "DLP: Personal Data" +tags: + - "Personal data" + - "GDPR" + - "EU" + - "Netherlands" +source: | + // + // This rule makes use of a beta feature and is subject to change without notice + // using the beta feature in custom rules is not suggested until it has been formally released + // + // NOTE: This rule depends on the nl_driver_license recognizer in Hydra — do not ship until recognizer is merged + // + type.outbound + and ( + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type == "nl_driver_license" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type == "nl_driver_license" and .confidence in ("medium", "high") + ) + or any(attachments, + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "nl_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "nl_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) + ) + ) +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "File analysis" + - "Optical Character Recognition" +id: "36e381c9-4531-5176-8ebe-d18ece75ad3d" diff --git a/dlp-discovery-rules/beta_dlp_nl_vat.yml b/dlp-discovery-rules/dlp_nl_vat.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_nl_vat.yml rename to dlp-discovery-rules/dlp_nl_vat.yml index 905c249e3ba..2749961e37a 100644 --- a/dlp-discovery-rules/beta_dlp_nl_vat.yml +++ b/dlp-discovery-rules/dlp_nl_vat.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Netherlands VAT" +name: "DLP: Netherlands VAT" description: "Detects messages containing Netherlands VAT numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_nz_bank_account.yml b/dlp-discovery-rules/dlp_nz_bank_account.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_nz_bank_account.yml rename to dlp-discovery-rules/dlp_nz_bank_account.yml index 4a62d225f45..58c708a60e8 100644 --- a/dlp-discovery-rules/beta_dlp_nz_bank_account.yml +++ b/dlp-discovery-rules/dlp_nz_bank_account.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: New Zealand Bank Account" +name: "DLP: New Zealand Bank Account" description: "Detects messages containing New Zealand bank account numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_nz_moh.yml b/dlp-discovery-rules/dlp_nz_moh.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_nz_moh.yml rename to dlp-discovery-rules/dlp_nz_moh.yml index f8ca389ed02..0345a918d1a 100644 --- a/dlp-discovery-rules/beta_dlp_nz_moh.yml +++ b/dlp-discovery-rules/dlp_nz_moh.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: New Zealand MOH" +name: "DLP: New Zealand MOH" description: "Detects messages containing New Zealand Ministry of Health numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_oauth_client_secret.yml b/dlp-discovery-rules/dlp_oauth_client_secret.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_oauth_client_secret.yml rename to dlp-discovery-rules/dlp_oauth_client_secret.yml index 6d7238da6dc..55ad812f154 100644 --- a/dlp-discovery-rules/beta_dlp_oauth_client_secret.yml +++ b/dlp-discovery-rules/dlp_oauth_client_secret.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: OAuth Client Secret" +name: "DLP: OAuth Client Secret" description: "Detects messages containing OAuth client secrets." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml b/dlp-discovery-rules/dlp_pci_us_credit_card_any.yml similarity index 95% rename from dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml rename to dlp-discovery-rules/dlp_pci_us_credit_card_any.yml index 6074c2a88a7..8b4a2e575c6 100644 --- a/dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml +++ b/dlp-discovery-rules/dlp_pci_us_credit_card_any.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: PCI US Credit Card Number (Any Network)" +name: "DLP: PCI US Credit Card Number (Any Network)" description: "Detects messages containing credit card numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/dlp_pl_driver_license.yml b/dlp-discovery-rules/dlp_pl_driver_license.yml new file mode 100644 index 00000000000..b5645acbd5c --- /dev/null +++ b/dlp-discovery-rules/dlp_pl_driver_license.yml @@ -0,0 +1,47 @@ +name: "DLP: Poland Driver's License" +description: "Detects messages containing Poland driver's license numbers." +type: "dlp" +severity: "high" +attack_types: + - "DLP: Personal Data" +tags: + - "Personal data" + - "GDPR" + - "EU" + - "Poland" +source: | + // + // This rule makes use of a beta feature and is subject to change without notice + // using the beta feature in custom rules is not suggested until it has been formally released + // + // NOTE: This rule depends on the pl_driver_license recognizer in Hydra — do not ship until recognizer is merged + // + type.outbound + and ( + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type == "pl_driver_license" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type == "pl_driver_license" and .confidence in ("medium", "high") + ) + or any(attachments, + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "pl_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "pl_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) + ) + ) +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "File analysis" + - "Optical Character Recognition" +id: "6732b353-2004-563b-b7bc-a2515e03fc5f" diff --git a/dlp-discovery-rules/beta_dlp_pl_regon.yml b/dlp-discovery-rules/dlp_pl_regon.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_pl_regon.yml rename to dlp-discovery-rules/dlp_pl_regon.yml index f97d564940f..b725d8dbb32 100644 --- a/dlp-discovery-rules/beta_dlp_pl_regon.yml +++ b/dlp-discovery-rules/dlp_pl_regon.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Poland REGON" +name: "DLP: Poland REGON" description: "Detects messages containing Polish REGON business registration numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_private_key.yml b/dlp-discovery-rules/dlp_private_key.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_private_key.yml rename to dlp-discovery-rules/dlp_private_key.yml index 7461bc1ece9..f94d337d642 100644 --- a/dlp-discovery-rules/beta_dlp_private_key.yml +++ b/dlp-discovery-rules/dlp_private_key.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Private Key" +name: "DLP: Private Key" description: "Detects messages containing private keys." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_se_personnummer.yml b/dlp-discovery-rules/dlp_se_personnummer.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_se_personnummer.yml rename to dlp-discovery-rules/dlp_se_personnummer.yml index ef7b9c10d2a..7bf7617f131 100644 --- a/dlp-discovery-rules/beta_dlp_se_personnummer.yml +++ b/dlp-discovery-rules/dlp_se_personnummer.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Sweden Personnummer / Tax ID" +name: "DLP: Sweden Personnummer / Tax ID" description: "Detects messages containing Swedish personal identity numbers (personnummer) or tax identification numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_sg_nric.yml b/dlp-discovery-rules/dlp_sg_nric.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_sg_nric.yml rename to dlp-discovery-rules/dlp_sg_nric.yml index 9853bfa0475..c86c91f1c30 100644 --- a/dlp-discovery-rules/beta_dlp_sg_nric.yml +++ b/dlp-discovery-rules/dlp_sg_nric.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Singapore NRIC" +name: "DLP: Singapore NRIC" description: "Detects messages containing Singapore National Registration Identity Card (NRIC) numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_sg_uen.yml b/dlp-discovery-rules/dlp_sg_uen.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_sg_uen.yml rename to dlp-discovery-rules/dlp_sg_uen.yml index d9a6714af23..1c22bf7cb52 100644 --- a/dlp-discovery-rules/beta_dlp_sg_uen.yml +++ b/dlp-discovery-rules/dlp_sg_uen.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Singapore UEN" +name: "DLP: Singapore UEN" description: "Detects messages containing Singapore Unique Entity Numbers (UEN)." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_slack_access_token.yml b/dlp-discovery-rules/dlp_slack_access_token.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_slack_access_token.yml rename to dlp-discovery-rules/dlp_slack_access_token.yml index 79170f6d7bd..69f939d7b7f 100644 --- a/dlp-discovery-rules/beta_dlp_slack_access_token.yml +++ b/dlp-discovery-rules/dlp_slack_access_token.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Slack Access Token" +name: "DLP: Slack Access Token" description: "Detects messages containing Slack access tokens." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_ssl_certificate.yml b/dlp-discovery-rules/dlp_ssl_certificate.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_ssl_certificate.yml rename to dlp-discovery-rules/dlp_ssl_certificate.yml index a0ed94a4d32..9d0abce0e41 100644 --- a/dlp-discovery-rules/beta_dlp_ssl_certificate.yml +++ b/dlp-discovery-rules/dlp_ssl_certificate.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: SSL/TLS Certificate" +name: "DLP: SSL/TLS Certificate" description: "Detects messages containing SSL/TLS certificates." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_swift_bic.yml b/dlp-discovery-rules/dlp_swift_bic.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_swift_bic.yml rename to dlp-discovery-rules/dlp_swift_bic.yml index 6fca4a909e6..0e7e4b2af05 100644 --- a/dlp-discovery-rules/beta_dlp_swift_bic.yml +++ b/dlp-discovery-rules/dlp_swift_bic.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: SWIFT/BIC Code" +name: "DLP: SWIFT/BIC Code" description: "Detects outbound messages containing SWIFT/BIC codes. SWIFT codes are used to identify banks and financial institutions globally and may indicate financial account details being shared externally." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_uk_drivers_license.yml b/dlp-discovery-rules/dlp_uk_drivers_license.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_uk_drivers_license.yml rename to dlp-discovery-rules/dlp_uk_drivers_license.yml index 50000eb8bf0..b4542316214 100644 --- a/dlp-discovery-rules/beta_dlp_uk_drivers_license.yml +++ b/dlp-discovery-rules/dlp_uk_drivers_license.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: UK Driver's License" +name: "DLP: UK Driver's License" description: "Detects messages containing UK driver's license numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_uk_nhs_number.yml b/dlp-discovery-rules/dlp_uk_nhs_number.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_uk_nhs_number.yml rename to dlp-discovery-rules/dlp_uk_nhs_number.yml index 2ed44af53dc..b920fbc9ba3 100644 --- a/dlp-discovery-rules/beta_dlp_uk_nhs_number.yml +++ b/dlp-discovery-rules/dlp_uk_nhs_number.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: NHS Number" +name: "DLP: NHS Number" description: "Detects messages containing UK NHS numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_uk_nino.yml b/dlp-discovery-rules/dlp_uk_nino.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_uk_nino.yml rename to dlp-discovery-rules/dlp_uk_nino.yml index 7d4d518de90..3890d158f0e 100644 --- a/dlp-discovery-rules/beta_dlp_uk_nino.yml +++ b/dlp-discovery-rules/dlp_uk_nino.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: UK National Insurance Number" +name: "DLP: UK National Insurance Number" description: "Detects messages containing UK National Insurance numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_uk_passport.yml b/dlp-discovery-rules/dlp_uk_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_uk_passport.yml rename to dlp-discovery-rules/dlp_uk_passport.yml index 3b96261ebb6..aed6f5f801c 100644 --- a/dlp-discovery-rules/beta_dlp_uk_passport.yml +++ b/dlp-discovery-rules/dlp_uk_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: UK Passport" +name: "DLP: UK Passport" description: "Detects messages containing UK passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_uk_utr.yml b/dlp-discovery-rules/dlp_uk_utr.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_uk_utr.yml rename to dlp-discovery-rules/dlp_uk_utr.yml index bab3c852b3e..74214951129 100644 --- a/dlp-discovery-rules/beta_dlp_uk_utr.yml +++ b/dlp-discovery-rules/dlp_uk_utr.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: UK UTR (Tax)" +name: "DLP: UK UTR (Tax)" description: "Detects messages containing UK Unique Taxpayer Reference numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml b/dlp-discovery-rules/dlp_us_aba_routing_number.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml rename to dlp-discovery-rules/dlp_us_aba_routing_number.yml index 6c221db2410..a6eeca34169 100644 --- a/dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml +++ b/dlp-discovery-rules/dlp_us_aba_routing_number.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US ABA Routing Number" +name: "DLP: US ABA Routing Number" description: "Detects messages containing US ABA routing numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_bank_account.yml b/dlp-discovery-rules/dlp_us_bank_account.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_us_bank_account.yml rename to dlp-discovery-rules/dlp_us_bank_account.yml index e04e9e928ba..de6b4f89b39 100644 --- a/dlp-discovery-rules/beta_dlp_us_bank_account.yml +++ b/dlp-discovery-rules/dlp_us_bank_account.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US Bank Account Number" +name: "DLP: US Bank Account Number" description: "Detects messages containing US bank account numbers." type: "dlp" severity: "medium" diff --git a/dlp-discovery-rules/beta_dlp_us_dea_number.yml b/dlp-discovery-rules/dlp_us_dea_number.yml similarity index 98% rename from dlp-discovery-rules/beta_dlp_us_dea_number.yml rename to dlp-discovery-rules/dlp_us_dea_number.yml index b9b962b24e8..139ba563b13 100644 --- a/dlp-discovery-rules/beta_dlp_us_dea_number.yml +++ b/dlp-discovery-rules/dlp_us_dea_number.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: DEA Number" +name: "DLP: DEA Number" description: "Detects messages containing US Drug Enforcement Administration (DEA) numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_driver_license.yml b/dlp-discovery-rules/dlp_us_driver_license.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_us_driver_license.yml rename to dlp-discovery-rules/dlp_us_driver_license.yml index 8429bab4ce5..60d79936dad 100644 --- a/dlp-discovery-rules/beta_dlp_us_driver_license.yml +++ b/dlp-discovery-rules/dlp_us_driver_license.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US Driver's License" +name: "DLP: US Driver's License" description: "Detects messages containing US driver's license numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_icd10.yml b/dlp-discovery-rules/dlp_us_icd10.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_us_icd10.yml rename to dlp-discovery-rules/dlp_us_icd10.yml index aa52a252c25..1beb7a159e5 100644 --- a/dlp-discovery-rules/beta_dlp_us_icd10.yml +++ b/dlp-discovery-rules/dlp_us_icd10.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: ICD-10 Code" +name: "DLP: ICD-10 Code" description: "Detects messages containing ICD-10 medical diagnosis codes." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_icd9.yml b/dlp-discovery-rules/dlp_us_icd9.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_us_icd9.yml rename to dlp-discovery-rules/dlp_us_icd9.yml index 7449720f107..227e6a3b951 100644 --- a/dlp-discovery-rules/beta_dlp_us_icd9.yml +++ b/dlp-discovery-rules/dlp_us_icd9.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: ICD-9 Code" +name: "DLP: ICD-9 Code" description: "Detects messages containing ICD-9 medical diagnosis codes." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_itin.yml b/dlp-discovery-rules/dlp_us_itin.yml similarity index 94% rename from dlp-discovery-rules/beta_dlp_us_itin.yml rename to dlp-discovery-rules/dlp_us_itin.yml index d29056a5d66..9676ce7801e 100644 --- a/dlp-discovery-rules/beta_dlp_us_itin.yml +++ b/dlp-discovery-rules/dlp_us_itin.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US Individual Taxpayer Identification Number (ITIN)" +name: "DLP: US Individual Taxpayer Identification Number (ITIN)" description: "Detects messages containing US Individual Taxpayer Identification Numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml b/dlp-discovery-rules/dlp_us_medicare_beneficiary_id.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml rename to dlp-discovery-rules/dlp_us_medicare_beneficiary_id.yml index 4da9a069b2f..91d3be7f7ea 100644 --- a/dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml +++ b/dlp-discovery-rules/dlp_us_medicare_beneficiary_id.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US Medicare Beneficiary ID" +name: "DLP: US Medicare Beneficiary ID" description: "Detects messages containing US Medicare Beneficiary Identification numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_npi.yml b/dlp-discovery-rules/dlp_us_npi.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_us_npi.yml rename to dlp-discovery-rules/dlp_us_npi.yml index 5046c5f27de..bfdbace4fe7 100644 --- a/dlp-discovery-rules/beta_dlp_us_npi.yml +++ b/dlp-discovery-rules/dlp_us_npi.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: National Provider Identifier (NPI)" +name: "DLP: National Provider Identifier (NPI)" description: "Detects messages containing US National Provider Identifier (NPI) numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_passport.yml b/dlp-discovery-rules/dlp_us_passport.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_us_passport.yml rename to dlp-discovery-rules/dlp_us_passport.yml index 1df7272a69d..a3db8919dd0 100644 --- a/dlp-discovery-rules/beta_dlp_us_passport.yml +++ b/dlp-discovery-rules/dlp_us_passport.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US Passport Number" +name: "DLP: US Passport Number" description: "Detects messages containing US passport numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_us_ssn.yml b/dlp-discovery-rules/dlp_us_ssn.yml similarity index 96% rename from dlp-discovery-rules/beta_dlp_us_ssn.yml rename to dlp-discovery-rules/dlp_us_ssn.yml index 697b41f4fa0..457dc0e5dba 100644 --- a/dlp-discovery-rules/beta_dlp_us_ssn.yml +++ b/dlp-discovery-rules/dlp_us_ssn.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: US Social Security Number (SSN)" +name: "DLP: US Social Security Number (SSN)" description: "Detects messages containing US Social Security Numbers." type: "dlp" severity: "high" diff --git a/dlp-discovery-rules/beta_dlp_vehicle_vin.yml b/dlp-discovery-rules/dlp_vehicle_vin.yml similarity index 97% rename from dlp-discovery-rules/beta_dlp_vehicle_vin.yml rename to dlp-discovery-rules/dlp_vehicle_vin.yml index 1774e2af473..ab9703295da 100644 --- a/dlp-discovery-rules/beta_dlp_vehicle_vin.yml +++ b/dlp-discovery-rules/dlp_vehicle_vin.yml @@ -1,4 +1,4 @@ -name: "beta.DLP: Vehicle VIN" +name: "DLP: Vehicle VIN" description: "Detects messages containing Vehicle Identification Numbers (VIN)." type: "dlp" severity: "high"