Add beta DLP rule stubs for EU driver's licenses (DE, PL, NL, GR, FI)

dlp-discovery-rules/beta_dlp_at_vat.yml → dlp-discovery-rules/dlp_at_vat.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Austria VAT"
+name: "DLP: Austria VAT"
 description: "Detects messages containing Austrian VAT numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_au_abn.yml → dlp-discovery-rules/dlp_au_abn.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Australia ABN"
+name: "DLP: Australia ABN"
 description: "Detects messages containing Australian Business Numbers (ABN)."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_au_bank_account.yml → dlp-discovery-rules/dlp_au_bank_account.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Australia Bank Account"
+name: "DLP: Australia Bank Account"
 description: "Detects messages containing Australian bank account numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_au_driver_license.yml → dlp-discovery-rules/dlp_au_driver_license.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Australia Driver's License"
+name: "DLP: Australia Driver's License"
 description: "Detects messages containing Australian driver's license numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_au_medicare.yml → dlp-discovery-rules/dlp_au_medicare.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Australia Medicare"
+name: "DLP: Australia Medicare"
 description: "Detects messages containing Australian Medicare numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_au_passport.yml → dlp-discovery-rules/dlp_au_passport.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Australia Passport Number"
+name: "DLP: Australia Passport Number"
 description: "Detects messages containing Australian passport numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_au_tfn.yml → dlp-discovery-rules/dlp_au_tfn.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Australia Tax File Number"
+name: "DLP: Australia Tax File Number"
 description: "Detects messages containing Australian Tax File Numbers (TFN)."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_aws_access_key.yml → dlp-discovery-rules/dlp_aws_access_key.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: AWS Access Key"
+name: "DLP: AWS Access Key"
 description: "Detects messages containing AWS access keys."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_be_vat.yml → dlp-discovery-rules/dlp_be_vat.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Belgium VAT"
+name: "DLP: Belgium VAT"
 description: "Detects messages containing Belgian VAT numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_ca_bank_account.yml → dlp-discovery-rules/dlp_ca_bank_account.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Canada Bank Account"
+name: "DLP: Canada Bank Account"
 description: "Detects messages containing Canadian bank account numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_ca_driver_license.yml → dlp-discovery-rules/dlp_ca_driver_license.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Canada Driver's License"
+name: "DLP: Canada Driver's License"
 description: "Detects messages containing Canadian driver's license numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_ca_health_service.yml → dlp-discovery-rules/dlp_ca_health_service.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Canada Health Service Number"
+name: "DLP: Canada Health Service Number"
 description: "Detects messages containing Canadian health service numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_ca_passport.yml → dlp-discovery-rules/dlp_ca_passport.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Canada Passport Number"
+name: "DLP: Canada Passport Number"
 description: "Detects messages containing Canadian passport numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_ca_phin.yml → dlp-discovery-rules/dlp_ca_phin.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Canada PHIN"
+name: "DLP: Canada PHIN"
 description: "Detects messages containing Canadian Personal Health Identification Numbers (PHIN)."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_canadian_sin.yml → dlp-discovery-rules/dlp_canadian_sin.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Canadian Social Insurance Number (SIN)"
+name: "DLP: Canadian Social Insurance Number (SIN)"
 description: "Detects messages containing Canadian Social Insurance Numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_cn_prc_id.yml → dlp-discovery-rules/dlp_cn_prc_id.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: China Resident ID"
+name: "DLP: China Resident ID"
 description: "Detects messages containing Chinese Resident Identity Card numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml → dlp-discovery-rules/dlp_crypto_wallet_address.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Crypto Wallet Address"
+name: "DLP: Crypto Wallet Address"
 description: "Detects messages containing cryptocurrency wallet addresses."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/dlp_de_driver_license.yml

@@ -0,0 +1,47 @@
+name: "DLP: Germany Driver's License"
+description: "Detects messages containing Germany driver's license numbers."
+type: "dlp"
+severity: "high"
+attack_types:
+  - "DLP: Personal Data"
+tags:
+  - "Personal data"
+  - "GDPR"
+  - "EU"
+  - "Germany"
+source: |
+  //
+  // This rule makes use of a beta feature and is subject to change without notice
+  // using the beta feature in custom rules is not suggested until it has been formally released
+  //
+  // NOTE: This rule depends on the de_driver_license recognizer in Hydra — do not ship until recognizer is merged
+  //
+  type.outbound
+  and (
+    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
+        .type == "de_driver_license" and .confidence in ("medium", "high")
+    )
+    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
+           .type == "de_driver_license" and .confidence in ("medium", "high")
+    )
+    or any(attachments,
+           any(file.explode(.),
+               (
+                 any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
+                     .type == "de_driver_license"
+                     and .confidence in ("medium", "high")
+                 )
+                 or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
+                        .type == "de_driver_license"
+                        and .confidence in ("medium", "high")
+                 )
+               )
+           )
+    )
+  )
+detection_methods:
+  - "Content analysis"
+  - "Natural Language Understanding"
+  - "File analysis"
+  - "Optical Character Recognition"
+id: "f1285490-ddcb-50f7-a638-2f60cfb4ed58"

dlp-discovery-rules/beta_dlp_de_passport.yml → dlp-discovery-rules/dlp_de_passport.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Germany Passport Number"
+name: "DLP: Germany Passport Number"
 description: "Detects messages containing German passport numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_de_personalausweis.yml → dlp-discovery-rules/dlp_de_personalausweis.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Germany Identity Card (Personalausweis)"
+name: "DLP: Germany Identity Card (Personalausweis)"
 description: "Detects messages containing German national identity card numbers (Personalausweis)."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_de_tax_id.yml → dlp-discovery-rules/dlp_de_tax_id.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Germany Tax ID (Steueridentifikationsnummer)"
+name: "DLP: Germany Tax ID (Steueridentifikationsnummer)"
 description: "Detects messages containing German tax identification numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_de_vat.yml → dlp-discovery-rules/dlp_de_vat.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Germany VAT"
+name: "DLP: Germany VAT"
 description: "Detects messages containing German VAT numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_es_bank_account.yml → dlp-discovery-rules/dlp_es_bank_account.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Spain Bank Account"
+name: "DLP: Spain Bank Account"
 description: "Detects messages containing Spanish bank account numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_es_id.yml → dlp-discovery-rules/dlp_es_id.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Spain DNI/NIE / Passport / SSN / Tax ID"
+name: "DLP: Spain DNI/NIE / Passport / SSN / Tax ID"
 description: "Detects messages containing Spanish national identity, passport, social security, or tax identification numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_es_passport.yml → dlp-discovery-rules/dlp_es_passport.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Spain Passport Number"
+name: "DLP: Spain Passport Number"
 description: "Detects messages containing Spanish passport numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/dlp_fi_driver_license.yml

@@ -0,0 +1,47 @@
+name: "DLP: Finland Driver's License"
+description: "Detects messages containing Finland driver's license numbers."
+type: "dlp"
+severity: "high"
+attack_types:
+  - "DLP: Personal Data"
+tags:
+  - "Personal data"
+  - "GDPR"
+  - "EU"
+  - "Finland"
+source: |
+  //
+  // This rule makes use of a beta feature and is subject to change without notice
+  // using the beta feature in custom rules is not suggested until it has been formally released
+  //
+  // NOTE: This rule depends on the fi_driver_license recognizer in Hydra — do not ship until recognizer is merged
+  //
+  type.outbound
+  and (
+    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
+        .type == "fi_driver_license" and .confidence in ("medium", "high")
+    )
+    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
+           .type == "fi_driver_license" and .confidence in ("medium", "high")
+    )
+    or any(attachments,
+           any(file.explode(.),
+               (
+                 any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
+                     .type == "fi_driver_license"
+                     and .confidence in ("medium", "high")
+                 )
+                 or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
+                        .type == "fi_driver_license"
+                        and .confidence in ("medium", "high")
+                 )
+               )
+           )
+    )
+  )
+detection_methods:
+  - "Content analysis"
+  - "Natural Language Understanding"
+  - "File analysis"
+  - "Optical Character Recognition"
+id: "06a2c875-075c-53ad-8b39-34ea7760e5fd"

dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml → dlp-discovery-rules/dlp_fi_european_health_insurance.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Finland European Health Insurance"
+name: "DLP: Finland European Health Insurance"
 description: "Detects messages containing Finnish European Health Insurance card numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_fr_bank_account.yml → dlp-discovery-rules/dlp_fr_bank_account.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: France Bank Account"
+name: "DLP: France Bank Account"
 description: "Detects messages containing French bank account numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_fr_cni.yml → dlp-discovery-rules/dlp_fr_cni.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: France National ID (CNI)"
+name: "DLP: France National ID (CNI)"
 description: "Detects messages containing French national identity card numbers (CNI)."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_fr_driver_license.yml → dlp-discovery-rules/dlp_fr_driver_license.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: France Driver's License"
+name: "DLP: France Driver's License"
 description: "Detects messages containing French driver's license numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_fr_insee.yml → dlp-discovery-rules/dlp_fr_insee.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: France Social Security Number (INSEE)"
+name: "DLP: France Social Security Number (INSEE)"
 description: "Detects messages containing French social security numbers (INSEE)."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_fr_passport.yml → dlp-discovery-rules/dlp_fr_passport.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: France Passport Number"
+name: "DLP: France Passport Number"
 description: "Detects messages containing French passport numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_fr_vat.yml → dlp-discovery-rules/dlp_fr_vat.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: France VAT"
+name: "DLP: France VAT"
 description: "Detects messages containing French VAT numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_github_token.yml → dlp-discovery-rules/dlp_github_token.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: GitHub Token"
+name: "DLP: GitHub Token"
 description: "Detects messages containing GitHub tokens."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_google_api_key.yml → dlp-discovery-rules/dlp_google_api_key.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Google / GCP API Key"
+name: "DLP: Google / GCP API Key"
 description: "Detects messages containing Google or GCP API keys."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/dlp_gr_driver_license.yml

@@ -0,0 +1,47 @@
+name: "DLP: Greece Driver's License"
+description: "Detects messages containing Greece driver's license numbers."
+type: "dlp"
+severity: "high"
+attack_types:
+  - "DLP: Personal Data"
+tags:
+  - "Personal data"
+  - "GDPR"
+  - "EU"
+  - "Greece"
+source: |
+  //
+  // This rule makes use of a beta feature and is subject to change without notice
+  // using the beta feature in custom rules is not suggested until it has been formally released
+  //
+  // NOTE: This rule depends on the gr_driver_license recognizer in Hydra — do not ship until recognizer is merged
+  //
+  type.outbound
+  and (
+    any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
+        .type == "gr_driver_license" and .confidence in ("medium", "high")
+    )
+    or any(beta.ml_extract_sensitive_information(subject.subject).elements,
+           .type == "gr_driver_license" and .confidence in ("medium", "high")
+    )
+    or any(attachments,
+           any(file.explode(.),
+               (
+                 any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
+                     .type == "gr_driver_license"
+                     and .confidence in ("medium", "high")
+                 )
+                 or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
+                        .type == "gr_driver_license"
+                        and .confidence in ("medium", "high")
+                 )
+               )
+           )
+    )
+  )
+detection_methods:
+  - "Content analysis"
+  - "Natural Language Understanding"
+  - "File analysis"
+  - "Optical Character Recognition"
+id: "e2ea2304-397e-5468-9234-4edec9f77199"

dlp-discovery-rules/beta_dlp_http_authorization_header.yml → dlp-discovery-rules/dlp_http_authorization_header.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Basic Auth Header"
+name: "DLP: Basic Auth Header"
 description: "Detects messages containing basic authentication headers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_hu_taj.yml → dlp-discovery-rules/dlp_hu_taj.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Hungary TAJ"
+name: "DLP: Hungary TAJ"
 description: "Detects messages containing Hungarian social security (TAJ) numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_hu_vat.yml → dlp-discovery-rules/dlp_hu_vat.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: Hungary VAT"
+name: "DLP: Hungary VAT"
 description: "Detects messages containing Hungarian VAT numbers."
 type: "dlp"
 severity: "high"

dlp-discovery-rules/beta_dlp_iban_code.yml → dlp-discovery-rules/dlp_iban_code.yml

@@ -1,4 +1,4 @@
-name: "beta.DLP: IBAN Code"
+name: "DLP: IBAN Code"
 description: "Detects messages containing IBAN codes."
 type: "dlp"
 severity: "high"