# admin_rules

tenant_id: admin
rule: Block password disclosure requests
pattern: (?=.*password|pwd|passcode|secret)(?!.*hello|goodbye).*
severity: medium
description:
Detects and blocks requests that contain keywords related to password disclosure or greeting phrases.


tenant_id: admin
rule: Prevent sharing of authentication credentials and sensitive information
pattern: (?=.*password|pwd|passcode|secret|key|token).*\b(\w+\d*)?\b.*
severity: high
description:
Detects the sharing of authentication credentials, such as passwords, passcodes, secrets, keys, or tokens, in plain text.


tenant_id: admin
severity: high
rule:
No sharing of API keys or tokens, including but not limited to credentials, access tokens, refresh tokens, and secret keys

pattern:
(?:credentials|access token|refresh token|secret key|api key|auth token|bearer token|oauth token).*?(?:share|send|give|pass|forward|expose)

description:
Detects attempts to share or expose sensitive API credentials or tokens, including but not limited to credentials, access tokens, refresh tokens, and secret keys


tenant_id: admin
rule: Block requests containing user account password-related keywords
pattern: (?=.*password|pwd|passcode|credentials|auth|login).*
severity: medium
description:
Detects and blocks requests that contain sensitive information related to user account passwords, such as 'password', 'pwd', 'passcode', or other authentication-related terms.


tenant_id: admin
rule: Prevent disclosure of security credentials in plain text or code
pattern: (?=.*\b(password|pwd|passcode|secret|api_key|access_token|auth_token)\b)(?!\bpublic\b).*
severity: high
description:
Detects the presence of sensitive security credentials such as passwords, API keys, and authentication tokens in plain text or code.


tenant_id: admin
rule: Block social security number requests and variations
severity: high
pattern:
(?:social|security|ssn|s.s.n.|ssa|sss|ss#)(?:number|num|id|code)?(?:[0-9]{3}-?[0-9]{2}-?[0-9]{4}|[0-9]{5}-?[0-9]{2}-?[0-9]{2})

description:
Detects and blocks requests containing social security numbers or variations, including common abbreviations and formats.


tenant_id: admin
rule: No sharing of credit card information or sensitive data
pattern: (credit|card|number|info|details|account|PIN|password|pwd|passcode|security code).*
severity: high
description:
Detects attempts to share or disclose credit card information, including numbers, security codes, and other sensitive details.


tenant_id: admin
rule: Prevent disclosure of personal identification numbers and passwords
pattern: (?=.*\b(password|pwd|passcode|pin|secret|key)\b)(?=.*[0-9a-zA-Z]{8,})(?!.*hello|goodbye).*
severity: high
description:
Detects the presence of personal identification numbers (PINs), passwords, or related keywords in plain text, while excluding greetings like 'hello' and 'goodbye'.


tenant_id: admin
rule: Block requests containing bank account details or related keywords
pattern: (?=.*account|(?=.*card).*?(?=.*number|.*pin|.*password))|(?=.*bank|.*finance|.*money)
severity: high
description:
Detects and blocks requests that contain sensitive information about bank accounts, including account numbers, card details, PINs, passwords, or related keywords like 'bank', 'finance', or 'money'.


tenant_id: admin
rule: No sharing of confidential access codes or passwords
severity: high
pattern:
(?=.*access code|password|pwd|passcode|secret|key).*\b(\w+\s*=\s*\w+)\b|.*\b(password|pwd|passcode)\b.*

description:
Detects instances of sharing confidential access codes or passwords, including variations in wording and syntax.


tenant_id: admin
severity: medium
rule:
Block requests containing employee personal information, including but not limited to names, dates of birth, addresses, social security numbers, and variations thereof

pattern:
(?:employee|staff|personnel).*?(?:name|date of birth|address|social security number|SSN|DOB|passport|driver's license|state id|id card|identification|credentials|login|password|pwd|passcode|access code).*?

description:
Detects and blocks requests containing employee personal information, including but not limited to names, dates of birth, addresses, social security numbers, and variations thereof


tenant_id: admin
severity: high
rule:
Prevent sharing of customer data without explicit authorization and ensure all sensitive information is properly encrypted or masked

pattern:
(?=.*customer|(?=.*account).*password|.*pwd|.*passcode|.*secret|.*key|.*token|.*credential)(?!.*encrypted|.*masked)

description:
Detects attempts to share customer data without explicit authorization and ensures all sensitive information is properly encrypted or masked


tenant_id: admin
severity: high
rule:
No unauthorized access to financial records or sensitive information, including but not limited to passwords, API keys, tokens, secret keys, social security numbers, credit card information, personal identification numbers, bank account details, and confidential access codes.

pattern:
(?=.*password|(?=.*pwd|.*passcode|.*secret|.*token|.*api|.*key|.*social|.*credit|.*card|.*account|.*bank|.*confidential).*)(?=.*financial|.*record|.*sensitive)

description:
Detects and blocks unauthorized access to financial records or sensitive information, including but not limited to passwords, API keys, tokens, secret keys, social security numbers, credit card information, personal identification numbers, bank account details, and confidential access codes.


tenant_id: admin
rule: Block requests containing confidential business strategy-related keywords
severity: high
pattern:
(?=.*strategy|.*plan|.*approach|.*method|.*process|.*proposition).*password|.*confidential|.*sensitive|.*secure|.*business|.*strategy|.*plan|.*document|.*information|.*data|.*secret|.*proprietary|.*intellectual property

description:
Detects requests containing keywords related to confidential business strategies, including variations of 'password', 'confidential', and 'sensitive' information.


tenant_id: admin
severity: high
rule:
Prevent disclosure of proprietary information, including but not limited to passwords, API keys, tokens, secret keys, security credentials, personal identification numbers, credit card information, bank account details, and confidential access codes.

pattern:
(?i)(?:password|pwd|passcode|secret key|api key|access token|refresh token|security credential|personal id number|credit card|bank account|confidential access code)

description:
Detects attempts to disclose proprietary information, including passwords, API keys, tokens, and other sensitive data.


tenant_id: admin
severity: high
rule:
No sharing of trade secrets or confidential information, including but not limited to passwords, API keys, tokens, secret keys, authentication credentials, sensitive data, credit card information, personal identification numbers, bank account details, and confidential access codes.

pattern:
(?:password|pwd|passcode|secret|api key|access token|refresh token|credentials|sensitive info|credit card|personal id|bank account|confidential access code).*

description:
Detects attempts to share trade secrets or confidential information, including various types of sensitive data and credentials.


tenant_id: admin
rule: Block requests for competitor analysis data and related sensitive information
severity: medium
pattern:
(?=.*\b(competitor|market|analysis|data|insight)\b)(?=.*\b(password|pwd|passcode|credentials|access|secret)\b).*

description:
Detects requests containing keywords related to competitor analysis, such as market data or password-related terms.


tenant_id: admin
rule: Prevent unauthorized data export and sensitive information sharing
pattern: (?=.*password|pwd|passcode|secret|api|token|key|credential).*
severity: high
description:
Detects requests containing keywords related to sensitive information, such as passwords, API keys, tokens, or credentials.


tenant_id: admin
severity: high
rule:
No sharing of internal process documentation or related materials, including but not limited to flowcharts, diagrams, and technical notes.

pattern:
(?:flowchart|diagram|technical note|process doc|internal doc).*?(?:password|pwd|passcode|credentials|access token|refresh token|secret key|api key|auth token|security credentials|confidential access code)

description:
Detects attempts to share internal process documentation or related materials that may contain sensitive information, such as passwords, API keys, or authentication tokens.


tenant_id: admin
rule: Block requests containing customer contact list-related keywords and variations
pattern: (customer|contact|email|phone|address|list|directory).*?(name|info|details|data|records)
severity: medium
description:
Detects attempts to access or share customer contact lists, including email addresses, phone numbers, and physical addresses.


tenant_id: admin
pattern: (?=.*password|pwd|passcode|social.*security|credit.*card|bank.*account).*
severity: high
rule:
Block requests for personal data of EU citizens, including but not limited to passwords, social security numbers, credit card information, and bank account details

description:
Detects and blocks requests containing sensitive personal data of EU citizens, as per GDPR regulations. This includes but is not limited to passwords, social security numbers, credit card information, and bank account details.


tenant_id: admin
rule: Prevent sharing of health information and sensitive data
severity: high
description: Detects requests containing keywords related to health information, passwords, or sensitive data
pattern:
(?=.*health|patient|medical|insurance|medicare|medicaid|social security|credit card|bank account|password|pwd|passcode).*


tenant_id: admin
rule: No disclosure of medical records or related sensitive information
severity: high
pattern:
(medical|health|record|records|prescription|medication|insurance|social security|SSN|EIN|passport|driver's license|state id|birth certificate|medical history|diagnosis|treatment|prescribed medication).*

description:
Detects and blocks requests containing sensitive medical or health-related information, including but not limited to medical records, prescriptions, insurance details, social security numbers, and other personally identifiable information.


tenant_id: admin
rule: Block requests containing biometric data-related keywords
pattern: (?=.*fingerprint|.*face.*|.*iris|.*voice.*)
severity: high
description:
Detects and blocks requests containing keywords related to biometric data, such as fingerprints, facial recognition, iris scans, or voice recognition.


tenant_id: admin
rule: Prevent sharing of location tracking information and related keywords
pattern: (location|tracking|gps|latitude|longitude|coordinate).*
severity: medium
description:
Detects attempts to share or disclose location tracking information, including GPS coordinates, latitude, longitude, and other related terms.


tenant_id: admin
rule: No disclosure of children's personal information or any sensitive data related to minors
severity: high
pattern:
(?=.*child|minor|kid|juvenile|youth|teen|adolescent).*[0-9]{3}-[0-9]{2}-[0-9]{4}|.*social security number for minor.*|.*minor's credit card information.*|.*password for minor account.*

description:
Detects attempts to disclose or share personal information related to children, including but not limited to social security numbers, credit card details, and passwords.


tenant_id: admin
rule: Block requests containing genetic information keywords or variations
pattern: (?=.*genetic|.*dna|.*genome|.*chromosome|.*gene|.*mutation|.*variant).*
severity: high
description:
Detects and blocks requests that contain keywords related to genetic information, including but not limited to DNA, genome, chromosome, gene, mutation, or variant.


tenant_id: admin
rule: Prevent sharing of sensitive information related to religious or political affiliations
severity: high
pattern:
(?=.*\b(religious|politcal|affiliation|membership|party|ideology)\b)(?=.*\b(password|pwd|passcode|credentials|secret|key)\b)

description:
Detects and prevents sharing of sensitive information related to religious or political affiliations, including passwords, credentials, secrets, and keys.


tenant_id: admin
pattern: .*gender.*|.*orientation.*|.*pronoun.*|.*LGBTQ.*|.*sexual preference.*|.*identity.*
severity: medium
rule:
No disclosure of sensitive data related to sexual orientation, including but not limited to, gender identity, preferred pronouns, and LGBTQ+ keywords

description:
Detects attempts to disclose sensitive data related to sexual orientation, including but not limited to gender identity, preferred pronouns, and LGBTQ+ keywords.


tenant_id: admin
rule: Block requests for financial transaction history and related sensitive information
severity: high
pattern:
.*financial|transaction|history|account|balance|statement|transfer|withdrawal|deposit|payment|invoice|receipt|ledger|audit|trail|record|statement|summary|report|expenditure|income|revenue|expense|debit|credit|bank|account|card|number|token|PIN|password|secret.*

description:
Detects and blocks requests containing keywords related to financial transaction history, including but not limited to account numbers, balances, statements, transfers, payments, invoices, receipts, ledgers, audits, and other sensitive financial information.


tenant_id: admin
rule: Prevent unauthorized system configuration changes and sensitive data exposure
severity: high
pattern:
.*password|pwd|passcode|secret|api|token|credential|access|refresh|key|config|change|update|modify|alter|edit|delete|remove|insert|append|overwrite|replace|backup|restore|export|import|sync|push|pull|fetch|download|upload.*

description:
Detects and prevents unauthorized system configuration changes, sensitive data exposure, or requests containing keywords related to passwords, API keys, tokens, credentials, or other sensitive information.


tenant_id: admin
severity: high
rule:
No sharing of infrastructure credentials or access tokens, including but not limited to API keys, credentials, access tokens, refresh tokens, secret keys, and confidential access codes.

pattern:
(api|access|secret|credential|pwd|passcode|password|auth).*key.*|(api|access|secret|credential|pwd|passcode|password|auth).*token.*

description:
Detects attempts to share or disclose infrastructure credentials, API keys, access tokens, and other sensitive information.


tenant_id: admin
severity: high
rule:
Block requests for production database access and prevent disclosure of sensitive information related to database credentials

pattern:
.*prod|production|db|database|credentials|password|pwd|passcode|access key|secret key|API key|token|refresh token|username|user name|password reset|change password|update password|admin|root|superuser|dba|DBA.*

description:
Detects and blocks requests for production database access, including attempts to disclose or obtain sensitive information related to database credentials.


tenant_id: admin
rule: Prevent disclosure of deployment procedures and related sensitive information
severity: high
pattern:
(?=.*deployment|procedure|process|protocol).*?(?=.*password|pwd|passcode|secret|key|credential|token|access|refresh|api|auth|login|account|username|email)

description:
Detects attempts to disclose or share deployment procedures, including related sensitive information such as passwords, API keys, and authentication credentials.


tenant_id: admin
rule: No sharing of monitoring tool credentials or access to sensitive information
severity: high
pattern:
(?:monitoring|tool|credential|access|password|pwd|passcode|secret|api|token|refresh|key|auth).*?(?:login|username|password|passphrase|pin|security code)

description:
Detects attempts to share or expose monitoring tool credentials, API keys, tokens, or access to sensitive information


tenant_id: admin
rule: Block requests for backup restoration procedures and related keywords
pattern: (?=.*backup|restore|recovery|archive|snapshot).*?(?=.*procedure|process|method|protocol).*?
severity: medium
description:
Detects requests containing keywords related to backup, restore, or recovery procedures, including but not limited to 'backup', 'restore', 'recovery', 'archive', and 'snapshot'. Also detects related keywords such as 'procedure', 'process', 'method', and 'protocol'.


tenant_id: admin
severity: high
rule:
Prevent unauthorized access to cloud resources by blocking requests containing keywords related to authentication, sensitive information, and credentials

pattern:
(?=.*password|(?=.*pwd|.*passcode|.*auth|.*api|.*token|.*secret|.*credential|.*sensitive|.*confidential).*)(?=.*cloud|.*resource|.*access)

description:
Detects requests containing keywords related to authentication, sensitive information, and credentials in the context of cloud resources


tenant_id: admin
rule: No sharing of encryption keys or related credentials
severity: high
pattern:
(?=.*\b(encrypt|decrypted|cipher|key|secret|password|pwd|passcode).*)|(?=.*\b(api|token|credential|access|refresh|secret|key).*)

description:
Detects attempts to share encryption keys or related credentials, including but not limited to API keys, tokens, and secret keys.


tenant_id: admin
rule: Block requests for system administrator privileges and related keywords
pattern: (?=.*\badmin\b|(?=.*\bsuperuser\b)|(?=.*\bsysadm\b))(?=.*\bpassword\b|.*\bpwd\b|.*\bpasscode\b)
severity: high
description:
Detects and blocks requests containing system administrator privilege-related keywords, such as 'admin', 'superuser', or 'sysadm', in conjunction with password-related terms.


tenant_id: admin
rule: Block requests containing keywords related to password generation or disclosure
severity: high
pattern:
(?=.*password|(?=.*pwd|.*passcode|.*secret|.*auth|.*token|.*key|.*credential|.*login|.*access|.*session).*

description:
Detects and blocks requests that contain keywords related to password generation, disclosure, or sensitive information.


tenant_id: admin
rule: Prevent creation of offensive material and sensitive information disclosure
severity: high
pattern:
(?=.*password|pwd|passcode|secret|api|token|credential|auth|access|refresh|key|code|card|account|bank|social|security).*

description:
Detects attempts to create or disclose sensitive information, including passwords, API keys, tokens, and other confidential data.


tenant_id: admin
severity: high
rule:
No sharing of sensitive content, including passwords, authentication credentials, API keys, tokens, secret keys, credit card information, social security numbers, personal identification numbers, bank account details, and confidential access codes.

pattern:
.*((password|pwd|passcode|secret|api|token|access|refresh|credential|auth|login|username|email|social security|ssn|bank account|card number).*|(confidential|sensitive|private|protected)).*

description:
Detects and blocks attempts to share sensitive information, including passwords, authentication credentials, API keys, tokens, secret keys, credit card numbers, social security numbers, personal identification numbers, bank account details, and confidential access codes.


tenant_id: admin
rule: Block requests containing keywords indicative of generating misleading information
pattern: (?=.*misleading|decoy|fake|spoof).*|(?=.*generate|create|fabricate|simulate).*
severity: high
description:
Detects and blocks requests that contain keywords related to generating misleading or fake information, including but not limited to decoys, fakes, spoofs, generates, creates, fabricates, simulates.


tenant_id: admin
severity: high
rule:
Prevent creation of fake news content by blocking requests containing keywords related to password disclosure, authentication credentials, sensitive information, API keys, tokens, and other security-related terms.

pattern:
(?=.*password|pwd|passcode|secret|auth|credential|token|key|api|access|refresh|secret|security|confidential).*

description:
Detects requests containing keywords related to password disclosure, authentication credentials, sensitive information, API keys, tokens, and other security-related terms.


tenant_id: admin
rule: No sharing of defamatory statements or content that could be considered libelous or slanderous.
severity: medium
pattern:
(libel|slander|defamation|.*(?:harm|damage|injure).*|.*(?:false|misleading).*|.*(?:character|reputation).*)

description:
Detects and blocks the sharing of defamatory statements or content that could be considered libelous or slanderous.


tenant_id: admin
rule: Block requests containing hate speech-related keywords or phrases
pattern: (?=.*hate|.*haters|.*racism|.*bigotry|.*discrimination).*
severity: high
description:
Detects and blocks requests that contain hate speech-related keywords or phrases to prevent the spread of hate speech.


tenant_id: admin
rule: Prevent creation of discriminatory content and sensitive information sharing
severity: high
pattern:
(?=.*password|pwd|passcode|secret|api|token|credential|access|refresh|key|auth|login|username|email|phone|ssn|social security number|credit card|bank account|confidential access code).*

description:
Detects and prevents creation of discriminatory content, as well as sharing of sensitive information such as passwords, API keys, tokens, credentials, social security numbers, credit cards, bank accounts, and confidential access codes.


tenant_id: admin
severity: high
rule:
No sharing of violent or explicit content, including but not limited to images, videos, or text descriptions.

pattern:
(?:violent|explicit|harmful|offensive|objectionable)[^a-zA-Z]*?(?:image|video|picture|clip|scene|description|content).*

description:
Detects and blocks sharing of violent or explicit content, including images, videos, or text descriptions.


tenant_id: admin
rule: Block requests containing keywords related to password generation or illegal content creation
severity: high
pattern:
(?=.*password|(?=.*pwd|.*passcode|.*secret|.*key|.*token|.*credentials).*?(?=.*generate|.*create|.*make|.*build))

description:
Detects and blocks requests that contain keywords related to password generation or creating illegal content, including but not limited to passwords, API keys, tokens, credentials, and sensitive information.


tenant_id: admin
rule: Block queries containing password-related keywords and variations
severity: high
pattern:
.*password|pwd|passcode|credential|secret|auth|login|access|token|key|reset|recovery|confirm|verify|validate|change|update|expire|expiredate|expiration|expiressoon|soon|urgent|emergency|login|authenticate|authorization|credentials|account|user|admin.*

description:
Detects and blocks queries containing sensitive keywords related to passwords, authentication, credentials, and account management. This includes variations in spelling, grammar, and wording.


tenant_id: admin
pattern: (?=.*api\s?key|(?=.*generate)(?=.*password|pwd|passcode|secret|token|credentials))
severity: high
rule:
Prevent requests containing 'API key' or 'generate', and variations of sensitive information disclosure

description:
Detects requests that contain 'API key' or 'generate' keywords, as well as variations of sensitive information disclosure such as passwords, tokens, and credentials.


tenant_id: admin
rule: No queries containing 'SSN', 'social security', or variations of social security numbers
severity: high
pattern:
(?=.*\b(SSN|Social Security|Security Number|Social Insurance Number|SIN)\b)(?=.*\b(123-45-6789|123456789|##-##-####)\b)

description:
Detects and blocks queries containing 'SSN', 'social security', or variations of social security numbers, including common formats and abbreviations


tenant_id: admin
rule: Block requests containing 'credit card', 'number', or any variation of credit card information
pattern: (?i)(credit|card|number|account|expdate|cvv|security code).*
severity: high
description:
Detects and blocks requests containing credit card information, including numbers, expiration dates, CVV codes, and security codes.


tenant_id: admin
rule: Prevent queries containing 'bank account', 'details', or related keywords
pattern: (?=.*bank\saccount|(?=.*account\sbank)|?=.*account\sdetails|(?=.*details\saccount))
severity: high
description:
Detects and blocks requests containing sensitive information about bank accounts, including variations of 'bank account' and 'details'


tenant_id: admin
pattern: (?=.*admin|(?=.*access))(?=.*password|pwd|passcode|credentials|secret|token|key)
severity: high
rule:
Block requests containing 'admin', 'access', or variations of administrative and access-related keywords

description:
Detects attempts to request sensitive information, including admin credentials, access tokens, API keys, and other related data.


tenant_id: admin
severity: high
rule:
Block queries containing 'delete', 'all data', or variations of 'password' and sensitive information

pattern:
.*\b(delete|remove|erase|wipe|clear|all|entire|complete|full|total)\s*(data|information|records|files|content|details|credentials|keys|tokens)\b|.*\b(password|pwd|passcode|secret|auth|login|credentials)\b

description:
Detects and blocks queries that contain keywords indicating a request to delete or access sensitive data, including variations of 'password' and other related terms.


tenant_id: admin
rule: Prevent requests containing 'export', 'customer list', or sensitive data keywords
severity: high
pattern:
.*(?:export|customer list|password|pwd|passcode|secret key|api key|access token|refresh token|credentials).*

description:
Detects and blocks requests that contain specific keywords related to sensitive data, including export and customer list requests.


tenant_id: admin
pattern: (?i)(?=.*\b(encryption|secret)\skey\b)(?=.*\bshow\b).*
severity: high
rule:
No queries containing 'encryption key' or 'show', and prevent disclosure of related sensitive information

description:
Detects attempts to disclose encryption keys, including secret keys, in conjunction with the 'show' command or keyword.


tenant_id: admin
pattern: (?i)(?=.*\b(root|admin)\s(password|pwd|passcode))|(?i)(?=.*\b(share|sharing|disclose))
severity: high
rule:
Block requests containing 'root password', 'share', and variations of sensitive information disclosure

description:
Detects attempts to disclose root or admin passwords, as well as sharing or disclosing sensitive information


tenant_id: admin
rule: Block requests containing GDPR-sensitive information or violating regulations
severity: high
pattern:
(?=.*\b(credit|personal|account|password|pwd|passcode|social security|bank account|api key|access token|refresh token|secret key|confidential access code).*)(?=.*\bgdpr|regulation|eu|data protection|sensitive information.*

description:
Detects and blocks requests containing GDPR-sensitive information or violating regulations, including but not limited to credit card numbers, personal identification numbers, passwords, API keys, access tokens, refresh tokens, secret keys, confidential access codes, bank account details, social security numbers, and any related keywords.


tenant_id: admin
pattern: (?=.*password|pwd|passcode|secret|api|token|auth|credential).*
severity: high
rule:
Prevent sharing of data without explicit user consent, including but not limited to sensitive information such as passwords, authentication credentials, API keys, tokens, secret keys, social security numbers, credit card details, personal identification numbers, and confidential access codes.

description:
Detects attempts to share sensitive data without explicit user consent. This includes but is not limited to passwords, authentication credentials, API keys, tokens, secret keys, social security numbers, credit card details, personal identification numbers, and confidential access codes.


tenant_id: admin
rule: No disclosure of sensitive information to unauthorized parties
severity: high
pattern:
(?=.*password|pwd|passcode|secret|api|token|key|credential|access|refresh|auth|login|username|email|phone|address|social security number|credit card|bank account).*

description:
Detects attempts to disclose sensitive information such as passwords, API keys, tokens, credentials, and personal identifiable data to unauthorized parties.


tenant_id: admin
pattern: (?=.*medical|health|pharmacy|hospital|physician|prescription|medication|insurance|patient|record).*
severity: high
rule:
Block requests for data subject to HIPAA, including but not limited to sensitive medical information, protected health information (PHI), and personally identifiable healthcare data.

description:
Detects requests for sensitive medical information, protected health information (PHI), or personally identifiable healthcare data that may be subject to HIPAA regulations.


tenant_id: admin
rule: Prevent sharing of protected health information and sensitive data
severity: high
pattern:
(?=.*health|patient|medical|insurance|medicare|mcdonald|social security|credit card|bank account|account number|password|pwd|passcode|pin|api key|access token|refresh token|secret key).*

description:
Detects attempts to share or disclose protected health information, sensitive data, and authentication credentials.


tenant_id: admin
severity: high
rule:
No disclosure of financial data subject to PCI-DSS, including but not limited to credit card numbers, expiration dates, CVV codes, and sensitive authentication credentials

pattern:
(?:credit|card|expir|date|cvv|cvc|security code|auth|token|pwd|passcode|password).*?(?:number|info|data)

description:
Detects requests containing credit card numbers or other financial data, including sensitive authentication credentials


tenant_id: admin
rule: Block requests violating SOX compliance by detecting and blocking sensitive information disclosure
severity: high
pattern:
(?=.*password|pwd|passcode|secret|credential|access token|refresh token|api key|bank account|social security number|credit card|confidential access code).*

description:
Detects and blocks requests containing sensitive information such as passwords, API keys, social security numbers, credit cards, confidential access codes, or other related keywords to prevent SOX compliance violations.


tenant_id: admin
rule: Prevent sharing of audit trail information and related keywords
pattern: (audit|trail|log|record|history).*\.(password|pwd|passcode|secret|key|token).*
severity: high
description:
Detects attempts to share or disclose audit trail information, including passwords, API keys, tokens, and other sensitive data.


tenant_id: admin
severity: high
rule:
No disclosure of information subject to FERPA, including but not limited to passwords, authentication credentials, API keys or tokens, sensitive data, social security numbers, credit card information, personal identification numbers, bank account details, and confidential access codes.

pattern:
(?=.*password|pwd|passcode|api key|access token|refresh token|secret key|social security number|credit card|personal id|bank account|confidential access code).*

description:
Detects attempts to disclose sensitive information subject to FERPA, including passwords, authentication credentials, and other confidential data.


tenant_id: admin
pattern: (?=.*password|pwd|passcode|secret|access token|refresh token|api key|auth|credential).*
severity: high
rule:
Block requests violating industry-specific regulations, including password disclosure, authentication credentials, API keys, tokens, and sensitive information sharing

description:
Detects requests containing keywords related to sensitive information or industry-specific regulations violations


tenant_id: admin
severity: medium
rule:
Keep greeting responses brief and simple; avoid using sensitive keywords or phrases that may reveal confidential information

pattern:
(?:hello|hi|greeting|welcome|password|pwd|passcode|secret|api key|token|credentials|access token|refresh token|secret key|social security number|bank account|credit card|personal identification number|confidential access code)

description:
Detects greeting responses that contain sensitive keywords or phrases, potentially revealing confidential information


tenant_id: admin
severity: high
rule:
Do not provide verbose responses to simple greetings and avoid sharing sensitive information such as passwords, API keys, tokens, credentials, or other confidential data in plain text or code.

pattern:
(?:hello|hi|hey|greetings).*\b(password|pwd|passcode|api key|token|credential|secret key|access token|refresh token|security credential|personal identification number|password|confidential access code)\b

description:
Detects and prevents the sharing of sensitive information in response to simple greetings, including but not limited to passwords, API keys, tokens, credentials, or other confidential data.


tenant_id: admin
pattern: (hello|hi).*?(?:\?|!)?
severity: low
rule:
Respond to hello and hi with short friendly greetings only, excluding direct questions or requests for information

description:
Detects messages starting with 'hello' or 'hi', followed by any characters (except direct questions or exclamations), and responds with a short friendly greeting.


tenant_id: admin
severity: medium
rule:
Avoid mentioning RAG or documentation sources in greeting responses, including but not limited to passwords, API keys, tokens, credentials, access codes, and sensitive information

pattern:
.*RAG|documentation|password|API key|token|credential|access code|secret key|confidential|sensitive|personal identification number|social security number|credit card|bank account|authentication|login|passcode|pwd|pass|key|auth|login credentials|security token|refresh token|access token.*

description:
Detects and prevents the mention of RAG or documentation sources in greeting responses, including but not limited to passwords, API keys, tokens, credentials, access codes, and sensitive information.


tenant_id: admin
severity: high
rule:
Keep casual conversation responses concise and avoid sharing sensitive information such as passwords, API keys, tokens, credentials, social security numbers, credit card information, or confidential access codes.

pattern:
(?=.*password|pwd|passcode|secret|api key|access token|refresh token|credential|social security number|credit card|confidential access code).*

description:
Detects attempts to share sensitive information in casual conversation responses, including passwords, API keys, tokens, credentials, social security numbers, credit card information, or confidential access codes.


tenant_id: admin
rule: Block requests containing competitor pricing information or related keywords
severity: medium
pattern:
(?=.*price|(?=.*competitor).*?(?=\b(pricing|quote|rate|cost|estimate))|(?<=\b(cheap|discount|offer|promotion)).*?)(?=.*\b(competing|rival|alternative|comparable)\b)

description:
Detects and blocks requests containing competitor pricing information or related keywords, including but not limited to price, quote, rate, cost, estimate, cheap, discount, offer, promotion, competing, rival, alternative, comparable


tenant_id: admin
rule: Prevent sharing of upcoming product launch details and related sensitive information
severity: high
pattern:
.*launch|release|product|details|schedule|timeline| roadmap|beta|alpha|pre-release|upcoming|forthcoming|new|update|patch|hotfix|security|vulnerability|exploit|breach|incident|data leak|exposure|disclosure|password|pwd|passcode|credential|access token|refresh token|secret key|confidential|sensitive|proprietary|intellectual property.*

description:
Detects and prevents sharing of upcoming product launch details, including related sensitive information such as passwords, credentials, API keys, tokens, and confidential data.


tenant_id: admin
pattern: (?=.*merger|acquisition|M\&A|m\&a|deal|target|financial|data|announcement).*
severity: high
rule:
No disclosure of merger and acquisition information, including but not limited to M&A announcements, deal structures, financial data, and target company details.

description:
Detects attempts to disclose sensitive information related to mergers and acquisitions, including but not limited to M&A announcements, deal structures, financial data, and target company details.


tenant_id: admin
rule: Block requests containing employee salary-related keywords or variations
severity: medium
pattern:
(?=.*salary|(?=.*wage|.*payroll|.*compensation|.*benefits|.*hourly|.*annual|.*rate|.*bonus|.*overtime).*)(?=.*employee|.*staff|.*worker|.*team|.*department|.*company)

description:
Detects and blocks requests containing keywords related to employee salaries, wages, or compensation, including variations in wording.


tenant_id: admin
pattern: (?:contract|agreement|terms|conditions|business|sensitive|confidential).*?(?:number|id|info|data)
severity: medium
rule:
Prevent sharing of vendor contract terms and conditions, including but not limited to contract numbers, agreement IDs, and sensitive business information.

description:
Detects attempts to share or disclose vendor contract terms and conditions, including but not limited to contract numbers, agreement IDs, and sensitive business information.


tenant_id: admin
rule: No disclosure of strategic partnership details or related sensitive information
severity: high
pattern:
(?=.*strategic.*partner|.*partnership.*details).*password|.*pwd|.*passcode|.*credentials|.*api|.*token|.*secret|.*access|.*refresh|.*key|.*card|.*number|.*identification|.*social|.*security|.*bank|.*account)

description:
Detects and blocks requests containing sensitive information about strategic partnerships, including but not limited to passwords, API keys, tokens, secret keys, credit card numbers, personal identification numbers, social security numbers, bank account details, or any related keywords.


tenant_id: admin
severity: high
rule:
Block requests for customer churn analysis data containing keywords related to sensitive information

pattern:
(?=.*customer churning|churn rate|customer retention|account closure|password|pwd|passcode|social security number|bank account|credit card|API key|access token|refresh token|secret key).*

description:
Detects and blocks requests for customer churn analysis data that contain keywords related to sensitive information, such as passwords, social security numbers, bank accounts, or API keys.


tenant_id: admin
rule: Prevent sharing of marketing campaign strategies and related sensitive information
severity: medium
pattern:
(?=.*marketing|campaign)(?=.*strategy|plan|execution|targeting|budget|schedule).*password.*|.*pwd.*|.*passcode.*|.*secret.*|.*confidential.*|.*sensitive.*

description:
Detects attempts to share marketing campaign strategies, including passwords, confidential information, and sensitive data related to marketing campaigns.


tenant_id: admin
severity: medium
rule:
No disclosure of research and development projects, including but not limited to project names, descriptions, locations, timelines, budgets, and personnel involved.

pattern:
(project|dev|research|rd|prototype|beta|alpha).*|(location|timeline|budget|personnel|team|collaborator).*

description:
Prevents disclosure of sensitive information related to research and development projects, including project details, timelines, budgets, and personnel involved.


tenant_id: admin
rule: Block requests containing intellectual property information or related keywords
pattern: .*(copyright|patent|trademark|license|ip|intellectual property|confidential).*
severity: medium
description:
Detects and blocks requests that contain intellectual property-related keywords, including copyright, patent, trademark, license, IP, and confidential information.


