Built-in Detection Patterns
Signal Canary includes pre-configured patterns for common sensitive data types. These patterns are optimized for accuracy and minimize false positives.
Personal Identifiers
| Pattern | Detects | Example |
|---|---|---|
ssn | US Social Security Numbers | 123-45-6789 |
passport | Passport Numbers (US, UK, EU) | A12345678 |
drivers_license | Driver's License Numbers | D123-456-789 |
national_id | National ID Numbers | Various formats |
Financial Data
| Pattern | Detects | Example |
|---|---|---|
credit_card | Credit/Debit Card Numbers | 4111-1111-1111-1111 |
bank_account | Bank Account Numbers | 123456789012 |
routing_number | Bank Routing Numbers | 021000021 |
iban | International Bank Numbers | GB82WEST12345698765432 |
Credentials & Secrets
| Pattern | Detects | Example |
|---|---|---|
api_key | Common API Key Formats | sk-proj-abc123... |
aws_key | AWS Access Keys | AKIAIOSFODNN7... |
github_token | GitHub Personal Access Tokens | ghp_xxxx... |
private_key | RSA/SSH Private Keys | -----BEGIN RSA PRIVATE KEY----- |
password | Password patterns in code | password = "..." |
Contact Information
| Pattern | Detects | Example |
|---|---|---|
email | Email Addresses | user@example.com |
phone | Phone Numbers (US/Intl) | +1 (555) 123-4567 |
address | Physical Addresses | 123 Main St, City, ST 12345 |
Creating Custom Patterns
For organization-specific data, you can create custom detection patterns using regular expressions (regex).
1 Go to Pattern Settings
In your DLP policy, click Add Custom Pattern.
2 Define the Pattern
Enter a name and the regex pattern to match:
Name: Employee ID
Pattern: EMP-[0-9]{6}3 Test Your Pattern
Use the test panel to verify matches before saving.
Regex Tips for DLP
Keep patterns specific to avoid false positives. A pattern that matches too broadly will flag legitimate content.
Common Regex Syntax
[0-9] | Any digit 0-9 |
[A-Z] | Any uppercase letter |
[a-zA-Z] | Any letter (upper or lower) |
{n} | Exactly n occurrences |
{n,m} | Between n and m occurrences |
+ | One or more |
* | Zero or more |
? | Zero or one (optional) |
\b | Word boundary |
| | OR (alternative patterns) |
Pattern Examples
Internal Project Codes
# Match: PROJ-ABC-12345
Pattern: PROJ-[A-Z]{3}-[0-9]{5}Customer Account Numbers
# Match: CUST-2024-00001234
Pattern: CUST-[0-9]{4}-[0-9]{8}Internal IP Addresses
# Match: 10.x.x.x or 192.168.x.x
Pattern: (10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3})Medical Record Numbers
# Match: MRN-12345678
Pattern: MRN-[0-9]{8}API Endpoints (Internal)
# Match: api.internal.company.com
Pattern: api\.internal\.[a-z]+\.com
Escape special regex characters (. * + ?) with a backslash when you want to match them literally.
Well-designed patterns are the foundation of effective DLP. Take time to test and refine your patterns for the best results.