patterns Classifier

Defines a classifier that detects labeled content by matching regular expressions.

The patterns classifier maps each configured label to one or more regular expressions. A value is detected for a label when any of that label's expressions finds a non-empty match anywhere in the text. Matching is case-sensitive. Matching runs in-process, with no external service. Use it for content with a recognizable shape, such as API keys and tokens.

classifiers:
  secrets0:
    type: patterns
    options:
      entropy: 3.0
      labels:
        secret.aws_key: "AKIA[0-9A-Z]{16}"
        secret.github_token:
          - "ghp_[A-Za-z0-9]{36}"
          - "gho_[A-Za-z0-9]{36}"

A classifier is applied to a message value by the classify model. A value longer than 65,536 characters, or that makes an expression exceed its match budget, is treated as detected, so the message is rejected rather than passed through unchecked.

Configuration (* required)

type: patterns

const

Specifies the classifier is patterns.

options*

object

The patterns specific options.

options:
  entropy: 3.0
  labels:
    secret.aws_key: "AKIA[0-9A-Z]{16}"

options.entropy

number | Minimum: 0

Minimum Shannon entropy of the matched text for a match to count as detected. Raising it filters out low-randomness matches, such as placeholder keys like AKIAXXXXXXXXXXXXXXXX, from expressions that would otherwise match them. When omitted, every match counts.

options.labels*

object as map of string | array of string

Named labels to detect, each mapped to a Java regular expression or a non-empty list of expressions. At least one label is required, and expressions must not be empty. A label is detected when any of its expressions matches.

Label names are chosen freely, and are the names a consumer such as the classify model's reject refers to.