- kind: regex
pattern: '(?i)\bpassword authentication failed for user "([^"]{1,64})"'
category: name
label: pg_failed_auth_user
- kind: regex
pattern: '(?i)\bjdbc:postgresql://[^\s"''<>]+'
category: url
label: pg_jdbc_url
- kind: regex
pattern: '(?i)\bpostgres(?:ql)?://[^\s:@/]+:[^\s:@/]+@[^\s"''<>]+'
category: url
label: pg_connection_uri
- kind: allow
values:
- "postgres"
- "postgresql"
- "postgres.conf"
- "postgresql.conf"
- "localhost:5432"
- "127.0.0.1:5432"
- "postgres://localhost"
- "postgresql://localhost"
- "postgres://127.0.0.1"
- "postgresql://127.0.0.1"
- "true"
- "false"
- "yes"
- "no"
- "null"
- "none"
- "nil"
- "0"
- "1"
- "localhost"
- "127.0.0.1"
- "0.0.0.0"
- "::1"
- "changeme"
- "example"
- "sample"
- "placeholder"
- "${*}"
- "{{*}}"
- "example.com"
- "example.org"