Data loss prevention
Stage channel-specific rules, minimize sensitive telemetry, investigate matches, and recover false blocks.
Data loss prevention (DLP) policies detect or block supported transfers of sensitive data. Coverage depends on the endpoint platform, agent version, channel, and data visibility shown by the device's capabilities.
Create a policy
You need Administrator authority for the target group and approval for the collection purpose under Organization → Privacy → Endpoint monitoring.
At Policies → DLP → Create policy, define the sensitive-data classifier, direction, matched destination, target group, and action. Use built-in classifiers or approved organization patterns with a non-sensitive test sample. Test broad patterns for false matches before publication.
Select a channel only if Endpoints → Endpoint → Capabilities → DLP lists it. An endpoint file-write control does not imply inspection of every browser upload, encrypted archive, clipboard operation, or unsupported application. For opaque or encrypted content, the policy's uninspectable-content action applies; the event must not be shown as a successful content inspection.
Start in monitor mode and review Endpoints → DLP → Matches for the non-sensitive test sample's classifier, destination, and policy revision. If an expected match is missing, inspect the endpoint's channel capability and reporting health before changing enforcement.
Publish block only for tested channels and groups. After Policy → Adoption reports the revision as applied, repeat the test transfer and confirm both the endpoint's blocked result and its event action. Avoid collecting full file contents when metadata and a masked match explain the event.
Review and remediate
An Analyst opens DLP → Event to inspect masked context. Access to employee-sensitive detail or evidence requires the corresponding grant. Compare the user's authorized business task, destination ownership, and data classification before assigning malicious intent. A classifier match is not proof of data theft.
If a block is incorrect, correct its destination or classifier scope at Policy → Edit draft or create a bounded exception. Verify the agent applied the new revision, then have the user repeat the transfer through the approved channel. Guard cannot recall data already transferred before a block or recover an application transaction merely by removing a rule.
Privacy and retention
Set collection purpose and access at Organization → Privacy → Endpoint monitoring. Use the least data necessary and review applicable employee notices and internal authorization before broad rollout. Match metadata, raw evidence, and reports have different retention. Export permissions do not automatically include unmasked content.
Keep DLP separate from backup. A prevented write does not create a recoverable copy, and a monitored transfer does not establish that the receiving system deleted its copy.