32. Data loss prevention (DLP)

DLP finds sensitive data on hosts (at rest) and watches it leave (USB and removable media, cloud or web upload, email attachments, clipboard, print, network shares). A policy says what is sensitive and what to do on each channel: allow, alert, block or quarantine. The agent on each host enforces the policy and reports incidents.

DLP is a licensed module. What a host can actually enforce depends on its operating system and on the agent running with full privileges; the Enforcement status tab reads it live from the agent (32.6). Do not assume a block happened: every incident says what was actually enforced.

Permissions:

32.1 The tabs#

Path: DLP. The page title is Data loss prevention.

32.2 Incidents#

The Incident stream: Incident, Severity, Status, Action, Enforcement, Residual risk, Source, Detected. Filter incidents... narrows the list.

The Enforcement column says what really happened:

Residual risk is the exposure that remains given what was done.

Procedure: triage an incident#

Permission: Triage findings.

1. Click the incident. The drawer shows File, Data type, Severity, Matches, Residual risk, Host, User, Process, Attempts, Destination, Policy action, Actually enforced, Matched patterns and Context.
2. Under Set status press one of the statuses:

3. Type the reason in the note box ("Kept with the finding. A status change without a reason is a decision nobody can review later.") and press Save. You see "Saved.".

A confirmed exposure is a security incident: open an investigation (chapter 34) and, if the host must be contained, use Defense (chapter 36).

Incidents are never deleted from the console. Close them with resolved, false positive or authorised; they stay as the record.

32.3 Policies#

Procedure: create a DLP policy#

Permission: Manage DLP. Four-eyes: no.

Risk: a block or quarantine action stops users' work on every host in scope; a broad device-control setting can block every USB stick. Rollback: edit the policy back, or disable it; agents pick up the change on their next policy refresh.

1. Open DLP > Policies and press New policy.
2. Fill Name, Data type (pii, pci, phi, credentials, financial, ip, confidential, custom) and Severity. Leave Enabled off until tested.
3. Detection rules: choose + add rule... and the rule type:

"A policy with no rules falls back to the built-in detector for its data type."

4. Per-channel action: for each channel (USB / removable, Cloud / web upload, Email attachments, Clipboard, Print, Network shares, At-rest / discovery) choose allow, alert, block or quarantine.
5. Optional controls:

6. Test against sample: paste text into Paste text to test this policy against... and press Test text (or test a file) to see what would match.
7. Press Save policy. Then tick Enabled and save again when you are satisfied.

What you see: the policy in the Policy catalogue (Name, Data type, Severity, Rules, Blocking channels, Enabled).

If it fails: the form names the problem (for example an invalid regular expression). Save is disabled while Name is empty.

Procedure: change, disable or delete a DLP policy#

Permission: Manage DLP. Four-eyes: no. Risk: a change to a blocking action or device control takes effect on every host in scope at its next policy refresh. Rollback: change it back the same way.

To change it:

1. Open DLP > Policies and click the policy's row. The drawer Edit DLP policy opens.
2. Change the fields (as in "Create a DLP policy"). Test against a sample again.
3. Press Save policy. If it fails, the drawer shows the reason ("Save failed" or the server's message).

To disable it (stop enforcing, keep it and its incidents):

1. Open the policy, untick Enabled, and press Save policy.
2. The catalogue shows off in the Enabled column. Agents stop applying it at their next policy refresh. Tick Enabled and save to turn it back on.

To delete it:

1. Press the bin on the policy's row and confirm "Delete this policy?".
2. A policy that has raised incidents is not deleted: the page shows "Policy has N incident(s); archive it instead of deleting it (archiving disables it on every agent and keeps the incident trail)." The console has no archive button in this release: disable the policy instead (above). It keeps the incident trail and stops enforcement.

32.4 Discovery (data at rest)#

Procedure: run a discovery scan#

Permission: Manage DLP. Risk: the agent reads every file under the paths; on a large share this takes time and disk I/O. Run large scans out of hours.

1. Open DLP > Discovery. Under Start a discovery scan choose the Agent and enter Paths (comma separated).
2. Press Start scan.
3. Watch Recent scans (Name, Host, Status, Files scanned, Sensitive found, Completed); Refresh updates it.
4. Read the Sensitive-file inventory: Host, Path, Rules, Detail, Size, SHA-256. CSV and JSON download it for the auditor.

Procedure: schedule discovery#

1. In Scheduled discovery press New schedule.
2. Set the cadence (Every N minutes - 15 or more, Daily, Weekly, Monthly (30 days)), the hosts (All hosts, Selected hosts, All hosts of a platform), and Paths ("empty = the platform defaults"). Leave Enabled ticked.
3. Press Save schedule.

"No schedules. Discovery runs only when started by hand." until you create one.

Procedure: run, change, pause or delete a discovery schedule#

Permission: Manage DLP. Four-eyes: no.

1. Open DLP > Discovery, section Scheduled discovery. Each row shows the name, hosts, paths, cadence, next run, last run and the last result.
2. To run it now: press the play button (Run now). You see "<name>: N scan(s) dispatched".
3. To change it: click the row. The drawer Edit discovery schedule opens; change the fields and press Save schedule.
4. To pause or resume it: press disable (or enable) on the row. A paused schedule shows "(disabled)" after its name and no next run.
5. To delete it: press the bin (Delete) and confirm "Delete schedule "<name>"?". Scans it already ran, and the inventory they built, are kept.

If it fails: "Run failed", "<name> could not be disabled" (or enabled), "<name> could not be deleted", with the reason.

Discovery scans themselves are kept as a record; there is no delete for a scan or for the sensitive-file inventory in the console.

32.5 Where is this file#

Find copies of a file across the estate.

1. Open DLP > Where is this file.
2. Enter a SHA-256 (64 hex characters), a Name contains fragment, and/or a Sample document (fingerprint, finds edited copies).
3. Tick Search online agents live to ask the agents now, not only the inventory.
4. Press Search.

Results: Host, Path, Matched by, Source. "No matches." means none was found in the inventory or on the online agents.

32.6 Enforcement status#

1. Open DLP > Enforcement status and choose the host in Select host....
2. The console asks the agent ("Querying the agent...") and shows each channel with what it can do, and Controls applied now (device rules with Device, Product, Decision, and blocked domains).

"not root (enforcement limited)" means the agent does not run with full privileges; blocking will not work on that host. "Agent did not answer: ... Enforcement status is unknown." means the host is offline.

32.7 If it fails#