Data Loss Prevention
Building a custom DLP policy
Start from a template or build from scratch: choose what to detect, which channels to watch, and what action to take when a rule matches.
A DLP policy is three decisions: what to detect, where to watch for it, and what to do when it happens.
1. What to detect
Match on content (keywords, or patterns like card and ID numbers) or on file type and sensitivity labels.
2. Which channels
Apply the rule to the channels that matter — uploads, email, removable media, clipboard, printing, and more.
3. What action
- Monitor — record and alert without interrupting the user.
- Warn — notify the user that the action is risky.
- Block — stop the action outright.
Start in Monitor mode to see what a rule would catch before you enforce it.