Use Endpoint DLP to prevent exfiltration of sensitive data to peripheral devices such as USB devices, printers, and network shares, or to control access to them. To prevent exfiltration of sensitive data, files moved between a device and the connected peripheral device are sent to Enterprise Data Loss Prevention (E-DLP) for inspection and verdict rendering.

You can also use Endpoint DLP to scan managed endpoint devices for sensitive data at rest. Data at rest scanning uses the local detection engine on the Prisma Agent to discover sensitive files across Windows and macOS devices using regex-based and OCR-based pattern matching.