Peripheral devices create potential data exfiltration paths on managed endpoints. Users can move sensitive data to connected storage devices, printers, and applications without passing through network-based controls. Endpoint DLP lets you define policy rules that allow, block, or monitor file transfers to and from peripheral devices based on data sensitivity, helping you prevent sensitive data from leaving your organization through uncontrolled channels.

Add individual peripheral devices when you want to enforce controls on specific devices rather than all devices of a given type. When you add a peripheral, you provide identifying details that Prisma Access Agent and Enterprise Data Loss Prevention (E-DLP) uses to recognize the device. You can then reference that peripheral in a peripheral group and, ultimately, in an Endpoint DLP policy rule. If you want to allow or block access to all peripheral devices of any type without targeting specific devices, you can create an Endpoint DLP policy rule directly without adding individual peripherals.

Before you can create an Endpoint DLP policy rule that targets specific peripherals, you must add the peripheral devices and organize them into peripheral groups. Peripheral groups let you apply the same security enforcement to multiple devices simultaneously. A policy rule references a peripheral group, not individual devices, which makes the group a required step between adding a device and enforcing a policy against it.

You add one peripheral device at a time. During the add process, you select the peripheral type and provide the configuration details that Enterprise DLP uses to identify the device. Each peripheral type has its own set of identifying fields. After you add your peripheral devices, create peripheral groups and then create an Endpoint DLP policy rule to enforce the access controls you need.