Create an Endpoint DLP Data at Rest Policy Rule

1. Log in to Strata Cloud Manager.
2. (Optional) Create one or more custom data profiles that support Local Detection.
3. Select ConfigurationData Loss PreventionEndpoint DLP and click Create Scan.

   Enterprise DLP supports only one data at rest policy rule per tenant. To detect multiple types of sensitive data, add multiple data profiles to the single data at rest policy rule.

4. Add an Endpoint Compatible data profile to the Data at Rest policy rule.

   1. Click Add Local Data Profile to search for and select an Endpoint Compatible data profile.

      Data at rest scanning supports predefined regex data profiles and custom data profiles that support Local Detection only.
   2. Enable Trigger an Incident if you want inspected files on the endpoint that contain sensitive data to generate an incident.

      This setting applies per data profile.

      • Enabled—Prisma Access Agent generates a DLP incident when it detects sensitive data when a file that matches a data profile. Scan results also appear in the Data Asset Explorer.
      • Disabled—No DLP incident is generated. Scan results appear in the Data Asset Explorer only.
   3. Choose the Severity for files that match the data at rest policy rule.

      The severity applies to all DLP incidents and assets displayed in the Data Asset Explorer for all files that match this data profile. You can select Critical, High, Medium, Low, or Informational.
   4. Repeat this step to add additional Endpoint Compatible data profiles.

5. Select the File Types to include or exclude in the scan.

   • Any File Types (default)—Scan all supported file types.
     (Optional) Exclude specific file types from the scan.
   • Select File Types—Scan only the file types you select.

   Data at rest scanning supports files up to 100 MB.
6. (Optional) Configure the User scope to define which users the data at rest policy rule applies to.

   1. Enable Apply Users match criteria to all enabled data profiles.
   2. Select the Users added using Cloud Identity Engine whose endpoints you want to scan.

      • Any User (default)—Scan endpoints for all users.
        (Optional) Exclude specific users or groups from inspection.
      • Select Users—Scan endpoints only for the users and groups you select.
        (Optional) Exclude specific users or groups from inspection.

7. Configure the Folder Paths to define which directories on the endpoint the scan targets.

   Enter the folder paths for each operating system separately. You can specify paths for macOS, Windows, or both.

   Click Add Folder Path to include directories in the scan.

   Prisma Access Agent inspects only actual files and directories within the specified paths, not symbolic links (shortcuts that point to files or directories in other locations).

   Some examples of commonly configured folder paths include:

   macOS	Windows
   /Users/*/Desktop	C:\Users\*\Desktop
   /Users/*/Documents	C:\Users\*\Documents
   /Users/*/Downloads	C:\Users\*\Downloads
   /Users/*/Library/CloudStorage/GoogleDrive-*	C:\Users\*\AppData\Local\Google\Drive
   /Users/*/Library/CloudStorage/OneDrive-*	C:\Users\*\OneDrive - Company Name

8. Click Next to continue.
9. Review the policy rule Summary to verify the configuration is correct and click Save.
10. Push your Endpoint DLP policy rule.

    1. Select Push Policies and click Push Policies.
    2. (Optional) Enter a Description for the Endpoint DLP policy push.
    3. Review the Push Policies scope to understand which Endpoint DLP policy rules and configuration changes are included in the push.
    4. Click Push.
11. Review your Endpoint DLP Audit and Push Logs.
12. Review the Data Asset Explorer or your DLP incidents.

    The Data Asset Explorer displays assets that match your data at rest policy rule regardless of whether a DLP incident was generated.

    Prisma Access Agent generates a DLP incident when the data at rest scan detects sensitive data on an endpoint that matches the configured data profiles and you enabled Trigger an Incident for the matched data profile.