Downloads your entire Enterprise DLP tenant configuration, including data profiles, data patterns, dictionaries, policies, and peripherals, and optionally your recent incidents, to local JSON files on your machine. The skill also builds a cross-reference index, identifies unused patterns, and generates a DuckDB loader script. Use it to analyze your configuration offline with DuckDB, pandas, or any analysis tool, or to capture the current state of your tenant before you make changes. Because the snapshot can include incident data, store the files in a location that meets your data handling requirements.

Access level—Read-only. The skill writes files only to your machine and doesn't change your tenant.

Command—Use the "tenant-snapshot" prompt. You can also specify the output directory, whether to include incidents, and how many days of incidents to include.

Example—Export my tenant configuration snapshot so I can review it offline.

Maps your data profiles and data patterns against the General Data Protection Regulation (GDPR), the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA). The skill classifies each required data element as covered, partial, not covered, or unknown, and checks your evidence storage, audit trail, and log export. It then scores your configured coverage and lists the gaps in priority order. The report shows incident activity separately as supporting evidence, not as proof that your configuration works. The skill doesn't change your tenant and doesn't certify compliance.

Access level—Read-only.

Command—Use the "audit-coverage" prompt for GDPR and HIPAA over the last 30 days. The frameworks and the time range are optional. The default is all four frameworks, and the time range can be 7, 30, or 90 days.

Example—Which compliance requirements do my data profiles cover, and where are the gaps?

Creates a data profile tailored to a compliance standard, such as GDPR, PCI DSS, HIPAA, or the Sarbanes-Oxley Act (SOX). The skill loads your existing data patterns and data profiles, identifies the patterns that match the standard, and recommends a profile configuration with a primary rule and a secondary rule. It creates the profile after you confirm. Use it before you put a new profile into enforcement.

Access level—Read-write. The agent creates the profile in your tenant only after you confirm it.

Command—Use the "create-compliance-profile" prompt for HIPAA. Replace HIPAA with the compliance standard you want. The compliance standard is required.

Example—Help me build a data profile for HIPAA. Which patterns should I include?

Recommends the right detection approach for the data you want to protect. The skill compares seven approaches, which are predefined patterns, custom regular expressions, exact data matching, document fingerprinting, keyword dictionaries, AI and ML detection, and custom classifiers. It recommends the best combination for your use case and explains the trade-offs so you can choose before you build a pattern or profile. After you confirm, the skill can also create the profile for you.

Access level—Read-only to get a recommendation. Read-write to have the agent create the profile.

Command—Use the "engine-selector" prompt for protecting source code. Replace the use case with your own. The use case is optional.

Example—What detection approach should I use for protecting source code? Walk me through the options.

Audits all of the data patterns in your tenant. The skill identifies patterns that no profile uses, patterns that overlap with each other, and patterns that are outdated, and it reports the ratio of predefined to custom patterns, the distribution of detection techniques, and coverage gaps. Use it to reduce the number of patterns you maintain and to find overlapping patterns that can contribute to duplicate incidents. To act on the suggestions, change your configuration with an AI agent.

Access level—Read-only.

Command—Use the "audit-data-patterns" prompt.

Example—Audit my current data patterns. Which ones are unused or overlapping?

Reviews one data profile and every pattern that it references. The skill explains what each rule detects, recommends changes, and can dry-run a file against the current or proposed definition. It reports its findings and its proposed changes in separate sections, and it applies a change only after you approve the exact change set.

Access level—Read-only to review. Read-write to apply the changes. With read-only access, the agent shows the plan and doesn't apply it.

Command—Use the "review-profile" prompt for the profile Finance Baseline. Replace the profile name with your own profile ID or exact name. To dry-run a file, include the file path in the prompt.

Example—Review my Finance Baseline data profile and tell me what each rule detects.

Adds country-specific patterns for a region to one data profile. The skill expands the region into a list of countries, matches each country to patterns in the pattern catalog, skips patterns that the profile already includes, and never removes anything. It applies the change only after you confirm the exact before-and-after difference.

Access level—Read-write to apply the change. With read-only access, the agent shows the plan and doesn't apply it.

Command—Use the "update-profile-for-region" prompt to add patterns for Germany to the profile Finance Baseline. The region is required, and it can be a list of countries or a region such as the European Union (EU), Asia-Pacific (APAC), North America, or Latin America (LATAM). You can also limit the patterns to the identity, financial, or health category.

Example—Add identity and financial patterns for France and Italy to my Finance Baseline profile.

Reviews your custom dictionaries. The skill lists each dictionary with its keyword count against the limit of 200 and its last update date, and it shows which data profiles reference it. It flags dictionaries that might be stale, and for one dictionary it counts duplicate and invalid entries without printing the existing keywords. The skill never deletes a dictionary, and it updates a word list only after you confirm the exact change.

Access level—Read-only to review. Read-write to update a word list. With read-only access, or for dictionaries that a parent tenant manages, the agent gives you steps to complete in the console.

Command—Use the "custom-dictionary-review" prompt. To review one dictionary, include its ID or exact name. To change what counts as stale, specify the number of days. The default is 180 days.

Example—Review my custom dictionaries and flag any that I haven't updated in 90 days.

Summarizes your recent incidents, from the last 24 hours by default, by severity, status, channel, and volume. The skill identifies the data profiles that trigger most often and the users that incidents affect most, examines the three most critical incidents in detail, and recommends next actions.

Access level—Read-only.

Command—Use the "triage-incidents" prompt for the last 7 days. The time range and the channel are optional.

Example—Triage my Enterprise DLP incidents from the last 24 hours.

Triages one incident. The skill loads the incident with its detections, profile context, snippets, and audit history, and assesses whether it is a false positive. It keeps evidence and inference in separate sections, summarizes snippets by default, and masks matched values. It changes the incident status or submits feedback only after you approve the exact action.

Access level—Read-only to triage. Read-write to change the status or submit feedback. With read-only access, the agent shows the plan and doesn't apply it.

Command—Use the "triage-incident" prompt for incident 12345. Replace 12345 with your incident ID. The incident ID is required.

Example—Triage incident 12345 and tell me whether it is a false positive.

Investigates one incident in depth. The skill pulls the full incident details, retrieves the associated reports with snippets, cross-references the data profile and patterns that triggered the incident, and produces an investigation report with a true-positive or false-positive assessment and remediation steps. The reports include snippets, which your AI model processes.

Access level—Read-only.

Command—Use the "investigate-incident" prompt for incident 12345. Replace 12345 with your incident ID. The incident ID is required.

Example—Investigate incident 12345 and recommend how to remediate it.

Summarizes the incidents for one user. The skill looks up the user by name, email address, or user principal name (UPN), asks you to choose if several users match, and queries incidents only after you confirm one. The summary covers incident volume, profiles, channels, actions, and the latest 10 incidents over a bounded time window, without file names or snippets. The skill doesn't report department information.

Access level—Read-only.

Command—Use the "investigate-user" prompt for jane.doe@example.com over the last 30 days. The user is required. The time range can be 7, 30, or 90 days, and you can limit the number of incidents to a maximum of 500. The default is 200.

Example—Summarize the Enterprise DLP incidents for Jane Doe over the last 30 days.

Reports incident volume trends, breakdowns by channel and severity, and the top users, resolved to names. The skill uses aggregate data only, so it retrieves no snippets or file names. It prints the time window and filters that it used, and it states that a department breakdown isn't available.

Access level—Read-only.

Command—Use the "dlp-incident-report" prompt for the last 30 days and show the top 10 users. The time range can be 24 hours, 7, 30, or 90 days. You can also specify an incident filter, the number of top users to show, up to 25, and a time zone.

Example—Give me an incident report for the last 7 days with a breakdown by channel and severity.

Finds data profiles that generate excessive incidents and proposes rule changes. The skill flags a profile when it accounts for 20 percent or more of your incidents, when 60 percent or more of its incidents have informational or low severity, or when 50 percent or more of at least five labeled incidents are false positives. For the profile you choose, it proposes up to three rule changes with an exact before-and-after difference. If you supply a test file, it dry-runs the current and proposed rules against that file. It patches the profile only after you approve the exact difference.

Access level—Read-only to analyze and propose changes. Read-write to apply them. With read-only access, the agent shows the plan and doesn't apply it.

Command—Use the "policy-tuning" prompt for the last 30 days. You can also specify the number of profiles to rank, up to 10 (the default is 5), a profile ID to skip the ranking, and a test file path for the dry run.

Example—Which of my data profiles generate the most false positives, and how can I tune them?

Reviews your alert exemption settings against best practices. The skill fetches your current alert and exemption configuration, analyzes the exemption period length and the notification settings, samples recent incidents for signs of alert fatigue or missed detections, and recommends changes.

Access level—Read-only. The skill recommends changes and doesn't apply them.

Command—Use the "review-exemption-settings" prompt.

Example—Review my alert exemption settings and tell me what to change.

Manages your tenant configuration as code. The skill exports your configuration, then stops so that you can edit the exported JSON file locally, and the agent never modifies the file. It then takes a backup export of the target tenant, validates the file, confirms the target tenant, and imports the file after you approve. If an import pauses, the skill helps you resolve missing dependencies and conflicts one approved action at a time. It also explains the 501, 403, and 500 errors that an import can return and the safe way to recover.

Access level—Read-only to export. Read-write to import. Writes aren't available with read-only access.

Command—Use the "config-export-import" prompt in round-trip mode. The mode can be export, import, or round-trip. To import a file, include its path. To resume a paused import, include the import job ID.

Example—Export my tenant configuration so that I can edit it locally and import it again.

Guides you through setting up Enterprise DLP for the first time. The skill researches your organization on the web to pre-fill your context, maps six data categories to custom data profiles, selects country-specific patterns, updates your data profiles, and reviews severity and exclusions. It then recommends an enforcement rule for each channel that your tenant supports. You create those rules in Strata Cloud Manager. You start with profiles that match your requirements instead of deciding which of the predefined options to enable on your own. Use it when you onboard a new tenant or a new business unit.

Access level—Read-write to apply the data profile updates. With read-only access, the agent shows the plan and doesn't apply it.

Command—Use the "onboarding" prompt for the healthcare industry. Replace the industry with your own. The industry is optional.

Example—Use the onboarding skill to help me set up Enterprise DLP for our compliance requirements.

Estimates your onboarding progress from the configuration that the APIs can see. The skill runs four ordered checks, which are available channels, tailored data profiles, enforcement settings, and evidence storage, and rates each as pass, partial, gap, or unknown. Your status is the first stage that doesn't pass. The report is an estimate, makes no claims about how effective your configuration is, and lists next steps for each gap.

Access level—Read-only.

Command—Use the "onboarding-status" prompt.

Example—How far along is my Enterprise DLP onboarding?

Reports the service health of your licensed DLP services, plus the number of data profiles and data filtering profiles in your tenant. The skill reports infrastructure readiness only. It doesn't validate detection or policy effectiveness. It marks telemetry that is empty as unknown, entries that are missing as missing, and entries without a timestamp as unverified, and it lists next steps.

Access level—Read-only.

Command—Use the "dlp-health-check" prompt.

Example—Run a health check on my Enterprise DLP services.

Gives you a quick-start guide inside your AI agent. The skill shows what the MCP server can do, explains how to use each category of tools, and gives example commands for common tasks, so you can learn what to ask without leaving your agent. Use it right after you set up the MCP server, or when you want a reminder of what is available.

Access level—Read-only.

Command—Use the "basic-usage" prompt.

Example—Use the basic-usage skill to show me what the Enterprise DLP MCP server can do.

Diagnoses connection and authentication problems between your AI agent and your Enterprise DLP tenant. The skill checks your environment variables, looks for accidental URL overrides, runs an end-to-end test with the command-line interface (CLI), tests authentication and the API directly, checks your MCP client configuration, and verifies the permissions of your service account. Use it when your agent cannot reach the MCP server, returns authentication errors, or reports that it does not have permission to complete a request.

Access level—Read-only.

Command—Use the "connection-debug" prompt.

Example—Use the connection-debug skill to find out why you cannot connect to Enterprise DLP.

Gives you step-by-step installation guidance for the Enterprise DLP MCP server inside your AI agent. The skill covers creating a service account, choosing between npx and the standalone binary, writing the configuration for your AI client, verifying the connection, and troubleshooting common failures, so you can complete or repeat the setup procedure on another machine without switching between the agent and this documentation.

Access level—Read-only. The skill guides you through setup and doesn't change your tenant.

Command—Use the "install" prompt. To skip to the configuration for your agent, name it in the prompt, for example Use the "install" prompt for Cursor.

Example—Use the install skill to walk me through setting up the Enterprise DLP MCP server for this agent.