Endpoint DLP enables your Security administrators to control the use of peripheral devices by enabling you to allow or block their use, or to alert your Security administrators when a peripheral device is connected to an endpoint in your network. To prevent exfiltration of sensitive data to peripheral devices, use the Enterprise Data Loss Prevention (E-DLP) advanced detection methods, as well as custom data profiles to define custom traffic match criteria or use predefined ML-based and regex data profiles.

Install the Prisma Access Agent on the endpoints that you need to protect. The agent will detect file movement between the endpoint and the peripheral device and then evaluates and enforces your Endpoint DLP policy rules. When necessary, the Prisma Access Agent forwards the traffic to Enterprise DLP for inspection and to render a verdict. Enterprise DLP then communicates the verdict to the Prisma Access Agent which executes the action you configured in the Endpoint DLP policy rule. Additionally, the Prisma Access Agent is responsible for displaying a notification to the end user when they generate a DLP incident.

The following is an example of the process Enterprise DLP uses to inspect endpoints. This process succeeds only if you installed the Prisma Access Agent and that you already configured your Endpoint DLP policy rules.