Focus

Data Protection Events (DLP)

Table of Contents

Data Protection Events (DLP)

Data protection events capture file transfers, clipboard activity, printing, form submissions, and GenAI interactions monitored by Prisma Browser data loss prevention controls.

Event Types

Event Type	UI Name	Description
fileDownload	File download	A user downloaded a file
fileUpload	File upload	A user uploaded a file
fileOpen	File open	A user opened a file from local storage in the browser
fileDecrypt	File decrypt	A user decrypted a file
clipboardCopy	Cut/copy	A user cut or copied content
clipboardPaste	Paste	A user pasted content
print	Print	A user printed a page
formSubmission	Read-only webpage	A user attempted to submit data on a read-only page
genAIPrompt	GenAI prompt	A user submitted a prompt to a GenAI application
maskingContent	Webpage data masking	Sensitive content was masked on a page
unmaskContent	Webpage data unmasking	Previously masked content was unmasked by a user
sanitizingContent	Typing guard	Sensitive content was sanitized in an input field before submission
chatBotInteraction	ChatBot interaction	A user interacted with a chatbot
screenshot	Screenshot	A user took a screenshot of browser content
screenshare	Screenshare/Screen record	A user started screen sharing or screen recording
secureScreenshot	Secure screenshot	An admin-initiated secure screenshot was captured for evidence

Context Fields — File Events

Field	UI Label	Description
file.name	File name	The name of the file
file.extension	File type	The file extension (e.g., pdf, xlsx, docx)
file.mimeType	File format	The MIME type of the file
file.sha256	File SHA-256	The SHA-256 hash of the file content
file.localPath	File path	The local path from which the file was selected
file.url	File download URL	The URL associated with the file transfer
file.originDownloadUrl	File origin	The original source URL of the file
file.operation	Activity	The file operation type (Download, Upload, Open, Decrypt)
file.isEncrypted	Encrypted	Whether the file is encrypted
content.lengthBytes	File size	The content size in bytes
content.scanEngine	Scan engine	The scan engine used to analyze the file (Talon, CrowdStrike, CrowdStrike Quick Scan, CrowdStrike Indicators, OPSWAT MetaDefender Core, Yazamtech, Symantec, Votiro, AWF)
content.categories	Detected content types	Sensitive data categories found in the content
content.mipMatchedLabel	MIP label match	Microsoft Information Protection label matched

DLP Context

When a data profile or classifier matches:

Field	UI Label	Description
dlp.matchedDataProfiles	Matched data profiles	Names of data profiles that matched the content
dlp.detectedClassifiers	Detected classifiers	Classifiers detected in the content (e.g., Credit Card Number, Social Security Number)
dlp.matchedClassifiers	Matched classifiers	Classifiers that triggered the rule action
dlp.matchedClassifiersOccurrences	Occurrences	Number of times each matched classifier was found
dlp.matchedClassifiersConfidence	Confidence	Confidence level for each matched classifier
dlp.parentDataProfile	Parent data profile	The parent data profile name

Context Fields — Clipboard Events

Field	UI Label	Description
clipboard.data	Data	The clipboard content (when enhanced logging is enabled)
clipboard.fromUrl	Source	The URL from which data was copied
clipboard.selectedElement	Element class	The DOM element class from which data was copied
clipboard.searchEngine	Search Engine	If the copy was triggered by a search engine feature (Bing, Google Lens, Yandex)
clipboard.fromLocalDesktopApp.productName	Source app	The local desktop app from which data was copied (BPY)
clipboard.fromLocalDesktopApp.processPath	Source process	The process path of the source application
clipboard.fromLocalDesktopApp.windowTitle	Source window	The window title of the source application

Context Fields — Print Events

Field	UI Label	Description
print.printerName	Printer name	The name of the printer used
print.printerLocation	Printer location	The printer location

Context Fields — Screenshot and Screen Recording Events

Field	UI Label	Description
page.capture.isSecureScreenshot	Triggered by	Whether this is an admin-initiated secure screenshot
page.capture.triggeredByUrl	Screen shared via	The application or URL that triggered the screen capture

Context Fields — GenAI Prompt Events

Field	UI Label	Description
genAIPrompt.prompt	Prompt	The text of the prompt submitted to the GenAI application (when enhanced logging is enabled)
genAIPrompt.includedFiles	Included files	Files attached to or included in the prompt
genAIPrompt.embeddedGenAI	Embedded GenAI	The embedded AI application where the prompt was sent (Gemini, Claude, ChatGPT, Copilot, Perplexity)
genAIPrompt.isPromptCollected	Prompt collected	Whether the prompt text was captured
application.isGenAI	GenAI application	Whether the target application is classified as a GenAI application

Block Reasons

When a DLP event is blocked, the following reasons may apply:

Block Reason	Description
Forbidden file type	The file type is not allowed by policy
Forbidden file size	The file exceeds the size limit defined in policy
Forbidden file SHA-256	The file hash matches a blocked file hash
Sensitive content	Sensitive data was detected by DLP scanning
Sensitive file label	The file has a sensitivity label that is blocked
Encrypted file	The file is encrypted and encrypted files are blocked
Non-encrypted file	The file is not encrypted and policy requires encryption
External provider	An external DLP provider flagged the content
File scan failed	The file scan did not complete successfully
Cloud scanning timeout	The cloud-based scan timed out
Cloud scanning file size	The file exceeds the cloud scanning size limit
Cloud scanning service unavailable	The cloud scanning service is temporarily unavailable
Page with masking	The page has data masking applied
Page with watermark	The page has watermarking applied
Page with account protection	The page has Account Shield protection active
Timeout	The operation timed out
Browser close	The browser was closed during the operation
Inactivity	The session was inactive

Live Scanning Context

For events detected by live page scanning:

Field	Description
content.liveScanning.scanMethod	The scan method used (Content analysis, Injected script, Screenshot analysis)
content.liveScanning.triggeredBy	Whether scanning was triggered by the user or automatically by the webpage
content.liveScanning.maliciousObject	The type of malicious object found (Iframe, Webpage, Service worker, Clipboard)
content.liveScanning.maliciousContentUrl	The URL of the malicious content found
content.liveScanning.detectionID	Detection identifier for correlation

Examples

File Upload — Blocked (Sensitive Content)

Field	Value
Type	File upload
Category	DLP
User	john.smith@acme.com
URL	www.chatgpt.com/upload
Application	ChatGPT
GenAI	Yes
File name	employee-ssn-list.xlsx
Action	Blocked
Block reason	Sensitive content
Matched data profiles	PII - Social Security Numbers
Matched classifiers	Social Security Number
Occurrences	247
Confidence	High

GenAI Prompt — Blocked

Field	Value
Type	GenAI prompt
Category	DLP
User	dev.engineer@acme.com
URL	www.chatgpt.com/chat
Application	ChatGPT
Included files	api-keys.env, database-config.yml
Action	Blocked
Block reason	Sensitive content
Matched data profiles	Secrets - API Keys
Matched classifiers	API Key, Private Key
Policy rule	Block sensitive prompts to external AI

Clipboard Paste — Blocked

Field	Value
Type	Paste
Category	DLP
User	jane.doe@acme.com
Source	www.internal-crm.acme.com/contacts
URL	www.chatgpt.com
Application	ChatGPT
Action	Blocked
Block reason	Sensitive content
Detected content types	Phone Number, Email Address
Policy rule	Block paste to GenAI apps

Screenshare — Blocked

Field	Value
Type	Screenshare/Screen record
Category	DLP
User	sarah.kim@acme.com
URL	www.zoom.us/meeting/123456
Screen shared via	zoom.us
Action	Blocked
Policy rule	Block screen sharing on sensitive pages

Audit Events

Extension Events