Implementing Endpoint Dlp Controls

---
name: implementing-endpoint-dlp-controls
description: 'Use when implements endpoint Data Loss Prevention (DLP) controls to
  detect and prevent sensitive data exfiltration through email, USB, cloud storage,
  and printing. Use when deploying DLP agents, creating content inspection policies,
  or preventing unauthorized data movement from endpoints. Activates for requests
  involving DLP, data exfiltration prevention, content inspection, or sensitive data
  protection on endpoints.

  '
domain: cybersecurity
tags:
- endpoint
- DLP
- data-loss-prevention
- data-protection
- content-inspection
subdomain: endpoint-security
version: 1.0.0
author: oyi77
license: Apache-2.0
atlas_techniques:
- AML.T0024
- AML.T0056
nist_ai_rmf:
- GOVERN-1.1
- MEASURE-2.7
- MANAGE-3.1
- MAP-5.1
- MANAGE-2.4
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
category: cybersecurity
---

# Implementing Endpoint Dlp Controls

## Overview

Cybersecurity skill for implementing endpoint dlp controls. Follows industry best practices and security standards.

## When to Use

**Trigger phrases:**
- "implementing endpoint dlp controls"
- "Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving th"
- "Configuring content inspection rules for email attachments, USB transfers, and c"
- "Implementing Microsoft Purview DLP or Symantec DLP endpoint policies"


Use this skill when:
- Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization
- Configuring content inspection rules for email attachments, USB transfers, and cloud uploads
- Implementing Microsoft Purview DLP or Symantec DLP endpoint policies
- Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)

**Do not use** for network DLP (inline proxy-based) or cloud-only DLP (CASB).


## When NOT to Use

- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope


## Prerequisites

- Microsoft 365 E5 or standalone Microsoft Purview DLP license
- Microsoft Purview compliance portal access (compliance.microsoft.com)
- Sensitive Information Types (SITs) defined for organization data
- Endpoint onboarded to Microsoft Purview (via Intune or SCCM)

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Assess Requirements** — Evaluate current environment and define endpoint dlp controls implementation requirements.
2. **Design Architecture** — Plan the endpoint dlp controls architecture, including components, integrations, and data flows.
3. **Configure Components** — Set up and configure each endpoint dlp controls component according to best practices.
4. **Test Integration** — Validate that all components work together. Run functional and security tests.
5. **Deploy to Production** — Roll out the implementation with monitoring and rollback capabilities.
6. **Validate and Document** — Verify the implementation meets requirements. Document configuration and runbooks.

## Tools

- **Configuration Management** — Infrastructure as code and automation
- **Monitoring Stack** — Observability and alerting
- **Documentation Platform** — Runbooks and architecture docs


## Process

1. **Prepare** — Gather requirements, verify prerequisites, set up environment
1. **Execute** — Run implementing endpoint dlp controls workflow with configured parameters
1. **Verify** — Validate output meets requirements, document results

## Verification

- [ ] All endpoint dlp controls procedures executed completely and documented
- [ ] Findings validated against multiple data sources
- [ ] False positives identified and filtered
- [ ] Results documented with evidence and timestamps
- [ ] Recommendations provided with risk-based prioritization

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |