> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/data-in-motion-rules.md).
# Data-in-Motion Rules
Data-in-motion Rules define the DLP policies that govern how sensitive data is handled when it moves across endpoints. These rules specify what data patterns to detect, which applications and destinations to monitor, and what actions to take (allow, block, notify) when sensitive data movement is detected. Rules can be created, edited, cloned, enabled/disabled, deleted, and prioritized.
For more information, see [Create data-in-motion rules](/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/configure-dlp-end-to-end.md#create-data-in-motion-rules).
Users access Data In Motion Rules by going to **Modules** → **Data Security** → **Endpoint Data-in-Motion Rules**.
| Permission | Description | Recommended Roles |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | Users cannot access the **Data-in-motion Rules** page. | - SOC Tier-1 Analyst: DLP rule management is outside triage responsibilities.
- IT Admin: DLP rule management is outside the IT infrastructure administration scope.
|
| View | Users can navigate to the **Data-in-motion Rules** page and see all configured DLP rules in the grid view. They can view rule names, priorities, statuses (enabled/disabled), target applications, conditions, actions, and inspect rule details. | - SOC Tier 2 and 3 Analysts: May need to review DLP rules when investigating cases/issues,
- Threat Hunter: May need to understand DLP rules to correlate with threat hunting findings
|
| View/Edit | Users have full control over Data-in-motion rules. They can create, edit, duplicate, delete, and enable/disable rules. They can also change rule priorities. All context menu actions are fully accessible. | - Security Engineer: Primary responsibility for creating and maintaining DLP rules.
- Security Admin: Full administrative access to all DLP configurations.
|
**Required and recommended permissions**
Data-in-Motion rules act as the enforcement arm of your DLP strategy. To build effective rules, administrators must have visibility into the sensitive data profiles they are detecting and the applications they are monitoring.
| Permission | Permission Level | Reason |
| -------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Endpoint DLP Settings | View | Strongly recommended. Global DLP settings (such as the default action, domain names, and browser extensions) directly affect rule behavior and enforcement. |
| Endpoint Applications and Groups | View | Strongly recommended. DLP rules directly reference specific endpoint applications and application groups to define their scope. Viewing these catalogs is essential to understand and configure rule targeting. |
| Agent Administrations | View | Strongly recommended. Understand which endpoints have the XDR agent deployed. |
| Data Classification | View | Strongly Recommended. DLP rules directly reference the data profiles configured within the Data Classification module. Understanding these profiles is required to know what the rule considers sensitive data. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/data-in-motion-rules.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.