> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp/configure-dlp-end-to-end.md). # Configure DLP end-to-end This section describes how to get up and running with Cortex DLP, including how to define Endpoint DLP settings, add applications and application groups, and define data-in-motion rules. ### Onboarding checklist for DLP We recommend following these steps to ensure all requirements for setting up DLP are met, protecting sensitive data, and maintaining compliance with your organization's standards. {% stepper %} {% step %} ### Step 1. Configure endpoint DLP settings Configure endpoint DLP settings to define your organization's DLP setup. See [Configure endpoint DLP settings](#configure-endpoint-dlp-settings). {% endstep %} {% step %} ### Step 2. Install the DLP browser extension Install the DLP browser extension on your endpoint. This extension works with the DLP agent to monitor and enforce security policies on web-based activities. See [Install DLP browser extension on your endpoint](#install-dlp-browser-extension-on-your-endpoint). {% endstep %} {% step %} ### Step 3. Check permissions for user roles Verify that **Data Security Admin** can create, manage, and remove data-in-motion rules. See [Check for permissions for user roles](/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/assign-user-roles-and-groups.md). {% endstep %} {% step %} ### Step 4. Add applications Add local and web applications to the application group when selecting source and destination in the data-in-motion rule. See [Create endpoint applications](#create-endpoint-applications). {% endstep %} {% step %} ### Step 5. Add application groups Create application groups for the source and destination in the data-in-motion rule. See [Create endpoint application groups](#create-endpoint-application-groups). {% endstep %} {% step %} ### Step 6. Define DLP rules Rules control sensitive data transfers based on context. They can block, allow, or report transfers. See [Create data-in-motion rules](#create-data-in-motion-rules). {% endstep %} {% step %} ### Step 7. DLP status in all endpoints View the extension and DLP installation status on each endpoint. See [DLP status in all endpoints](/cortex-xsiam/protect-your-endpoints/endpoint-dlp/dlp-status-in-all-endpoints.md). {% endstep %} {% step %} ### Step 8. Review threats Track and investigate issues triggered when a data-in-motion rule is violated. See [Cortex DLP threat detection and issues](/cortex-xsiam/protect-your-endpoints/endpoint-dlp/cortex-dlp-threat-detection-and-issues.md). {% endstep %} {% endstepper %} ### Configure endpoint DLP settings Configure the endpoint DLP settings to manage your organization's DLP policies. 1. In **Default Actions & Thresholds**, there are two parts. 1. **Data-in-motion default action and threshold configurations**: Select the fallback policy for instances when the DLP process fails or times out: * **Allow file movement (fail-open)**: Allows the file transfer, preventing service interruption. * **Block file movement (fail-close)**: Blocks the file transfer.

Note

When a fail-close action occurs, the system creates a Data movement blocked by Endpoint DLP fail-close action issue.

2. **Auto disablement of rule threshold** This setting refers to rule suppression. When the number of hits exceeds the set number, the rule is disabled. Click **Reset** to revert to the default threshold as configured in the system. If a rule was suppressed, you can view details in **Settings** → **Management Audit Logs**. 2. For **Corporate Account Domain**, add the web application resources. 3. **Cortex Data Security Extension (Web DLP Channel)**: This option lets you manage browser extension installation and removal. Configure Chrome and Edge separately using one of the two modes. By default, MDM deploys the extension to selected endpoints. See the earlier instructions for installing the DLP browser extension. * **MDM**: This default option distributes and installs the extension using a supported management tool, such as Microsoft Intune for Windows or JAMF for macOS. After installation, the agent communicates with the extension to activate endpoint DLP. * **Forced activation (by XDR)**: This option installs a missing browser extension automatically. The endpoint must be associated with a domain.

Note

* **Disable**: The extension is disabled.

Note

With MDM, the extension is user-managed. Cortex does not remove an installed MDM extension. It only disables communication with the DLP extension.

4. In the **End User Dialog** section, add the default pop-up message for these events: * **Enable User Interaction**

Note

You can specify the end-user message per rule.

* **Reporting Mismatch (FP)** * **Rule Override** For each option, enter the default text to display in the end-user dialog. * In the **Title**, enter the default dialog name. * In the **Body**, enter the dialog message. You can use the system default text. This also applies to **Reporting Mismatch** and **Rule Override**. * In the **Admin Email Link** field, enter the default admin email to include in the body. * In the **Dialog Main Button Label**, enter the text for the button that closes the window. ### Install DLP browser extension on your endpoint To activate DLP, you must install the CDSx browser extension on your endpoint. This extension works with the DLP agent to monitor and enforce security policies on web-based activities. {% hint style="info" %} ### Note Extensions are not enabled in `Incognito` or `InPrivate` modes in Chrome and Edge. It is recommended to disable these modes in the organization. {% endhint %} #### Enabling the extension in Cortex 1. Navigate to **Modules** → **Data Security** → **Endpoint Data-in-Motion Rules** → **Endpoint DLP Settings**. 2. For **Cortex Data Security Extension (Web DLP Channel)**, select the browser extension activation mode. See [Configure endpoint DLP settings](#configure-endpoint-dlp-settings) for more information.
Windows Use a managed deployment platform like UEM, MDM, or group policy to push the browser extension to the endpoints. Refer to the steps below to download the registry file (reg file), install, and configure settings to activate the extension on the endpoints. {% hint style="info" %} ### Important Endpoints should be linked to the domain. {% endhint %} Select one of the following managed installation options: **1. Managed installation from group policy** Extension ID & URL: `aalncdhjokfcbldaemnehledpfpibopi;file:///C:\ProgramData\Cyvera\Everyone\CDSX\extension.xml` **2. Managed installation from Intune** Extension ID & URL: `aalncdhjokfcbldaemnehledpfpibopi;file:///C:\ProgramData\Cyvera\Everyone\CDSX\extension.xml` **3. Managed installation on Edge** You must first deploy the CDSx extension from the Microsoft Edge policy. a. From the Microsoft 365 admin center, navigate to Settings+Microsoft Edge. b. Select the **Configuration policies** tab, and select **+Create Policy**. c. Enter a name (example: CDSx Extension Deployment), add an optional description, select the **Policy type**, and then click **Next**. d. In **Settings**, select **+Add Setting**. Search and select the **ExtensionInstallForcelist** policy. e. In **Control which extensions are installed silently**, paste `aalncdhjokfcbldaemnehledpfpibopi;file:///C:\ProgramData\Cyvera\Everyone\CDSX\extension.xml`, and then click **Next**. f. In **Assignments**, select the target users or security groups, and then click **Next**. g. Review the settings, and then click **Review and create**. **4. Managed installation from the registry in Windows** a. Install/uninstall the extension using the following files: {% file src="/files/nyrZRmU5wj28n9oYeZzS" %} {% file src="/files/IYUFEdpumvQH1agZKdSa" %} b. Instead of step a, you can also add the following to the registry using `reg IMPORT `: ```` ```programlisting Windows Registry Editor Version 5.00 ; ===== Start CDSX Policy ; Chrome [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionSettings] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionSettings\aalncdhjokfcbldaemnehledpfpibopi] "installation_mode"="force_installed" "update_url"="file:///C:\\ProgramData\\Cyvera\\Everyone\\CDSX\\extension.xml" "toolbar_pin"="force_pinned" ; Edge [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionSettings] [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionSettings\aalncdhjokfcbldaemnehledpfpibopi] "installation_mode"="force_installed" "update_url"="file:///C:\\ProgramData\\Cyvera\\Everyone\\CDSX\\extension.xml" "toolbar_state"="force_shown" ; ===== End CDSX Policy ``` ````
macOS To enable the DLP browser extension on your endpoint, you must either create a configuration profile in JAMF or upload a predefined configuration profile in your MDM solution. The predefined signed configuration profile includes settings that cannot be modified. An unsigned version is also available for self-signing. {% hint style="info" %} ### Note For a comprehensive overview, refer to the Cortex XDR Agent iOS Guide. {% endhint %} The following steps describe how to create a new configuration profile in JAMF to enable the DLP browser extension on your endpoint: 1. From **Configuration Profiles**, click **New**. 2. In the **General** page, enter a name and description. 3. From the left pane, under the **Options** tab, select **Application & Custom Settings** and then click **Upload**. 4. Add the following configuration details for each web browser: * **Chrome**: * **Preference Domain**: com.google.Chrome * **Property List**: ```programlisting ExtensionSettings aalncdhjokfcbldaemnehledpfpibopi installation_mode force_installed toolbar_pin force_pinned update_url file:///Library/Application Support/PaloAltoNetworks/Traps/cdsx/extension.xml ``` * **Edge**: * **Preference Domain**: com.microsoft.Edge * **Property List**: ```programlisting ExtensionSettings aalncdhjokfcbldaemnehledpfpibopi installation_mode force_installed toolbar_state force_shown update_url file:///Library/Application Support/PaloAltoNetworks/Traps/cdsx/extension.xml ``` 5. Click **Save**.
### Create endpoint applications An effective data loss prevention (DLP) system allows an organization to define specific applications as sensitive. This enables the system to monitor and control the transmission of critical information, preventing its unauthorized release. When creating a data-in-motion rule, you can specify the source of the sensitive data, but you must provide the intended destination. For the source and destination for the data-in-motion rule, you must select the relevant application groups ( custom local application group). The application groups comprise of predefined endpoint applications as defined by Palo Alto (local application). Predefined applications are indicated by **Created by: Palo Alto Networks** in the **All Applications** table. For predefined applications, you do not see details such as **URLS/Domains**, **Process names**, **or signers**. You cannot edit or delete these applications. The user can only create a Custom Web Application. #### Endpoint application type: After creating the application, you can select them from the application groups. * **Predefined local applications**: The following apps and services are supported. * **FTP, SFTP and FTPS apps**: * FileZilla * OpenSSH * WinSCP * **SSH and RDP apps**: * PuTTY * **Custom Web application**: In DLP, a web application refers to any software accessed via a web browser (e.g., cloud services, webmail, social media). Web DLP focuses on inspecting and controlling sensitive data as it travels over these internet-based channels, preventing unauthorized sharing or exfiltration. Palo Alto Networks has its own predefined list of applications. The Palo Alto predefined web applications cannot be edited or removed.
New custom web application Add a custom web application that appears in the **Custom Web-Application Group** of the **Endpoint Application Groups**. You can select the source or destination when defining the data-in-motion rule. 1. Navigate to **Modules** → **Endpoint Data-in-Motion Rules** → **Endpoint Applications**. 2. Click **New Application** and select **Custom Web Application**. 3. In **New Custom Web Application**, enter the application name, enter the URLs or domain of the web application, and then click ![dlp\_enter\_icon.png](/files/TdwxfXcwFURi5xhxtWzl). A web application is added to the list. You can add other custom web applications. 4. After adding all the web applications, click **Add**. The web application is successfully added to the **All Applications** table as **Type: Web**. Example: * Web: custom URLs * Local application: pre-defined applications * Catalog: a special group that includes SAAS applications, categories * Catalog web application groups: a special group that allows you to choose SAAS applications from the PANs catalog and to use the predefined catalog
### Create endpoint application groups Data-in-motion rules require defining both a source and a destination, which can be specified using your predefined endpoint application groups. Choose the relevant application group type. * **Catalog Web Application Group**: The catalog includes SAAS applications from PAN's predefined catalog and predefined web application categories.

Note

The catalog lists all supported and tested applications. If an application you need is not on the list, contact support for assistance.

* **Custom Local Application Group**: Select the available options from the predefined local applications. For example: Unsanctioned chat apps. * **Custom Web Application Group**: Select the available options from the custom local applications. You can create a new web application. For example: AI chatbots. ### Create data-in-motion rules You can create data-in-motion policies to identify, control, and protect sensitive information as it moves across networks, between systems, or to devices. Each rule defines an action, **Allow**, **Block**, or **Report**, from a specified source to a web destination. Rule conditions must include the channel destination, [data profile](/data-security-documentation/data-security/data-classification/how-to-disable-and-enable-data-profiles-in-cortex-data-classification.md), and type of data being accessed or moved. You can also configure responsive user dialogs for enforced events, which can be customized per rule. To create a data-in-motion rule: 1. In **Modules** → **Data Security** → **Endpoint Data-in-Motion Rules** → **Data-in-Motion Rules,** click **Create New Rule**. 2. On the **General** page: 1. Enter a unique name and description. 2. Choose the **Action** to implement when the rule criteria are met, such as blocking the transfer or notifying relevant parties. 3. Select the **Action for Partial Classification** to implement when partial classification occurs. Partial classification refers to a situation in which the classification process is incomplete, such as due to a timeout or a classification failure. 4. Select the **Severity** of the rule you are creating. The **Informational** action enables logging an activity without interfering with the user’s workflow. 5. Enter a **Raised Issue Name** to use for the issue resulting from policy breaches. 6. Select to **Disable/Enable Rule** as required. 3. On the **Context & Data** page: 1. For **Source**, select the Custom Web Application Groups. The source is the origin of the data, whether it resides on a local drive (such as a PDF on a laptop) or within a web application (such as a file in OneDrive). Without a defined source, this rule applies to every file by default. You can make the policy more targeted by selecting a specific source.

Note

Third-party application behaviour:

2. For **Destination**, select the relevant Application Groups. See the earlier instructions for creating endpoint application groups. Selecting **Allow corporate accounts users to upload** lets corporate account users bypass the **Block** rule action and upload data from the web application. **USB Channel**: Select **File Write/Copy to USB** to enforce the rule on the USB device. 3. For **Data Scope**, select the relevant [Data Profile](/data-security-documentation/data-security/data-classification/how-to-disable-and-enable-data-profiles-in-cortex-data-classification.md).

Note

To maximize data security, if you use Microsoft Purview for extensive manual and automated file classification tagging and are looking to integrate those labels directly with the DLP policies to trigger protective actions based on a file's sensitivity, refer to How to use information protection labels in Cortex Cloud Data Security.

4. On the **Target** page: * For **Rule Target**, select the endpoints to which this rule will apply.

Note

Distribution of the Endpoint DLP package is restricted to agents assigned to the data-in-motion policy. This ensures that only endpoints requiring DLP functionality are affected, rather than all eligible endpoints in the tenant.

5. On the **User Interaction** page, you can add the default pop-up message for each of the following events. 1. For **End User Dialog**, toggle **ON/OFF** to manage whether users see a message when the policy is violated. 2. In the **Title**, enter the default name for the dialog. 3. In the **Body**, enter the message to display in the dialog. You can choose to use the system's default text. This is also relevant for **Reporting Mismatch** and **Rule Override**. If enabled, the **Rule Override** allows the user to override the block policy and temporarily retry the operation (to move the file again) to complete the action. The user's response is recorded as part of the **Issue**. 4. In the **Admin Email Link**, enter the default admin email to be included in the body. 5. In the **Dialog Main Button Label**, enter the text to use for the button to close the window. 6. Click **Next** to create the rule. 7. From the **Data-In-Motion Rules** table, click **Save** or move the rule down to change its priority, then click **Save**. #### Rule priority Cortex processes these rules sequentially from top to bottom. To ensure the correct outcome, place **Allow** rules above **Block** rules. As soon as a first match is found for a data movement event, that rule's action is applied, and no other rules are evaluated for that specific event. Each matched event creates an **Issue**, and the total number of issues appears as **Hits** in the rules table. Modify rule priority by dragging rules. If a conflict arises while setting a rule's priority, for example, if another user updates the policy simultaneously, Cortex saves the rule as a draft to prevent loss of your work. #### Example: Creating a data-in-motion rule An employee at Company X sends an attachment containing financial information to another employee's personal email address. This action violates the company’s data handling policy. To help prevent this, you can create a data-in-motion rule with the following configuration: | Field | Description | Example user input | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------- | | **Rule Name** | Provide a descriptive name for easy referencing. | Prevent Financial Data Transfer | | **Action** | Specifies how data movement is controlled. Possible actions are: Block, Allow, or Report. | Block | | **Partial Classification** | Select a fallback action if classification fails or exceeds a time threshold. | Block | | **Severity** | Choose the severity level that the Issue will trigger. Possible options are: Critical, High, Medium, Low, Informational. | High | | **Raised Issue Name** | The name appears on the Issues page when filtering for Endpoint DLP Issues. | Blocked Financial File Transfer | | **Source** | The web application group the data transfer originates from. You can create and manage these custom groups to suit your preferences. | drive.google | | **Destination** | Choose where the data is moving to. Possible options are: None, Any, Specific web application group. | Web Application Group | | **Local Application Groups** | Select apps through which users might transfer sensitive data. | Zoom, Slack, TeamViewer, and WhatsApp. | | **Data Profile** |

Data Profiles are templates that define what kind of sensitive data to detect. Select the data profile to which the rule applies.

For more information, see How to create and validate a custom data profile.

| PHI, CCN (Credit Card Numbers), Financial, and PII. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp/configure-dlp-end-to-end.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.