> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md). # Cortex Data Loss Prevention (DLP) module overview {% hint style="warning" %} ### Prerequisite * Endpoint DLP add-on license * Cortex agent 9.1 and above for Windows and macOS {% endhint %} The Cortex Data Loss Prevention (DLP) module provides a unified, flexible solution for preventing the exfiltration of sensitive data. It continuously enforces policies on endpoints (even offline) across web, local, and USB channels, protecting both on-premises and cloud environments. After endpoint DLP is enabled, the DLP module is downloaded to all eligible endpoints. This highlights Cortex's benefit of proactively safeguarding sensitive information. Future enhancements will include data-at-rest discovery, adaptive policies, and broader channel support.
Supported platforms and browsers * Supported platforms: * Windows: x64 (ARM CPU architecture not supported) * macOS * Supported browsers for the Cortex data security extension: Google Chrome and Microsoft Edge (Chrome Enterprise is not supported in MDM mode) * Either the endpoint must be joined to a domain, or the browser must be managed.
Supported file types and extensions **Windows/macOS supported file types and extensions** | Category/application | Supported formats and extensions | | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | Microsoft Office | doc, docx, dotx, ppsx, potx, ppt, pptx, xls, xlsx, xsltx | | Microsoft Visio | vsd, vsdm, vsdx | | iWork | key, numbers, pages | | Standard documents | csv, pdf, rtf, txt, xps, oxps | | Image files and storage | bmp, jpeg, jpg, png, tif, tiff | | Source code/development (C-family) | c, cpp, cxx, c++, h, hpp, cs, m | | Source code/development (scripting and programming) | cgi, jav, java, js, pl, ps1, py, r, rb, vbs | | Source code/development (hardware and assembly) | asm, s, v, verilog, vh, vhd1, vlg | | Archived and compressed files (supported from 9.3) |

zip, 7z, rar, tar, gz, tar.bz2, tbz2, tar.bz, tbz, tar.xz, txz, tar.zst, tzst

\*tgz - will not be supported in 9.3

|
Agent limitations * Supported platforms: Windows and macOS * Minimum agent version: 9.1.0 * USB channel on Windows: * Before Windows 11 version 22H2, tracking is limited to files transferred to USB drives via File Explorer. * Archive file support: The system can scan up to 50 levels of nested archives. Content beyond this limit is not classified. * Supported file size: up to 300 MB (Cortex agent 9.3 and later). * Handwritten text: Detection of handwritten text is currently not supported. * Local applications: * On Windows, we only support WebView2-based applications such as WhatsApp, Microsoft Teams, and Zoom starting from agent version 9.2.0.
Use cases * Protecting personal information: Protects information like names, addresses, and credit card numbers to adhere to privacy policies (like GDPR or HIPAA). * Guarding company secrets: Prevents valuable designs, formulas, and business plans from falling into the wrong hands (like competitors). * Meeting legal rules: Helps businesses in specific industries (like healthcare or finance) follow strict laws about handling data. * Stopping leaks (accidental or intentional): Catches employees trying to email sensitive files to their accounts or upload them to unauthorized websites. It also helps prevent cybercriminals from stealing data. * Seeing and controlling data: Helps you locate all your important data and allows you to determine who can access it and how it can be utilized.
User roles and permissions Cortex DLP now includes two new out-of-the-box roles: * Data security admin: Defines the policy and its key components, including applications. * Data security viewer: Reviews and analyzes DLP-related issues. Refer to the [Personas workflow for DLP](/cortex-xsiam/protect-your-endpoints/endpoint-dlp/personas-workflow-for-dlp.md) for steps on how to create and manage endpoint DLP in your environment. Verify that the user has the correct permissions in the linked role for access and configuration permissions to DLP capabilities. 1. Go to **Settings** → **Configuration** → **Access Management** → **Roles**. 2. Go to the relevant role, right-click and select **Edit Role**, and in the **Components** tab, verify under **Data Security** that the settings are configured to **View/Edit**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.