Zscaler - Endpoint DLP

Endpoint DLP in ZIA

Every Data Loss Prevention program eventually runs into the same gap: policies built to inspect traffic as it crosses the network perimeter have nothing to say about a file that never touches the network at all. A user who copies a spreadsheet of customer records onto a USB drive, prints it, or drags it into a personal Dropbox folder can move sensitive data out the door without generating a single packet for ZIA to inspect. Zscaler's Endpoint DLP closes that gap by pushing DLP enforcement out to the device itself — the laptop or mobile endpoint — rather than relying solely on inspection at the network edge.

This matters more today than it did a few years ago, because the modern workforce is decentralized. Employees work from home, from coffee shops, and from branch offices that may never route through a corporate gateway. Endpoint DLP extends the same content-inspection logic used elsewhere in the Zscaler platform — the DLP engines and dictionaries covered in the companion DLP article — to the actions users take locally on their machines. The result is a single, consistent DLP policy model that follows the user and the data wherever they go, instead of stopping at the edge of the network.

Resource Channels

Where a network-based DLP rule is built around traffic (web uploads, email, SaaS apps), an Endpoint DLP rule is built around resource channels: the specific local pathways a user could use to move a file off the device. Zscaler defines four resource channels:

• Printing – sending a document to a physical or virtual printer
• Removable Storage – copying files to USB drives and other external media
• Network Share – writing files to shared drives on the local network
• Personal Cloud Storage – uploading files to consumer cloud storage services from the endpoint

A resource channel doesn't carry any inspection logic on its own — it simply defines which local action the rule is watching. The actual decision about whether that action should be allowed still comes from the criteria and the DLP engine attached to the rule, exactly as it does for network DLP.

Building an Endpoint DLP Rule

Endpoint DLP rules live under Data Security > Endpoint DLP Web, reached from the hamburger menu in the Zscaler console (console.zscaler.com, signed into through the Zscaler Authentication Service). That page lists every Endpoint DLP rule along with its rule order, its resource channel, its criteria, its action, and its severity — and each rule can be expanded to review any exceptions configured against it.

Building a rule follows a familiar pattern for anyone who has already worked with ZIA's network DLP policy:

• Rule Order and Rule Name – as with any ZIA policy, rules are evaluated top to bottom, so placement matters and the name should describe the rule's intent.
• Resource Channel – the local action the rule applies to: Printing, Removable Storage, Network Share, or Personal Cloud Storage.
• Criteria – what triggers the rule. This can be a DLP Engine (the same content-matching engines and dictionaries used in network DLP), a Device Group, a Department, or a combination of these.
• Action – what happens when the criteria match: Allow, Block, or Confirm (which prompts the user to justify or cancel the action).
• Severity – how the resulting incident is prioritized for review: High, Medium, Low, or Information.

Because the criteria can combine a content-matching DLP engine with contextual signals like device group or department, Endpoint DLP rules can be scoped tightly — for example, applying a stricter action only to a specific department's devices — without having to write a separate content engine for each scenario.

Example: ALL_Network_Share

The ALL_Network_Share rule illustrates how these pieces come together. Its criteria reference the "5 or more Credit Card Numbers" DLP engine — the same engine an administrator would already be using in network DLP policy to flag documents containing bulk payment card data. Its resource channel is Network Share, and its action is Block.

Put together, this rule says: if a user on a managed endpoint attempts to write a file containing five or more credit card numbers to a network share, stop the transfer. The employee doesn't need to be uploading to a website or sending an email for the policy to catch the exfiltration attempt — dragging the file onto a shared drive is enough to trigger inspection and enforcement, because the check happens at the endpoint rather than waiting for the traffic to reach the network.

This is the core value of Endpoint DLP: it takes DLP engines administrators already understand and applies them to actions that DLP appliances and cloud proxies can never fully see. Combined with network DLP, Cloud App Control, and Cloud Browser Isolation, it rounds out a data protection strategy that follows sensitive information across every channel a user might use to move it — on the network and off it.