implementing-endpoint-dlp-controls

name	implementing-endpoint-dlp-controls
description	Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.
domain	cybersecurity
tags	["endpoint","DLP","data-loss-prevention","data-protection","content-inspection"]
subdomain	endpoint-security
version	1.0.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0024","AML.T0056"]
nist_ai_rmf	["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MAP-5.1","MANAGE-2.4"]
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Implementing Endpoint Dlp Controls

Overview

Cybersecurity skill for implementing endpoint dlp controls. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing endpoint dlp controls"
• "Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving th"
• "Configuring content inspection rules for email attachments, USB transfers, and c"
• "Implementing Microsoft Purview DLP or Symantec DLP endpoint policies"

Use this skill when:

• Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization
• Configuring content inspection rules for email attachments, USB transfers, and cloud uploads
• Implementing Microsoft Purview DLP or Symantec DLP endpoint policies
• Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)

Do not use for network DLP (inline proxy-based) or cloud-only DLP (CASB).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Microsoft 365 E5 or standalone Microsoft Purview DLP license
• Microsoft Purview compliance portal access (compliance.microsoft.com)
• Sensitive Information Types (SITs) defined for organization data
• Endpoint onboarded to Microsoft Purview (via Intune or SCCM)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}