{"pageModel":{"attributes":{"id":"","name":"118847.dita","viewName":"DitaDetail"},"elements":{"ditaContent":{"name":"DITAContent","value":"
\r\n

Manage the Data Loss Prevention Policy

\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n
 		\r\n
\r\n

\r\nSecure Access Packages and Feature Availability\r\n

\r\n

Not all of the features described here are available to all Secure Access packages. Information about your current package is listed on the Admin > Licensing page. For more information, see Determine Current Package. If you encounter a feature here that you do not have access to, contact your sales representative for more information about your current package. For more information, click Cisco Secure Access Packages.

\r\n
\r\n
\r\n

The Data Loss Prevention (DLP) policy helps protect sensitive data uploaded to the web or\r\n transferred to external devices like a USB storage device, a Bluetooth device, a network\r\n share, or when a file is printed to a local or a network printer. It discovers and protects\r\n sensitive data stored and shared in your cloud-sanctioned applications.

\r\n

You can configure the DLP policy with multiple DLP rules. Real Time DLP rules inspect\r\n web traffic passing through the proxy or files transferred to external devices like a USB\r\n storage device, a Bluetooth device, a network share, or when a file is printed to a local or a\r\n network printer. SaaS API-based rules ensure data protection of data in the cloud.\r\n AI Guardrails rules ensure data protection in prompts and responses exchanged with AI\r\n applications. Furthermore, DLP Administrators can initiate on-demand Discovery Scans to learn\r\n about all the files in the applicable cloud applications that contain matches with the\r\n selected Data Classifications. Email DLP rules provide DLP functionality to enhance\r\n protection provided to outgoing emails by Cisco's Secure Email Threat Defense.

\r\n\r\n

Data violations detected through DLP rules are logged as part of the unified Events view of the Data Loss Prevention Report.

\r\n

\r\n Discovery Scans\r\n operate similarly to the SaaS API rules; they exercise the necessary cloud APIs to determine the files in the applicable cloud tenant that contain data matching any of the configured Data Classifications at the time the scan runs. Files containing matching data are considered to be in violation of the Discovery Scan.

\r\n

The Discovery tab in the Data Loss Prevention Report lists the files in violation of the most recently initiated Discovery Scan. Additionally, DLP Administrators can quickly retrieve the reported offending files from any of the last 10 generated Discovery Scans.

\r\n

Realtime DLP rules support scanning traffic isolated by the RBI (Remote Browser Isolation) in the outbound direction, in addition to scanning non-isolated HTTPs traffic. When the system detects a DLP violation in RBI traffic, a pop-up dialog appears in the user's browser indicating the content has been blocked due to a potential data security violation.

\r\n

Real Time rules, SaaS API rules, AI Guardrails rules, Email rules, and Discovery Scans all\r\n support scanning embedded files.

\r\n

\r\nLimitations\r\n

\r\n
    \r\n
  1. The rate limit is dependent on vendor SLA, which is usually up to 10 RPS for Microsoft 365\r\n and up to 20 RPS for Google Drive.
      \r\n
    • \r\n

      The Discovery Scan can scan up to 36,000 files per hour and 864,000 files per day\r\n with an average file size of 1MB.

      \r\n
      • \r\n
    • \r\n

      The incremental scan and Discovery Scan share the same rate limits, therefore, file\r\n changes (i.e. incremental) during the Discovery Scan are counted and have an effect on\r\n the Discovery Scan throughput.

      \r\n
      • \r\n
    • \r\n

      An org that triggers more than 864k events per day will be at risk of not having all\r\n their events scanned.

      \r\n
      • \r\n
    \r\n
    2. \r\n
  2. Triggering a Discovery Scan should take place around 24 hours after the tenant\r\n authorization, as the system needs time to evaluate and enumerate the users in the\r\n organization. Any triggering beforehand might not include all users and hence, the system is\r\n unable to scan all files.
    3. \r\n
  3. The DLP scans the plain text of files up to 50 MB.
    4. \r\n
  4. DLP scans archives as well as files containing embedded files. For these, DLP can extract\r\n and scan content for up to 100 files nested up to 10 levels deep.
    5. \r\n
  5. Revoke share for internal or external works only for organizations with one domain in\r\n Google Drive due to Google API limitation.
    6. \r\n
\r\n
\r\n
\r\n","ditaVal":"","format":"html"},"bookTitle":{"value":""},"shortDescription":{"value":""}}},"parameters":{"appId":"SecureAccess","topicAlias":"manage-data-protection-policies"}}