Product guide

DLP

Control sensitive data leaving through USB, web, email, clipboard, screenshot, and printing channels.

DLP Overview#

Data Loss Prevention watches the places where data actually leaves an endpoint. Instead of inspecting only network traffic, it works on the device, where the user action happens and where the content is still readable.

A DLP policy combines three things: what to look for, where to look for it, and what to do when it matches. The platform keeps those three separate so you can change one without rebuilding the others.

Moftgate DLP policies screen — DLP policies, protected channels, and rule distribution view.

Protected Channels#

DLP protects six channel groups. You enable the ones your policy needs:

Channel	What it controls
USB and removable media	Controls file copy to and from removable storage, with device-level allow and block lists.
Web and cloud upload	Inspects uploads and web form submissions so sensitive content does not leave through a browser.
Email	Checks outgoing mail and attachments before they are sent.
Clipboard	Prevents sensitive content from being copied out of a protected application.
Screenshot and screen capture	Records or blocks screen capture attempts on protected content.
Printing	Controls printing of documents that match a classification rule.

Enable only what you need

Each enabled channel adds inspection work on the endpoint. Enable the channels the policy actually requires so the agent stays within its resource budget.

Policies#

A policy is built from four parts. Configure them in this order:

Matching rules - the classification and pattern rules that decide whether content is sensitive.
Target scope - group, profile, tag, or individual endpoint selection.
Channels - which of the six channel groups this policy inspects.
Action and user message - audit or block, and the message the user sees when a match occurs.

Test on a pilot scope first

Policies that block without a pilot phase generate false positives that users cannot work around. Audit first, review the incidents, then enforce.

Enforcement Workflow#

1
Define sensitive content
Set the data classifications and matching rules that decide what counts as sensitive. Start from the built-in patterns and refine them.
2
Choose scope and channels
Apply the policy to a group, profile, tag, or individual endpoint, and enable only the channels you want to protect.
3
Pilot the policy
Run the policy on a narrow pilot scope first. Review incidents and false positives before you widen the target.
4
Enforce and communicate
Switch the action from audit to block, and tell users what will happen and how to request an exception.
5
Review incidents
Investigate matched incidents, record the outcome, and use exceptions or scope changes to handle legitimate workflows.

Frequently Asked Questions#

What appears in a DLP incident?

The incident view shows the matched rule, endpoint, user, channel, time, and the available evidence. Use it to decide whether the match is a real risk or a false positive.

Can I apply a policy only to selected devices?

Yes. The target scope can be a group, a profile, a tag, or an individual endpoint.

Does DLP block or only record?

Each policy has its own action. You can audit first and switch to blocking later, which is the recommended order for a new policy.