What it does. 'Implements endpoint Data Loss Prevention (DLP) controls to detect and Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-endpoint-dlp-controls, or copy the skill folder into ~/.claude/skills/implementing-endpoint-dlp-controls/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-dlp-controls/SKILL.md

SKILL.md (verbatim)

name: implementing-endpoint-dlp-controls
description: 'Implements endpoint Data Loss Prevention (DLP) controls to detect and
  prevent sensitive data exfiltration through email, USB, cloud storage, and printing.
  Use when deploying DLP agents, creating content inspection policies, or preventing
  unauthorized data movement from endpoints. Activates for requests involving DLP,
  data exfiltration prevention, content inspection, or sensitive data protection on
  endpoints.

  '
domain: cybersecurity
subdomain: endpoint-security
tags:
- endpoint
- DLP
- data-loss-prevention
- data-protection
- content-inspection
version: 1.0.0
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0024
- AML.T0056
nist_ai_rmf:
- GOVERN-1.1
- MEASURE-2.7
- MANAGE-3.1
- MAP-5.1
- MANAGE-2.4
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
mitre_attack:
- T1055
- T1547
- T1059
- T1036
- T1048

Implementing Endpoint DLP Controls

When to Use

Use this skill when:

• Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization
• Configuring content inspection rules for email attachments, USB transfers, and cloud uploads
• Implementing Microsoft Purview DLP or Symantec DLP endpoint policies
• Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)

Do not use for network DLP (inline proxy-based) or cloud-only DLP (CASB).

Prerequisites

• Microsoft 365 E5 or standalone Microsoft Purview DLP license
• Microsoft Purview compliance portal access (compliance.microsoft.com)
• Sensitive Information Types (SITs) defined for organization data
• Endpoint onboarded to Microsoft Purview (via Intune or SCCM)

Workflow

Step 1: Define Sensitive Information Types

Microsoft Purview → Data Classification → Sensitive info types

Built-in SITs for common data:
- Credit card number (PCI)
- Social Security Number (PII)
- Health records (HIPAA)
- Passport number
- Bank account number

Custom SIT example (Employee ID):
  Pattern: EMP-[0-9]{6}
  Confidence: High
  Keywords: "employee id", "emp id", "staff number"

Step 2: Create DLP Policy

Microsoft Purview → Data loss prevention → Policies → Create policy

Policy Configuration:
1. Template: Financial / Medical / PII (or custom)
2. Locations: Devices (endpoint DLP)
3. Conditions:
   - Content contains: Credit card numbers (min 5 instances)
   - OR Content contains: SSN (min 1 instance)
4. Actions:
   - Block: Prevent copy to USB, cloud, email
   - Audit: Log but allow (for initial deployment)
   - Notify: Show user notification with policy tip
5. User notifications:
   - "This file contains sensitive data and cannot be copied to this location"
   - Allow override with business justification (optional)

Step 3: Configure Endpoint DLP Activities

Monitored endpoint activities:
- Upload to cloud service (OneDrive, Dropbox, Google Drive)
- Copy to removable media (USB drives)
- Copy to network share
- Print document
- Copy to clipboard
- Access by unallowed browser (non-managed browser)
- Access by unallowed app
- Copy to Remote Desktop session

For each activity, configure:
- Audit only (log the action)
- Block with override (user can justify and proceed)
- Block (prevent action entirely)

Step 4: Deploy in Audit Mode

Deploy DLP policy in "Test mode with notifications" first:
1. Policy runs in audit mode for 2-4 weeks
2. Review DLP alerts in Activity Explorer
3. Identify false positives
4. Tune SIT patterns and conditions
5. Add exclusions for legitimate workflows
6. Switch to "Turn on the policy" (enforcement)

Step 5: Monitor and Respond

Purview → Data loss prevention → Activity explorer

Key metrics:
- DLP policy matches per day/week
- Top matched sensitive info types
- Top users triggering DLP
- Top activities blocked (USB, cloud, email)
- Override rate (percentage of blocks overridden)

DLP incident response:
1. Review DLP alert with matched content
2. Verify sensitivity of detected data
3. Assess intent (accidental vs. intentional)
4. If intentional exfiltration → escalate to security incident
5. If accidental → educate user, refine policy

Key Concepts

Tools & Systems

• Microsoft Purview DLP: Cloud-managed endpoint DLP included in M365 E5
• Symantec DLP (Broadcom): Enterprise DLP with endpoint, network, and cloud modules
• Digital Guardian: Endpoint DLP with data classification and protection
• Forcepoint DLP: Unified DLP platform with endpoint agent
• Code42 Incydr: Insider risk detection with file exfiltration monitoring

Common Pitfalls

• Over-blocking in enforcement mode: Deploy DLP in audit mode first. Blocking common workflows without warning causes productivity loss.
• Too many SIT false positives: Phone numbers, dates, and random number sequences can match PCI/SSN patterns. Tune confidence levels and require corroborating keywords.
• Ignoring user education: DLP is most effective when users understand why data is protected. Policy tips should explain the restriction and provide approved alternatives.
• Not monitoring overrides: If users frequently override DLP blocks, the policy is either too restrictive or users are ignoring data protection requirements. Review override reasons.

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Endpoint DLP Template

Policy Summary

Monitoring Metrics

Sign-Off

references/api-reference.md (verbatim)

API Reference: Implementing Endpoint DLP Controls

Sensitive Data Patterns

DLP Channels

Microsoft Purview DLP API

import requests
headers = {"Authorization": "Bearer <token>"}
resp = requests.get(
    "https://graph.microsoft.com/v1.0/security/alerts_v2",
    headers=headers,
    params={"$filter": "category eq 'DataLossPrevention'"})

CrowdStrike Falcon DLP

curl -X GET "https://api.crowdstrike.com/dlp/entities/policies/v1" \
  -H "Authorization: Bearer $TOKEN"

File Scanning

from pathlib import Path
import re
SENSITIVE_EXTS = {".pem", ".key", ".env", ".kdbx", ".pfx"}
for f in Path("/data").rglob("*"):
    if f.suffix in SENSITIVE_EXTS or re.search(r"AKIA", f.read_text()):
        print(f"ALERT: {f}")

References

• Microsoft Purview DLP: https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
• CrowdStrike Falcon DLP: https://www.crowdstrike.com/platform/data-protection/

references/standards.md (verbatim)

Standards & References

• NIST SP 800-53 SC-7: Boundary Protection - DLP enforces data boundaries
• PCI DSS 4.0 Req 3: Protect stored account data
• GDPR Article 32: Security of processing - preventing unauthorized data transfer
• HIPAA 164.312(e)(1): Transmission security for ePHI
• Microsoft Purview DLP: https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp

references/workflows.md (verbatim)

Workflows

DLP Deployment

[Identify sensitive data types] → [Create SITs and policies]
  → [Deploy in audit mode] → [Review Activity Explorer for 2-4 weeks]
  → [Tune rules and exclusions] → [Enable enforcement]
  → [Monitor alerts and override rates] → [Quarterly policy review]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.