Configure Sophos Endpoint Data Loss Prevention
Endpoint Data Loss Prevention controls whether users may transfer sensitive content or specific files to defined destinations. It has three levels: Content Control Lists describe sensitive data, DLP rules connect conditions with destinations and actions, and the Data Loss Prevention policy assigns these rules to endpoints.
This Endpoint feature is not the same as Sophos Email Data Control policies. Terms and reports must not be mixed between the products.
Content rule or file rule
A Content Rule uses one or more Content Control Lists to find data such as credit-card numbers, personal data or custom term patterns. A File Rule decides by file name or type, for example to block databases on removable media.
A rule applies when all its conditions are met. If several rules with different actions match one file, Sophos enforces the strictest: Block takes priority over user confirmation, and user confirmation over Allow.
| Action | Suitable rollout phase |
|---|---|
| Allow file transfer | visibility and Event baseline |
| Allow transfer if user confirms | controlled user decision |
| Block transfer | clear, tested prohibitions |
A rule can optionally send an email after a violation. This does not also appear as a Central Alert, so the DLP Event Log remains important in operation.
Content Control Lists
SophosLabs provides maintained CCLs for common financial and personal data. They can be filtered but not edited. Custom CCLs use terms, an exact phrase or an Advanced Expression.
Advanced Expressions use Perl 5 regular expressions. Trigger Score, Score and Max Count determine when a match counts. Sophos Support does not create or debug custom regex rules and refers customers to Professional Services. Always test a custom regex with real positive and negative examples.
For content rules, Match Count specifies how often a CCL must occur in a file. Too low increases false positives; too high misses small datasets. Sophos also marks obsolete CCLs as Deprecated. Existing policies continue to work, but migrate the definition to a current alternative.
Destinations and exceptions
The rule specifies monitored transfer destinations. File names or types can also be excluded from that specific rule. This DLP exception is not a general malware exclusion and must not be documented as one.
For Microsoft Office files, Sophos also examines many metadata areas including titles, comments, tags, headers, footers and embedded Excel charts. Signature data is not checked. Test data must therefore use the same document type and transfer route as the later business process.
Technical limits of transfer routes
Endpoint DLP is not a transparent scanner for every possible file operation. Files smaller than eight bytes are not inspected. After adding a storage destination to a rule, Windows requires the user to sign out and back in before that route is monitored reliably.
For removable media, Data Control expects a copy operation through Windows Explorer. Creating a file directly on the medium or using Save as from an application can therefore be blocked with File transfer method not supported, regardless of the rule content. Save locally first and then copy the file to the medium with Windows Explorer.
Email and browser routes also vary by client and version. A normal Outlook attachment may be detected while drag-and-drop into the message body uses another temporary path. Web uploads, webmail, SharePoint, instant messaging, and copy-and-paste are not covered by one generic test. Test every approved application with its actual transfer route.
⚠️ A missing Event on a technically unmonitored route does not prove that the transfer was allowed after evaluation. First verify that Endpoint DLP supports the client, action, and destination.
Create the policy
First create CCLs and rules under Global Settings > Protection & Remediation > Data Loss Prevention. Then create a Data Loss Prevention policy under My Products > Endpoint > Policies, assign it to pilot devices and enable it.
All rules are evaluated in sequence. Many complex content rules and large files increase inspection effort. The pilot therefore measures not only match quality but also copy time and user experience with typical file sizes.
User messages for confirmation or blocking are limited to 100 characters. They must still state the purpose and next step clearly, such as the team responsible for a justified exception.
DLP Event Log
Under Reports > Endpoint & Server Protection Logs > Data Loss Prevention, Sophos shows user, device, rule, action, file and destination. The period extends to 90 days. An export contains at most 5,000 Events per file.
An endpoint can send a maximum of 50 Data Control Events per hour to Sophos Central. Further Events remain logged locally. During a mass event, a flattening Central curve does not automatically mean the activity has ended.
Rollout strategy
A new DLP rule begins with a small pilot group and the mildest acceptable action. Assess matches together with data protection, business owners and the helpdesk. Only after legitimate transfers, technical accounts, archives and large files are covered should user confirmation or blocking follow.
Do not accept a policy solely on an artificial pattern. Test at least one real allowed and one prohibited business case per destination. Then check Event, user message and email notification separately.
Troubleshooting
For missing matches, check effective policy, destination type, file type, full file name and CCL Match Count. For many false positives, refine the CCL or adjust Match Count first. A blanket file exception removes too much control.
If a transfer appears possible despite Block, verify that the stricter rule actually applied and that the tested route is among the monitored destinations. An entry in the Email Data Control report does not prove the Endpoint DLP policy.
If modern Outlook still shows an attachment to the recipient although Sophos blocked it, do not judge from the Outlook display alone. Some Outlook versions create an attachment header even though the actual Base64 attachment data is empty. The Sophos Event, message size, and a controlled open attempt show whether data was transferred.
Several DLP or Endpoint Security products on one device can instrument the same processes and file operations. Typical effects are blanket-blocked transfers, faulty Outlook actions, or missing Events in the third-party system. Record product versions and loaded modules, then investigate the conflict using vendor-specific exclusions. Do not apply Registry workarounds from a product-specific support article to another DLP product without validation.
On Windows devices that are neither domain joined nor managed through Entra ID, Microsoft Edge version 129 and later can enumerate desktop files on its own. This can generate DLP prompts and Events about a minute after Edge starts although no visible upload occurred. A desktop or browser exclusion removes the effect but substantially reduces DLP coverage. Confirm the process, join state, and actual transfer attempt before creating one.
Related articles
Introduce Sophos Endpoint Control policies in practice explains the common rollout model. Build Sophos Central Endpoint policies correctly covers targets and ordering.