T Techclick ← All lessons
Zscaler · ZIA · Interactive lesson

ZIA DLP + CASB — see the file before it leaves

Finance PAN is blocked, marketing PDF is not. That is engines plus inspect, not a broken product.

18 min read · L2 primary · Quiz at end

⚡ Quick Answer

Inline DLP needs Decrypt. Engines, 400 MB limit, Incident Receiver, CASB vs endpoint. Scored quiz.

After this page you can

The ticket

Aditya at Apex Freight finance: “I uploaded a spreadsheet with PAN numbers to a personal drive and Zscaler blocked it. Marketing uploaded a brochure PDF and it went through. Is DLP broken?” No. DLP matched identifiers on one file and not the other.

Hero · data leaving the laptop
Documents and card data passing a glass scanner
Inline DLP is the web path. CASB is the SaaS-at-rest path. Endpoint DLP is the laptop path. Do not mix the three on the first sentence of the ticket.
Quick answer

Inline DLP reads the body after SSL inspect. Engines (dictionaries like PAN, Aadhaar, source code) match, then the rule Allow/Block/Notify. CASB is API to the SaaS tenant. If inspect is off, inline DLP is blind on HTTPS.

Mental model — three DLP desks

  1. Inline web DLP — ZIA proxy, Policy → Data Loss Prevention. Needs Decrypt for HTTPS payload.
  2. CASB / data-at-rest — SaaS API scan (files already in the tenant). Not the same click path.
  3. Endpoint DLP — Client Connector policy for USB/print/local. Deployed with ZCC.
Flow 1 · inline DLP
User uploadHTTPS fileSSL inspectmust DecryptDLP engines≤4 per ruleActionblock / notify / ICAP

Engines support files up to 400 MB and scan the first 100 MB of extracted text. Source: Configuring DLP Policy Rules with Content Inspection.

Say this out loud

Dictionary finds the secret. Engine groups dictionaries. Rule decides block or monitor. Inspect must be on or I am guessing.

Hard words: Dictionary is the pattern (PAN, Aadhaar, HIPAA). Engine combines dictionaries. Incident Receiver is the ICAP VM that stores the violating file + JSON metadata.

How to choose inline vs CASB vs endpoint

Journey · upload → engine → action
Pipeline of a file through cloud inspection
Inline catches the upload. CASB catches the file that is already in OneDrive. Endpoint catches the USB copy.
PathUse whenTrap
Inline web DLPBrowser / ZCC upload right nowHTTPS not decrypted
CASB DLPFile already in M365 / GDrive / BoxTreating it as a substitute for inspect
Endpoint DLPUSB, print, local sharePolicy created in ZIA but ZCC profile not deployed
Incident ReceiverNeed the actual violating fileNotify-only with no receiver — auditor sees a mail, no sample

Source: About Data Loss Prevention and About Zscaler Incident Receiver.

Decision · which DLP desk
Where is the file? Inline now CASB at rest

Browser upload = inline (needs Decrypt). Already in the tenant = CASB. USB = Endpoint DLP.

Runbook — Side A / B / C

Side A · inspect + identity

  1. Decrypt the DLP group

    If finance uploads over HTTPS, the SSL inspect rule for that group must be Decrypt. Otherwise the DLP rule never sees PAN numbers.

  2. User context

    DLP rules can key off users/groups. SCIM must place Aditya in grp-finance or the rule will miss him.

Side B · ZIA DLP policy

  1. Engine

    Administration → DLP Dictionaries & Engines (or Policy resources). Confirm PAN / Aadhaar dictionaries are in the engine you will attach.

  2. Rule

    Policy → Data Loss Prevention → Add rule. Content Matching = Select DLP Engines. Pick up to 4 engines (or Any). Action = Block + notify auditor for finance; Monitor for a week if this is the first pilot.

admin.zscaler.net · Policy → Data Loss Prevention → Add DLP Rule
Training mock · not live

Policy / Data Loss Prevention / Add DLP Rule

Add DLP Rule with Content Inspection

Finance-PAN-Block
grp-finance
Engine-IN-PII (1 of 4)
Block + Notify auditor

Help: content-inspection rules support Any or up to 4 engines. Files up to 400 MB; first 100 MB of extracted text. Training mock · not live.

Side C · prove

  1. Pilot file

    From a finance laptop, upload a lab file with synthetic PAN (never real customer data). Expect Block + EUN.

  2. Insights

    Analytics → Web Insights / DLP. Quote user, engine, dictionary, action. If CASB, use the SaaS DLP incident, not Web Insights.

Runtime path after go-live

Ops · incident desk
Operator reviewing DLP incident tiles
Notify without a sample is weak. Attach Incident Receiver when the DLP team must keep the file.

Optional: add Zscaler Incident Receiver on the rule. Zscaler sends the violating content plus JSON (URL, collaborators, dictionaries, engines) over ICAP. Host the VM in AWS, Azure, or on-prem. Source: About Zscaler Incident Receiver.

Traps and proof

SymptomFirst checkDo not
No DLP hit on HTTPSSSL inspect actionAdd engines blindly
Hit in SaaS but not in browserYou are looking at CASB, not inlineRewrite inline rules for API events
False positive on a brochureDictionary confidence / proximity; file actually has identifiers?Turn the engine off for the org
Endpoint USB copy still worksZCC Endpoint DLP profile deployed?Assume inline covers USB
Pilot checklist
Unsafe path

Uploading real customer PAN “to test DLP.” Use synthetic identifiers. Real data in a ticket is an incident of its own.

← SSL inspect · Path hub

Knowledge check

Six DLP tickets. Pick the first safe move.

Q1

Priya’s HTTPS upload is not inspected by DLP. First question?

Correct: b. Inline web DLP needs the payload. Do Not Decrypt = engines never see the file.
Q2

Inline ZIA DLP vs CASB — pick the true split.

Correct: a. Inline watches the click-now path. CASB watches files already in the SaaS tenant.
Q3

Zscaler DLP engines: file size limit called out in help?

Correct: c. Configuring DLP Policy Rules with Content Inspection.
Q4

How many DLP engines can one content-inspection rule select?

Correct: a. Help: select Any or up to 4 engines on the rule.
Q5

You need a copy of the violating file for the DLP team. What is the official receiver?

Correct: c. Incident Receiver gets violating content + JSON metadata for inline and CASB DLP.
Q6

Finance PAN upload blocked, marketing PDF allowed. First?

Correct: d. Different files, different engines. Prove the hit before changing engines.

Sources

Related: Path hub · SSL inspect · ZIA operator path