# ZIA DLP + CASB — content vs tenant Source: https://ai.techclick.in/blog_zscaler_b11_08_dlp_casb Markdown: https://ai.techclick.in/blog_zscaler_b11_08_dlp_casb.md Publisher: Techclick Infosec Pvt Ltd ZIA DLP + CASB lesson: dictionaries vs engines, EDM and IDM, Cloud App Control tenant restriction, and how to prove a hit in Web Insights DLP fields. Quick answer (say this out loud) Cloud App Control answers “which app, which tenant, which activity.” DLP answers “what data is in the payload.” Dictionaries detect (predefined, Pattern and Phrases, Exact Data Match, Indexed Document Match). You do not hang a regex on the rule — you put dictionaries in a DLP Engine with All (AND) , Any (OR) , Exclude (AND NOT) , or Sum , then the rule references up to four engines. Actions are Allow , Block , or Confirm . Tenant restriction is a Tenant Profile ( Tenant Directory ID ) on a Cloud App Control rule — not a DLP dictionary. Prove it on Analytics → Web Insights → Logs . Hero · inspect before the SaaS split Notice: the same upload can be allowed to the corporate tenant and blocked to personal storage. That split is Cloud App Control + Tenant Profiles. The spreadsheet contents are DLP. ## 1. Why this ticket exists URL Filtering keeps people off bad sites. Threat Protection keeps malware out. Legal will still ask one question: if an employee posts the customer table to personal webmail or a personal cloud drive, do we know, and do we stop it? That is two different jobs. Cloud App Control can allow, caution, block, or isolate an app — and, with a Tenant Profile , tell corporate Microsoft 365 from a personal login on the same domain. DLP inspects the body and attachments after SSL inspection and matches dictionaries inside an engine. Neither one replaces the other. HTTPS that is not decrypted is invisible to content DLP. If SSL Inspection is bypassed for onedrive.com , the DLP rule you spent a week on never sees the file. Fix inspection first; then build dictionaries. Visual · Path A vs Path B Caption in the diagram is mood only. Path A = sanctioned tenant + activity control. Path B = personal or unsanctioned destination. DLP still inspects the payload on both. ## 2. Mental model ZIA data protection is a stack. Memorize the order before you open the portal. #### 1 · Dictionary The detector. Predefined (Credit Cards, SSN, Aadhaar, …), custom Pattern and Phrases , Exact Data Match (EDM) , or Indexed Document Match (IDM) . #### 2 · Engine The expression. Combine dictionaries with All (AND) , Any (OR) , Exclude (AND NOT) , Sum , plus a match count per dictionary. This is what the rule references. #### 3 · DLP rule Who / where / which apps. Criteria include DLP Engines (Any, or up to 4), URL Categories , Cloud Applications , file types, users. Action: Allow , Block , Confirm . #### 4 · Tenant + at rest Tenant Profiles on Cloud App Control pick the SaaS tenant. SaaS Application Tenants + Data at Rest Scanning find files already stored — they never had to cross the tunnel today. Visual · Detect → Engine → Rule → Log Help’s real order: dictionaries never sit alone on a policy. The engine is the Boolean. The rule is the action. The log is the proof. Say this out loud Provision the detector. Combine it in an engine. Scope the rule. Restrict the tenant. Then open Web Insights and name the engine that fired. Hard words, once DLP Dictionary — a named detector. DLP Engine — Boolean (and Sum) over dictionaries; this is what the rule lists. EDM — Exact Data Match: Index Tool hashes your structured rows; inspection looks up hashes. IDM — Indexed Document Match: Index Tool fingerprints documents; match accuracy catches excerpts. Tenant Profile — Tenant Directory ID (and options such as Allow Personal Office 365 Domains ) attached to Cloud App Control. Confirm — user must justify or cancel; both are logged. Match Only — still evaluates on Allow and Block; used when you want the engine to count without changing the action story. ## 3. Decision flow Read the diagram first. Then pick the control. Do not start in “Add DLP Rule” if the problem is “personal vs corporate login.” Flow 1 · which control owns this ticket Decision flow: activity vs content vs data at rest - Start with the question, not the menu Sensitive data leaving / already in SaaS? User, app, direction, inspectable? Crossing ZIA right now? No · already in the tenant SaaS Application Tenants + Data at Rest Scanning DLP OAuth · not the tunnel Activity or content? Activity / tenant Cloud App Control + Tenant Profile (Directory ID) Allow · Caution · Block · Isolate Content DLP Engine on DLP rule Allow / Block / Confirm SSL Inspection must be on for HTTPS content DLP Bypass the SaaS host and the engine never sees the file. Encrypted / password-protected files also skip payload inspection. Most tickets need Cloud App Control AND DLP — tenant first, then content. Read top → bottom. Diamond = decision. Left = already stored (SaaS API). Right = in motion. Activity is not content. ## 4. How to choose One detector does not cover every leak. Pick the tool that matches the data shape, then wrap it in an engine. Control Use when Do not use when What it matches Predefined dictionary Regulator formats: Credit Cards, US SSN, India Aadhaar, IBAN, cloud keys. Zscaler maintains the pattern. You only care about your customer rows, or a board deck excerpt. Pattern + built-in validators (e.g. Luhn on cards). Alone, a Credit Cards dictionary is noisy. Pattern and Phrases Internal labels, project codenames, custom ID formats you can write as words, phrases, or a pattern. You try to paste a regex onto the DLP rule itself. Rules do not take raw regex. Tokens / phrases / patterns inside a named dictionary. Tune match count in the engine. EDM Structured rows you own: customer PAN + name + email. “Only our 1.2M records.” Free-text excerpts, slide decks, source trees. Stale CSV with no refresh job. Hash lookup from an EDM index template built in the Index Tool. Primary field is the unique key in classic templates. IDM Unstructured originals: board deck, M&A draft, contract. You need partial-document hits. Row-shaped databases. You expect 100% match on a heavily templated legal form (raise match accuracy). Document fingerprint. Set match accuracy on the custom IDM dictionary. Cloud App Control + Tenant Profile Personal vs corporate Microsoft / Google login. Block upload to an unsanctioned tenant while allowing the corp tenant. You need to know what was in the file. Tenant control does not read PAN digits. App + activity (upload / download / post) + Tenant Directory ID . Data at Rest Scanning Files already in SharePoint / Drive / Box from last quarter. Public shares. Off-tunnel BYOD that never hit ZIA. You need a real-time block of this morning’s upload. That is inline DLP + Cloud App Control. SaaS Application Tenant (OAuth) + Data at Rest DLP policy. Connector health is the silent failure. ## 5. Runbook — dictionary → engine → rule → tenant Side A builds detectors. Side B hangs them on an inline DLP rule. Side C restricts the SaaS tenant and (if licensed) authorizes the SaaS tenant for at-rest scan. Activate after each side. ### Side A — Dictionaries and engines Primary source: Zscaler Help About DLP Dictionaries , Adding Custom DLP Dictionaries , Understanding DLP Engines , Adding Custom DLP Engines . #### Open Dictionaries & Engines Path (current Help): Policies → Data Protection → Common Resources → DLP Dictionaries & Engines . Older clouds still show Policy → Data Loss Prevention . You will see predefined dictionaries, custom dictionaries, and DLP Engines as separate objects. - #### Reuse or clone a predefined dictionary first Credit Cards, Social Security Number (US), Aadhaar Card Number (India), and similar predefined dictionaries are maintained by Zscaler. Clone if you need a tighter match count later — do not invent a second Luhn regex unless Help’s dictionary cannot express the format. - #### Add a custom dictionary only when needed Add Dictionary → choose type: Pattern and Phrases , Exact Data Match , or Indexed Document Match . Pattern and Phrases is words / phrases / patterns. EDM and IDM require an index template from the Index Tool before the dictionary is useful. - #### EDM: Index Tool → template → dictionary Export the sensitive table, normalize columns the same way users will type them (strip spaces on PANs). In the Index Tool create an EDM index template . Classic templates still treat the primary field as the unique key the policy is based on. Hash upload — the Service Edge looks up hashes, not plaintext rows. Rebuild the index on a schedule; a six-week-old snapshot will not see last week’s customers. - #### IDM: Index Tool → template → match accuracy Upload the protected documents to an IDM index template . On the custom dictionary, set match accuracy (Help: Defining IDM Match Accuracy for Custom DLP Dictionaries ). Lower accuracy catches excerpts (pasted paragraphs). Higher accuracy reduces hits on templated legal text. - #### Build the engine — this is the Boolean Add DLP Engine. Root operators: All (AND) , Any (OR) , Sum . Nested operators also include Exclude (AND NOT) . Each dictionary gets a match count . Sum is for count-based dictionaries (Credit Cards, SSN, …) — you set the total matches that fire the group. Example production shape: All( Credit Cards match count ≥ 2 , Any( Cardholder-related phrase dictionary ) ). That is an engine, not a “composite dictionary.” admin.zscalerthree.net · Policies → Data Protection → Common Resources → DLP Dictionaries & Engines → DLP Engines Training mock · not live Policies / Data Protection / Common Resources / DLP Engines / Add DLP Engine ### Add DLP Engine Engine Name PCI-CC-Strict Status Enabled Root operator All (AND) Expression (training) All (   Dictionary: Credit Cards   Match Count: 2   Any ( Phrase: cardholder · expiry · CVV ) ) Cancel Save Root may be All, Any, or Sum. Exclude (AND NOT) is for nested expressions. Rules reference this engine — not the dictionaries directly. Source: Zscaler Help · Understanding DLP Engines / Adding Custom DLP Engines. Values are training placeholders. ### Side B — Inline DLP rule Primary source: Zscaler Help Configuring DLP Policy Rules with Content Inspection . - #### Confirm SSL Inspection covers the destination Content inspection of HTTPS requires decryption. If Cloud Apps or URL categories for webmail / file sharing are on an SSL bypass, stop and fix SSL Inspection first. - #### Add DLP Rule Path: Policies → Data Protection → Policy (older: Policy → Data Loss Prevention ) → Add DLP Rule . Set Rule Order (evaluated ascending: 1 before 2), Rule Name , status, optional Rule Label . - #### Content Matching = DLP Engines Choose Select DLP Engines . Pick Any , or select up to 4 engines . That is a documented limit — if you need a fifth detector, fold it into an existing engine expression. - #### Scope with AND criteria Help applies AND across URL Categories and Cloud Applications when both are set. Also set users / groups / departments / locations and file types. Example: Cloud Applications = webmail family, Groups = All except a documented exception group. - #### Action, auditor, notification Allow — permit and log. Block — deny and log. Confirm — user justifies to continue or cancels; both are logged. Attach an auditor and a notification template if you want the email; Help says if you select neither, no notification is sent. Match Only applies to both Allow and Block. - #### Pilot with Confirm, then flip to Block New PCI-to-personal-webmail rules go live as Confirm for a measured window (commonly two weeks in production practice). Tune match counts from the justification noise. Then change Action to Block. Check Evaluate All Rules on DLP Advanced Settings if your design needs more than first-match. Training rule card — field names from Help, not a live tenant Add DLP Rule Rule Order: 20 Rule Name: Block-PCI-to-personal-webmail Content Matching: Select DLP Engines DLP Engines: PCI-CC-Strict (max 4 engines) URL Categories: Webmail Cloud Applications:Gmail / Yahoo Mail / Outlook.com (as classified) Users / Groups: All except documented exception group Action: Confirm → later Block Auditor: secops-dlp@example.com Notification: PCI-block-banner Match Only: off ### Side C — Tenant restriction + SaaS at rest Primary source: Zscaler Help Adding Tenant Profiles , About Cloud App Control , Adding SaaS Application Tenants . - #### Add Tenant Profile Path (current Help): Policies → Access Control → Internet & SaaS → Tenant Profiles → Add Tenant Profile . Older label: Administration → Tenant Profiles . For Microsoft Login Services, enter the corporate Tenant Directory ID (Entra tenant GUID). Decide Allow Personal Office 365 Domains explicitly — leaving this wrong is how personal OneDrive stays open. - #### Attach the profile to Cloud App Control Cloud App Control rule (IT Services / File Sharing / the category Help shows for that app) → Tenant Profiles . Actions here are app actions: Allow , Caution , Block , Isolate , plus per-activity Allow/Block (upload, download, posting) where the category supports them. This is not DLP. - #### Authorize SaaS Application Tenants for at-rest If the ticket is “files already in SharePoint with a public link,” add the SaaS Application Tenant (OAuth / admin consent) and write a Data at Rest Scanning DLP policy against the same engines. Inline DLP will never enumerate last year’s library. admin.zscalerthree.net · Policies → Access Control → Internet & SaaS → Tenant Profiles Training mock · not live Policies / Access Control / Internet & SaaS / Tenant Profiles / Add Tenant Profile ### Add Tenant Profile Profile Name MS365-corp-only Cloud Application Microsoft Login Services Tenant Directory ID f4c77d8d-6bb8-41a2-0000-000000000000 Allow Personal Office 365 Domains Off — personal tenants blocked when this profile is attached Cancel Save Directory ID example shape from Help. Then attach this profile on the Cloud App Control rule — saving the profile alone does nothing. Source: Zscaler Help · Adding Tenant Profiles (Microsoft Login Services · Tenant Directory ID · Allow Personal Office 365 Domains). ## 6. Runtime path After go-live, one Gmail attachment or OneDrive PUT walks this path. If any box is skipped, the log will lie to you. Flow 2 · one upload after Activate Runtime path from user upload through DLP to Web Insights - 1 · User POST / upload 2 · Forward ZCC / GRE / PAC 3 · SSL Inspect or DLP is blind 4 · Cloud App Tenant Profile? 5 · DLP Engine dicts + match count Engine hit? rule Action Allow · log permitted + recorded Confirm justify or cancel Block · log user notification 6 · Web Insights Engine · Dicts · Severity · Action NSS web fields you will name in SIEM: DLP Engine, DLP Dictionaries, DLP Severity, Action — plus user, URL, Cloud App. Endpoint DLP uses dlpenginenames / dlpdictnames / actiontaken / triggeredrulelabel. Left → right, then down. If step 3 is bypass, steps 5–6 never populate DLP columns. ## 7. Traps + proof Ops · the log is the close Green boxes are a feeling. The ticket closes when Web Insights shows the engine name, the dictionaries, DLP Severity, and Action for the pilot user. Symptom Likely cause Fix 50k Credit Cards alerts / day, mostly from build logs A single predefined dictionary with match count 1, no engine AND Wrap Credit Cards in an engine: All + higher match count + Any nearby phrase dictionary. Optionally add EDM so only your rows count. Personal OneDrive upload succeeds; URL looks like onedrive.com No Tenant Profile on Cloud App Control, or Allow Personal Office 365 Domains left on Add Tenant Profile with corporate Tenant Directory ID . Attach it. URL Filtering cannot split tenants. Rule exists; Insights has no DLP Engine / DLP Dictionaries SSL Inspection bypassed, or file encrypted / password-protected, or traffic never hit ZIA Confirm inspect for that Cloud App. Encrypted ZIP will not yield payload matches — pair File Type Control. Prove forwarding first. New customer PAN does not fire EDM Index is a snapshot. Row was added after last Index Tool upload Rebuild / re-upload the EDM template on a schedule. Alert if last successful index is stale. Board-deck excerpt pasted into a chatbot is missed You used EDM or a phrase dictionary. That is the wrong detector IDM template + lower match accuracy on the custom dictionary. EDM is rows, not prose. SharePoint public-link report is empty for last month SaaS Application Tenant OAuth expired or last scan is old. Inline DLP never sees at-rest objects Re-authorize the tenant. Monitor connector / last-scan age. Write Data at Rest DLP separately. Match preview in the log shows a full PAN Notification / Insights preview not redacted; NSS forwarded the same string Treat the log as a second leak. Use redacted previews and confirm NSS / SIEM columns do not store the raw match. Audit every DLP rule. Unsafe vs safe Unsafe: Block-from-day-1 on All Users + Credit Cards dictionary only. Monday is a ticket flood and SecOps mutes DLP. Safe: Engine with All + match count → Confirm on a pilot group → read Web Insights → widen → Block. Tenant Profile on Cloud App Control so corporate OneDrive still works. Pilot proof checklist From a pilot user, trigger a documented test payload (not a live customer row). Confirm the user saw Allow / Confirm / Block as designed. - Analytics → Web Insights → Logs — columns on: User , URL , Cloud App , DLP Engine , DLP Dictionaries , DLP Severity , Action . Filter the engine name you created. - NSS / SIEM: same four DLP facts arrived. Endpoint DLP feeds use dlpenginenames , dlpdictnames , actiontaken , severity , triggeredrulelabel . - Cloud App Control: personal Microsoft login is blocked or cautioned; corporate Tenant Directory ID still works. - SaaS tenant page: connector connected; last scan is recent if you rely on Data at Rest. - EDM / IDM: Index Tool last upload time and row / document count match the system of record. ## Knowledge check Six judgment questions. Map each miss back to the section in the reason. Q1 A user on a corporate laptop uploads a file to personal OneDrive. The CISO wants personal blocked and corporate allowed on the same domain. Which control actually splits the tenants? URL Filtering on onedrive.com Tenant Profile (Tenant Directory ID) attached to a Cloud App Control rule A Credit Cards DLP dictionary SSL Inspection bypass for Microsoft Correct: b . Tenant restriction is Tenant Profiles on Cloud App Control. URL Filtering sees one domain. DLP reads content, not tenant ID. SSL bypass would hide the upload. Re-read the decision flow and Side C. Q2 You must match only your 1.2 million customer card numbers, not every Luhn-valid 16-digit string. Which detector? EDM index template + EDM dictionary (Index Tool hash upload) Predefined Credit Cards dictionary alone IDM match accuracy at 30% Cloud App Control Isolate Correct: a . EDM is structured exact-row match. Predefined Credit Cards is any valid card pattern. IDM is documents. Isolate is an app action. Re-read How to choose. Q3 A user pastes three paragraphs of last quarter’s board deck into a public chatbot. The file itself was never uploaded. What has a chance of firing? EDM primary-field lookup File Type Control on PDF IDM dictionary with match accuracy tuned for excerpts Tenant Directory ID on Microsoft Login Services Correct: c . IDM fingerprints documents and match accuracy is how excerpts hit. EDM is rows. File Type Control never sees a paste. Tenant ID is the Microsoft login, not the chatbot text. Re-read Side A IDM. Q4 SOC is drowning in Credit Cards dictionary hits from developer logs. What is the Help-shaped fix? Paste a PCRE regex into the DLP rule Action field Put Credit Cards plus a phrase dictionary in a DLP Engine using All (AND) and raise match count Disable SSL Inspection so logs are not inspected Delete the predefined dictionary from the cloud Correct: b . Rules reference engines, not raw regex. All + match count is the false-positive killer. SSL bypass creates a blind spot. Re-read Side A engines. Q5 A new rule will block PCI uploads to personal webmail next week. Least-damage rollout? Action = Block, Users = All, Monday 09:00 Turn off Cloud App Control so DLP is the only gate Evaluate only Rule Order 99 and hope Action = Confirm on a pilot group, tune engines from Insights, then flip to Block Correct: d . Confirm logs justifications without a Monday outage. Help’s actions are Allow, Block, Confirm — Confirm is the rehearsal. Re-read Side B. Q6 How do you prove the pilot upload actually hit inline DLP? Chrome loaded mail.google.com, so DLP ran Ping the Public Service Edge Analytics → Web Insights → Logs shows DLP Engine, DLP Dictionaries, DLP Severity, and Action for that user The SaaS Application Tenant OAuth page is green — that is inline proof Correct: c . Those four columns are the inline proof. Loading a site only proves forwarding. A green SaaS tenant is at-rest connector health, not this morning’s POST. Re-read traps + proof. Check answers Reset ## Sources - Zscaler Help — About DLP Dictionaries · Adding Custom DLP Dictionaries · Understanding Predefined DLP Dictionaries - Zscaler Help — About DLP Engines · Understanding DLP Engines · Adding Custom DLP Engines - Zscaler Help — Understanding Exact Data Match Index Templates · Creating an Exact Data Match Template · Defining EDM Fields for Custom DLP Dictionaries - Zscaler Help — About Indexed Document Match · Creating an IDM Template · Defining IDM Match Accuracy - Zscaler Help — Configuring DLP Policy Rules with Content Inspection · Configuring DLP Advanced Settings · About Zscaler Incident Receiver - Zscaler Help — About Cloud App Control · About Tenant Profiles · Adding Tenant Profiles - Zscaler Help — About SaaS Application Tenants · Adding SaaS Application Tenants · Data at Rest Scanning Policies - Zscaler Help — Web Insights Logs: Columns · DLP Severity on Web Insights Logs · NSS Feed Output Format: Endpoint DLP Logs Related: URL Filtering & Cloud App Control · SSL Inspection & file type · Zscaler authentication · ZIA traffic flow · Batch 11 · Lesson 9 — ZPA architecture --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt