# ZIA DLP + CASB — see the file before it leaves Source: https://ai.techclick.in/blog_zscaler_zia_dlp Markdown: https://ai.techclick.in/blog_zscaler_zia_dlp.md Publisher: Techclick Infosec Pvt Ltd Inline DLP needs Decrypt. Engines, 400 MB limit, Incident Receiver, CASB vs endpoint. Scored quiz. ## The ticket Aditya at Apex Freight finance: “I uploaded a spreadsheet with PAN numbers to a personal drive and Zscaler blocked it. Marketing uploaded a brochure PDF and it went through. Is DLP broken?” No. DLP matched identifiers on one file and not the other. Hero · data leaving the laptop Inline DLP is the web path. CASB is the SaaS-at-rest path. Endpoint DLP is the laptop path. Do not mix the three on the first sentence of the ticket. Quick answer Inline DLP reads the body after SSL inspect. Engines (dictionaries like PAN, Aadhaar, source code) match, then the rule Allow/Block/Notify. CASB is API to the SaaS tenant. If inspect is off, inline DLP is blind on HTTPS. ## Mental model — three DLP desks - Inline web DLP — ZIA proxy, Policy → Data Loss Prevention. Needs Decrypt for HTTPS payload. - CASB / data-at-rest — SaaS API scan (files already in the tenant). Not the same click path. - Endpoint DLP — Client Connector policy for USB/print/local. Deployed with ZCC. Flow 1 · inline DLP Flow 1 · inline DLP - User upload HTTPS file SSL inspect must Decrypt DLP engines ≤4 per rule Action block / notify / ICAP Engines support files up to 400 MB and scan the first 100 MB of extracted text. Source: Configuring DLP Policy Rules with Content Inspection. Say this out loud Dictionary finds the secret. Engine groups dictionaries. Rule decides block or monitor. Inspect must be on or I am guessing. Hard words: Dictionary is the pattern (PAN, Aadhaar, HIPAA). Engine combines dictionaries. Incident Receiver is the ICAP VM that stores the violating file + JSON metadata. ## How to choose inline vs CASB vs endpoint Journey · upload → engine → action Inline catches the upload. CASB catches the file that is already in OneDrive. Endpoint catches the USB copy. Path Use when Trap Inline web DLP Browser / ZCC upload right now HTTPS not decrypted CASB DLP File already in M365 / GDrive / Box Treating it as a substitute for inspect Endpoint DLP USB, print, local share Policy created in ZIA but ZCC profile not deployed Incident Receiver Need the actual violating file Notify-only with no receiver — auditor sees a mail, no sample Source: About Data Loss Prevention and About Zscaler Incident Receiver . Decision · which DLP desk Decision · which DLP desk Where is the file? Inline now CASB at rest Browser upload = inline (needs Decrypt). Already in the tenant = CASB. USB = Endpoint DLP. ## Runbook — Side A / B / C ### Side A · inspect + identity #### Decrypt the DLP group If finance uploads over HTTPS, the SSL inspect rule for that group must be Decrypt. Otherwise the DLP rule never sees PAN numbers. - #### User context DLP rules can key off users/groups. SCIM must place Aditya in grp-finance or the rule will miss him. ### Side B · ZIA DLP policy - #### Engine Administration → DLP Dictionaries & Engines (or Policy resources). Confirm PAN / Aadhaar dictionaries are in the engine you will attach. - #### Rule Policy → Data Loss Prevention → Add rule. Content Matching = Select DLP Engines. Pick up to 4 engines (or Any). Action = Block + notify auditor for finance; Monitor for a week if this is the first pilot. admin.zscaler.net · Policy → Data Loss Prevention → Add DLP Rule Training mock · not live Policy / Data Loss Prevention / Add DLP Rule ### Add DLP Rule with Content Inspection Rule Name Finance-PAN-Block Users / Groups grp-finance DLP Engines Engine-IN-PII (1 of 4) Action Block + Notify auditor Cancel Save Help: content-inspection rules support Any or up to 4 engines. Files up to 400 MB; first 100 MB of extracted text. Training mock · not live. ### Side C · prove - #### Pilot file From a finance laptop, upload a lab file with synthetic PAN (never real customer data). Expect Block + EUN. - #### Insights Analytics → Web Insights / DLP. Quote user, engine, dictionary, action. If CASB, use the SaaS DLP incident, not Web Insights. ## Runtime path after go-live Ops · incident desk Notify without a sample is weak. Attach Incident Receiver when the DLP team must keep the file. Optional: add Zscaler Incident Receiver on the rule. Zscaler sends the violating content plus JSON (URL, collaborators, dictionaries, engines) over ICAP. Host the VM in AWS, Azure, or on-prem. Source: About Zscaler Incident Receiver. ## Traps and proof Symptom First check Do not No DLP hit on HTTPS SSL inspect action Add engines blindly Hit in SaaS but not in browser You are looking at CASB, not inline Rewrite inline rules for API events False positive on a brochure Dictionary confidence / proximity; file actually has identifiers? Turn the engine off for the org Endpoint USB copy still works ZCC Endpoint DLP profile deployed? Assume inline covers USB Pilot checklist - Synthetic PAN from grp-finance is blocked. Web Insights quotes the engine. - Same file from a non-finance user follows the Monitor/allow design you intended. - One SaaS at-rest file is visible in CASB incidents, labelled as CASB not inline. Unsafe path Uploading real customer PAN “to test DLP.” Use synthetic identifiers. Real data in a ticket is an incident of its own. ← SSL inspect · Path hub ## Knowledge check Six DLP tickets. Pick the first safe move. Q1 Priya’s HTTPS upload is not inspected by DLP. First question? Add four more DLP engines Is the session decrypted by SSL Inspection? Rebuild the App Connector Disable ZCC Correct: b . Inline web DLP needs the payload. Do Not Decrypt = engines never see the file. Q2 Inline ZIA DLP vs CASB — pick the true split. Inline DLP is the web/proxy path; CASB DLP is SaaS data-at-rest / API They are the same policy CASB replaces SSL inspect DLP only works on GRE Correct: a . Inline watches the click-now path. CASB watches files already in the SaaS tenant. Q3 Zscaler DLP engines: file size limit called out in help? 1 MB only Unlimited Files up to 400 MB; first 100 MB of extracted text Only 10 KB dictionaries Correct: c . Configuring DLP Policy Rules with Content Inspection. Q4 How many DLP engines can one content-inspection rule select? Up to 4 (or Any) Unlimited Exactly 1 16 Correct: a . Help: select Any or up to 4 engines on the rule. Q5 You need a copy of the violating file for the DLP team. What is the official receiver? Email the CEO ZPA Browser Access Zscaler Incident Receiver (ICAP) on the DLP rule PAC file Correct: c . Incident Receiver gets violating content + JSON metadata for inline and CASB DLP. Q6 Finance PAN upload blocked, marketing PDF allowed. First? Turn DLP off New GRE Empty Connector Quote the DLP rule + engine + dictionary that hit, then check if the PDF had no matching identifiers Correct: d . Different files, different engines. Prove the hit before changing engines. Check answers Reset ## Sources - About Data Loss Prevention - Configuring DLP Policy Rules with Content Inspection - About Zscaler Incident Receiver - Step-by-Step Configuration Guide for Endpoint DLP Related: Path hub · SSL inspect · ZIA operator path --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt