DLP DATA CHANNEL MATRIX
What data channels does DLP monitor?
ITS DLP currently focuses on Windows endpoint signals: file activity, USB, clipboard file intent, local cloud-sync folders and network shares. Each channel has a different level of visibility, and the product should not be understood as controlling every possible data path.
The matrix below reflects the current verified scope, not a market wish list.
What does “monitoring a data channel” mean?
Recognizing a channel does not mean reading every file or blocking every action. ITS DLP currently collects event metadata and destination context to create reviewable incidents, helping IT teams understand what happened, on which endpoint and whether more investigation is required.
Audit
Record metadata and activity sequences inside an approved scope.
Alert
Use rules, thresholds and exceptions to prioritize noteworthy events.
Incident evidence
Group signals into timelines, risk scores and operational review states.
Current channel coverage
Channel status is based on capabilities verified in the current product source and project state.
Endpoint file activity
- Create, modify, delete and rename activity in allowlisted paths.
- File count, bytes and repeated behavior.
USB storage
- Volume and related file metadata.
- Rules by label, name, extension and size.
Clipboard file intent
- A file-copy intent signal for additional context.
- Not proof that a file left the device.
Local cloud sync
- Common OneDrive, SharePoint, Google Drive, Dropbox, iCloud and Box folders.
- Not a direct cloud connector.
Network shares
- UNC and mapped network drives.
- Best-effort source and destination context.
Unsupported channels
- No completed endpoint channel for browser upload, direct email/chat/AI or print.
Data channel status matrix
Unsupported channels are shown explicitly so pilot scope remains accurate.
Channel
Current visibility
Status
Endpoint file activity
Allowlisted file events, count, bytes and bulk-risk patterns.
Available for pilot
USB or removable storage
Volume context and related file metadata.
Available for pilot
Clipboard file intent
Intent signal reviewed with other event context.
Available for pilot
Local cloud-sync folder
Destination classification on the Windows endpoint.
Available for pilot
Network share
UNC and mapped-drive destination context.
Available for pilot
Microsoft 365 audit
Technical integration requires tenant, permission and subscription validation.
Conditional pilot
Web, direct email/chat/AI
No completed endpoint monitoring channel.
Not supported
Print
No completed endpoint print evidence channel.
Not supported
CHANNEL SELECTION
How channels become usable incident evidence
Signals from selected channels are grouped so the IT team works with context instead of isolated logs.
- Identify endpoint, user and destination class.
- Review file count, total bytes and activity timing.
- Check matched rules and protected samples.
- Assign an owner and record business context.
- Use results to improve channel scope and exceptions.
How to select channels for a pilot
01. Map workflows
Identify where business files move during legitimate work.
02. Prioritize risk
Select channels with meaningful impact and available reviewers.
03. Observe baseline
Understand normal sync, backup and bulk operations.
04. Evaluate coverage
Measure evidence quality and false positives before adding channels.
DLP channel coverage FAQs
Does DLP monitor every USB device automatically?
The pilot can record USB and volume context within the configured scope. Rules and exceptions must be agreed in advance.
Is local Google Drive detection a Google Workspace connector?
No. It classifies a local Windows sync folder. Direct cloud audit integration is a different capability.
Does clipboard intent prove exfiltration?
No. It is an additional signal that must be reviewed with file activity, destination and timeline evidence.
Can the current product monitor AI tools?
No completed browser, chat or AI endpoint channel is claimed.
Should the entire disk be monitored?
A targeted allowlist is recommended because broad monitoring increases load and noise without guaranteed detection value.
When should another channel be added?
After the current scope produces stable evidence, has a review owner and supports a clearly defined use case.
Related DLP pages
Choose the right data channels for a DLP pilot
Share your important data workflows, Windows endpoints and common destinations. IT Systems will recommend a channel scope, initial rules and evidence criteria.