loading…
Investigate a large sensitive-data upload to personal storage
/api/mcp/srv-data-loss-preventionMCP enable + token are only for calling from an external client — the playground below needs neither.
Create policy exception for specific users, content patterns, or destinations to reduce false positives
{
"type": "object",
"required": [
"policy_id",
"exception_type",
"value",
"justification"
],
"properties": {
"scope": {
"enum": [
"global",
"policy_specific",
"user_specific"
],
"type": "string"
},
"value": {
"type": "string"
},
"policy_id": {
"type": "string"
},
"expiry_date": {
"type": "string",
"format": "date-time"
},
"justification": {
"type": "string"
},
"exception_type": {
"enum": [
"user",
"content_pattern",
"destination",
"file_type",
"size_threshold"
],
"type": "string"
}
}
}Generate compliance reports for regulatory frameworks with incident summaries, policy effectiveness, and risk metrics
{
"type": "object",
"required": [
"framework",
"report_period"
],
"properties": {
"format": {
"enum": [
"pdf",
"csv",
"json"
],
"type": "string"
},
"end_date": {
"type": "string",
"format": "date-time"
},
"framework": {
"enum": [
"gdpr",
"hipaa",
"pci_dss",
"sox",
"ccpa",
"custom"
],
"type": "string"
},
"start_date": {
"type": "string",
"format": "date-time"
},
"report_period": {
"enum": [
"monthly",
"quarterly",
"yearly",
"custom"
],
"type": "string"
},
"include_trends": {
"type": "boolean",
"default": true
},
"include_incidents": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed incident information including matched content, policy violations, user context, and remediation actions
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
},
"include_content": {
"type": "boolean",
"default": false
},
"include_context": {
"type": "boolean",
"default": true
}
}
}Retrieve DLP policy configuration including rules, conditions, and enforcement actions
{
"type": "object",
"required": [
"policy_id"
],
"properties": {
"policy_id": {
"type": "string"
},
"include_rules": {
"type": "boolean",
"default": true
},
"include_statistics": {
"type": "boolean",
"default": false
}
}
}Analyze policy coverage across data repositories, users, and channels showing gaps and overlaps
{
"type": "object",
"required": [
"scope"
],
"properties": {
"scope": {
"enum": [
"users",
"repositories",
"channels",
"data_types"
],
"type": "string"
},
"policy_id": {
"type": "string"
},
"time_range": {
"enum": [
"last_7d",
"last_30d",
"last_90d"
],
"type": "string"
},
"include_gaps": {
"type": "boolean",
"default": true
}
}
}List all DLP policies with their status, rule counts, and recent incident statistics
{
"type": "object",
"required": [],
"properties": {
"status": {
"enum": [
"enabled",
"disabled",
"testing"
],
"type": "string"
},
"channel": {
"enum": [
"email",
"web",
"endpoint",
"cloud",
"network"
],
"type": "string"
},
"sort_by": {
"enum": [
"name",
"created_date",
"last_modified",
"incident_count"
],
"type": "string"
},
"policy_type": {
"enum": [
"content",
"contextual",
"statistical",
"exact_match",
"regex",
"ml_classifier"
],
"type": "string"
},
"include_stats": {
"type": "boolean",
"default": true
}
}
}Aggregate violation statistics by policy, data type, user, and time period
{
"type": "object",
"required": [
"group_by"
],
"properties": {
"user_id": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"group_by": {
"enum": [
"policy",
"user",
"department",
"data_type",
"severity",
"endpoint"
],
"type": "string"
},
"policy_id": {
"type": "string"
},
"department": {
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
}
}
}Quarantine detected sensitive content and notify stakeholders with optional automatic remediation
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": true
},
"auto_remediate": {
"type": "boolean",
"default": false
},
"notify_manager": {
"type": "boolean",
"default": false
},
"retention_days": {
"type": "integer",
"default": 90
},
"quarantine_location": {
"enum": [
"dlp_vault",
"original_encrypted",
"secure_storage"
],
"type": "string"
}
}
}Quarantine or restore files identified in DLP violations
{
"type": "object",
"required": [
"incident_id",
"file_path",
"action"
],
"properties": {
"action": {
"enum": [
"quarantine",
"restore",
"delete"
],
"type": "string"
},
"reason": {
"type": "string"
},
"file_path": {
"type": "string"
},
"incident_id": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": true
}
}
}Initiate on-demand DLP scan of files, directories, or data repositories
{
"type": "object",
"required": [
"scan_type",
"target_path"
],
"properties": {
"scan_mode": {
"enum": [
"full",
"incremental",
"sample"
],
"type": "string"
},
"scan_type": {
"enum": [
"file",
"directory",
"database",
"email",
"cloud_storage"
],
"type": "string"
},
"policy_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"target_path": {
"type": "string"
},
"notification_email": {
"type": "string",
"format": "email"
}
}
}Search DLP incidents across policies with filters for severity, status, data types, and time ranges returning incident details and metadata
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"query": {
"type": "string",
"description": "Free text search across incident content"
},
"status": {
"enum": [
"new",
"investigating",
"confirmed",
"false_positive",
"resolved"
],
"type": "string"
},
"channel": {
"enum": [
"email",
"web",
"endpoint",
"cloud",
"network"
],
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"policy_id": {
"type": "string",
"description": "Filter by specific DLP policy"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
},
"data_classification": {
"type": "array",
"items": {
"enum": [
"pii",
"phi",
"pci",
"confidential",
"restricted",
"public"
],
"type": "string"
}
}
}
}Update incident status, assign ownership, and add investigation notes
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
},
"priority": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"incident_id": {
"type": "string"
}
}
}Adjust policy sensitivity thresholds and matching criteria based on incident feedback and false positive rates
{
"type": "object",
"required": [
"policy_id"
],
"properties": {
"policy_id": {
"type": "string"
},
"enable_ml_tuning": {
"type": "boolean",
"default": false
},
"proximity_distance": {
"type": "integer",
"minimum": 1
},
"confidence_threshold": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"training_period_days": {
"type": "integer",
"default": 30
},
"match_count_threshold": {
"type": "integer",
"minimum": 1
}
}
}Change incident status and add investigation notes for case management and workflow progression
{
"type": "object",
"required": [
"incident_id",
"status"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"investigating",
"confirmed",
"false_positive",
"resolved"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"incident_id": {
"type": "string"
},
"remediation_action": {
"enum": [
"none",
"quarantine",
"encrypt",
"delete",
"notify_user",
"block_transmission"
],
"type": "string"
}
}
}