loading…
This task focuses on detecting and responding to unauthorized movement of sensitive or confidential information. It covers USB mass-copy detection, personal cloud synchronization, outbound SFTP PII detection, confidential document printing, cloud share-link revocation, and database dump egress hunting. The objective is to identify suspicious data transfers, determine what information may have been exposed, investigate the source of the activity, and prevent further unauthorized data movement. It helps security teams protect sensitive information and respond to potential data-loss incidents
/api/mcp/srv-dlp-data-exfiltration-responseMCP enable + token are only for calling from an external client — the playground below needs neither.
Block user from performing data transfer actions like email, file sharing, or removable media based on risk assessment.
{
"type": "object",
"required": [
"user_id",
"action_types",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"user_id": {
"type": "string"
},
"incident_id": {
"type": "string"
},
"action_types": {
"type": "array",
"items": {
"enum": [
"email",
"file_share",
"removable_media",
"cloud_upload",
"print"
],
"type": "string"
}
},
"duration_hours": {
"type": "integer"
}
}
}Create a new DLP incident from one or more related violations for investigation and response
{
"type": "object",
"required": [
"violation_ids",
"title",
"severity"
],
"properties": {
"title": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"description": {
"type": "string"
},
"violation_ids": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Create temporary or permanent policy exception for legitimate business use cases with approval workflow and audit logging.
{
"type": "object",
"required": [
"policy_id",
"user_id",
"exception_type",
"justification"
],
"properties": {
"user_id": {
"type": "string"
},
"policy_id": {
"type": "string"
},
"conditions": {
"type": "array",
"items": {
"type": "string"
}
},
"approver_id": {
"type": "string"
},
"expiry_date": {
"type": "string",
"format": "date-time"
},
"justification": {
"type": "string"
},
"exception_type": {
"enum": [
"temporary",
"permanent",
"conditional"
],
"type": "string"
}
}
}Generate comprehensive forensic report for DLP incident including timeline, evidence chain, policy violations, and recommended remediation actions.
{
"type": "object",
"required": [
"incident_id",
"report_type"
],
"properties": {
"incident_id": {
"type": "string"
},
"report_type": {
"enum": [
"executive_summary",
"technical_details",
"compliance_audit",
"full_forensic"
],
"type": "string"
},
"include_file_hashes": {
"type": "boolean",
"default": true
},
"include_screenshots": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed DLP incident by ID including policy violations, matched content snippets, user context, and remediation actions taken.
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
}
}
}Retrieve user risk profile including violation history, data access patterns, and risk score
{
"type": "object",
"required": [
"user_id"
],
"properties": {
"user_id": {
"type": "string"
},
"time_range": {
"enum": [
"last_30d",
"last_90d",
"last_year"
],
"type": "string",
"default": "last_90d"
},
"include_violations": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed information about a specific DLP violation including evidence, user context, and remediation actions
{
"type": "object",
"required": [
"violation_id"
],
"properties": {
"violation_id": {
"type": "string"
}
}
}List active DLP incidents with aggregated violation counts, assigned analysts, and current status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"status": {
"enum": [
"new",
"investigating",
"escalated",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"assigned_to": {
"type": "string"
}
}
}List recent policy matches and violations aggregated by policy, data type, and egress channel
{
"type": "object",
"required": [],
"properties": {
"group_by": {
"enum": [
"policy",
"user",
"channel",
"data_type"
],
"type": "string",
"default": "policy"
},
"data_type": {
"enum": [
"pii",
"phi",
"pci",
"ip",
"financial"
],
"type": "string"
},
"policy_id": {
"type": "string"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string",
"default": "last_24h"
},
"egress_channel": {
"enum": [
"email",
"web",
"usb",
"cloud",
"network"
],
"type": "string"
}
}
}List policy violations aggregated by policy name, severity, and violation count with trending data over specified time periods.
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"group_by": {
"enum": [
"policy",
"user",
"endpoint",
"data_type"
],
"type": "string"
},
"policy_id": {
"type": "string"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"min_severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
}
}Quarantine detected sensitive content to prevent further exfiltration while maintaining audit trail
{
"type": "object",
"required": [
"violation_id",
"quarantine_reason"
],
"properties": {
"notify_user": {
"type": "boolean",
"default": true
},
"violation_id": {
"type": "string"
},
"block_duration": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"indefinite"
],
"type": "string"
},
"quarantine_reason": {
"type": "string"
}
}
}Quarantine a file detected in DLP incident by moving to secure storage and blocking further access while preserving forensic evidence.
{
"type": "object",
"required": [
"incident_id",
"file_hash"
],
"properties": {
"reason": {
"type": "string"
},
"file_hash": {
"type": "string"
},
"incident_id": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": false
}
}
}Search for content matches across endpoints and network traffic using data identifiers, regex patterns, or fingerprints to identify sensitive data exposure.
{
"type": "object",
"required": [],
"properties": {
"pattern": {
"type": "string"
},
"location": {
"enum": [
"endpoint",
"network",
"email",
"web",
"cloud"
],
"type": "string"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"fingerprint_id": {
"type": "string"
},
"data_identifier": {
"enum": [
"ssn",
"ccn",
"phi",
"pii",
"custom"
],
"type": "string"
},
"confidence_threshold": {
"type": "number",
"maximum": 1,
"minimum": 0
}
}
}Search DLP incidents with filters for severity, policy violations, data classification, and time range returning incident summaries with policy matches and risk scores.
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"query": {
"type": "string"
},
"status": {
"enum": [
"new",
"investigating",
"confirmed",
"false_positive",
"resolved"
],
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"policy_id": {
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
},
"data_classification": {
"enum": [
"public",
"internal",
"confidential",
"restricted"
],
"type": "string"
}
}
}Search DLP policy violations with filters for severity, policy type, data classification, and time range
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"query": {
"type": "string",
"description": "Free text search across violation details"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"policy_id": {
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
},
"data_classification": {
"enum": [
"pii",
"phi",
"pci",
"confidential",
"restricted",
"public"
],
"type": "string"
}
}
}Update DLP incident status with analyst notes, disposition, and escalation level for case management workflow.
{
"type": "object",
"required": [
"incident_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"investigating",
"confirmed",
"false_positive",
"resolved"
],
"type": "string"
},
"escalate": {
"type": "boolean",
"default": false
},
"disposition": {
"enum": [
"true_positive",
"false_positive",
"benign_true_positive"
],
"type": "string"
},
"incident_id": {
"type": "string"
},
"analyst_notes": {
"type": "string"
}
}
}