Data-in-Motion Rules ↗

Data-in-motion Rules define the DLP policies that govern how sensitive data is handled when it moves across endpoints. These rules specify what data patterns to detect, which applications and destinations to monitor, and what actions to take (allow, block, notify) when sensitive data movement is detected. Rules can be created, edited, cloned, enabled/disabled, deleted, and prioritized.

Users access Data In Motion Rules by going to Modules → Data Security → Endpoint Data-in-Motion Rules.

Permission	Description	Recommended Roles
None	Users cannot access the Data-in-motion Rules page.	<ul><li>SOC Tier-1 Analyst: DLP rule management is outside triage responsibilities.</li><li>IT Admin: DLP rule management is outside the IT infrastructure administration scope.</li></ul>
View	Users can navigate to the Data-in-motion Rules page and see all configured DLP rules in the grid view. They can view rule names, priorities, statuses (enabled/disabled), target applications, conditions, actions, and inspect rule details.	<ul><li>SOC Tier 2 and 3 Analysts: May need to review DLP rules when investigating cases/issues,</li><li>Threat Hunter: May need to understand DLP rules to correlate with threat hunting findings</li></ul>
View/Edit	Users have full control over Data-in-motion rules. They can create, edit, duplicate, delete, and enable/disable rules. They can also change rule priorities. All context menu actions are fully accessible.	<ul><li>Security Engineer: Primary responsibility for creating and maintaining DLP rules.</li><li>Security Admin: Full administrative access to all DLP configurations.</li></ul>

Required and recommended permissions

Data-in-Motion rules act as the enforcement arm of your DLP strategy. To build effective rules, administrators must have visibility into the sensitive data profiles they are detecting and the applications they are monitoring.

Permission	Permission Level	Reason
Endpoint DLP Settings	View	Strongly recommended. Global DLP settings (such as the default action, domain names, and browser extensions) directly affect rule behavior and enforcement.
Endpoint Applications and Groups	View	Strongly recommended. DLP rules directly reference specific endpoint applications and application groups to define their scope. Viewing these catalogs is essential to understand and configure rule targeting.
Agent Administrations	View	Strongly recommended. Understand which endpoints have the XDR agent deployed.
Data Classification	View	Strongly Recommended. DLP rules directly reference the data profiles configured within the Data Classification module. Understanding these profiles is required to know what the rule considers sensitive data.