Endpoint Applications ↗

Endpoint Applications is a catalog of applications that can be referenced in Data-in-motion Rules. It includes predefined applications (web applications, local file-sharing applications, cloud storage applications, USB devices) and allows creation of custom local and web applications. Each application entry defines process names, URLs/domains, and application type that the DLP engine uses to identify data movement channels.

Users access Endpoint Applications by going to Modules → Data Security → Endpoint Data-in-Motion Rules → Endpoint Applications.

Caution

Predefined (system) applications cannot be edited or deleted regardless of permissions.

Permission	Description	Recommended Roles
None	Users cannot access the Endpoint Applications page. Users cannot see the application catalog, custom applications, or any application definitions. Any attempt to directly access the URL will result in an access denied error.	<ul><li>SOC Tier-1 Analyst: Application catalog management is outside the Tier-1 scope.</li><li>IT Admin: Application catalog management is outside the IT infrastructure administration scope.</li></ul>
View	Users can navigate to the Endpoint Applications page and see all applications in the grid view. They can view application names, types (Web Application, Local Application), process names, URLs/domains, and whether they are predefined or custom.	<ul><li>SOC Tier-2 and 3 Analysts: May need to review application definitions when investigating DLP issues.</li><li>Threat Hunter: May need to understand monitored applications for threat hunting context.</li></ul>
View/Edit	Users have full control over Endpoint Applications. They can create new local applications and web applications, edit custom application definitions, and delete custom applications.	<ul><li>Security Engineer: Responsible for defining custom applications for DLP rule targeting.</li><li>Security Admin: Full administrative access to all DLP configurations.</li></ul>

Required and recommended permissions

Endpoint Applications act as the building blocks for your DLP rules. To effectively manage the application catalog, administrators must understand how these applications are grouped and enforced.

Permission	Permission Level	Reason
Endpoint Application Groups	View	Strongly recommended. Groups contain applications; viewing the application catalog helps when managing groups.
Data-in-Motion Rules	View	Strongly Recommended. DLP rules directly reference the applications defined in this catalog. Viewing these rules provides essential context on where and how specific applications are actively being monitored or blocked.