Lab 6 — Preventing Data Exfiltration Using Inline Web DLP
In Lab 5, Alex built a custom DLP detection engine capable of identifying sensitive payroll data. Now it is time to put that engine to work. In this lab, Alex configures an Inline Web DLP policy that blocks unauthorized uploads in real time — and Kevin attempts to upload the Dataparity payroll report to ChatGPT for AI analysis, only to be stopped by Inline Web DLP.
Dependency: This lab requires the Unified DLP Engine created in Lab 5 (DP Project Code). Complete Lab 5 before proceeding.
Scenario Overview
This lab demonstrates the complete Inline Web DLP workflow end-to-end:
| Step | What Happens |
|---|---|
| 1 | Alex creates a custom End User Notification (EUN) |
| 2 | Alex builds an Inline Web DLP policy using the Lab 5 engine |
| 3 | Kevin attempts to upload Dataparity_Q2_2025_Workforce_Financial_Summary.docx to ChatGPT |
| 4 | Inline DLP inspects, detects, and blocks the upload in real time |
| 5 | Kevin receives the custom EUN explaining the denial |
| 6 | Alex reviews the violation in Web Insight Logs |
The payroll report contains a combination of Employee records, Social Security Numbers, payroll and salary data, ABA bank routing numbers, DP Project Codes, and confidential internal communications — exactly the multi-signal pattern the Lab 5 engine was designed to catch.
Task 1 — Admin Experience: Configure Inline DLP Protection
Configure a custom EUN and an Inline Web DLP policy that uses the Lab 5 detection engine to block sensitive uploads.
Step 1 — Navigate to End User Notification (EUN)
Alex creates a custom End User Notification to explain why uploads containing sensitive corporate data are blocked. Clear user coaching reduces helpdesk escalations and reinforces security awareness.
Navigate to:
The EUN is the user-facing message Kevin will see when his upload is blocked. Emphasize that this is not just a block page — it is a coaching moment. Well-crafted EUNs reduce repeat violations by explaining the why, not just the what.
Step 2 — Add a Custom EUN
Navigate to the Client Connector tab and click Add Custom Message. Select channel Inline Web.
Step 3 — Add the Custom Message Text
Enter the message that will be displayed to end users when a policy violation occurs. The message should identify the policy, explain the reason for the block, and provide a contact path.
📝 Suggested message: "Your file upload has been blocked because it contains sensitive Dataparity information protected under our Data Security Policy. If you believe this is an error, please contact the Security team at security@dataparity.com."
Step 4 — Navigate to Inline DLP Policy Creation
Navigate to the Inline DLP policy creation page:
Step 5 — Configure Basic Policy Information
The policy window is large and split across multiple sections. The first section covers the foundational policy settings:
- Policy Name:
Block Sensitive Corporate Data Uploads - Rule Order: Set appropriately for your policy stack
- User Scope: All users (or scoped to the Dataparity employee group)
- Destination / Application Scope: Any destination (to catch all unsanctioned apps)
Step 6 — Configure Policy Criteria
In the Criteria section, select the Unified DLP Engine created in Lab 5 — DP Project Code.
This is the key connection point: the detection logic built in Lab 5 is now referenced by an enforcement policy. The same engine can be reused across Labs 7 and 8 without reconfiguration.
This is the architectural payoff of Lab 5. Ask the group: "How many policies could reference this single engine?" The answer is unlimited — every Inline, Endpoint, and Browser policy in the org can share detection logic. Tune once, protect everywhere.
Step 7 — Configure Policy Action
In the Action section:
- Set Action = Block
- Select the End User Notification created in Steps 1–3
This completes the Detection → Enforcement → User Coaching → Logging chain.
Detection → Enforcement → User Coaching → Logging. This four-step chain is the hallmark of a mature DLP deployment. Detection identifies the risk. Enforcement stops the action. User coaching reduces recurrence. Logging creates an audit trail for investigation.
Most organizations start with detection and logging only (alert mode). The shift to Block + EUN is when DLP moves from visibility to active protection.
Task 2 — User Experience: Prevent Data Exfiltration
Attempt to upload the payroll report to an unsanctioned website and observe the real-time block and user notification.
This task must be performed from the lab VM machine. Ensure the Zscaler Client Connector is running on the VM before proceeding.
Step 8 — Attempt the Upload
Kevin opens a browser on the lab VM and navigates to https://chatgpt.com — a GenAI platform — to get an AI-powered analysis of the sensitive data.
No ChatGPT account? ChatGPT requires a login to upload files. If you do not have an account or prefer not to log in, use any of the following SaaS file-sharing applications instead — the block policy applies to all unsanctioned uploads regardless of destination:
- 4shared — https://www.4shared.com
- WeTransfer — https://wetransfer.com
- Box (personal/free) — https://www.box.com
The upload attempt and block behavior will be identical.
He selects Dataparity_Q2_2025_Workforce_Financial_Summary.docx from the desktop and initiates an upload.
What happens the moment Kevin clicks upload:
- The Zscaler proxy intercepts the outbound HTTP POST
- Inline DLP inspects the file payload in real time
- The DP Project Code engine matches on multiple sensitive identifiers
- The upload is terminated before a single byte reaches ChatGPT
Step 9 — Kevin Receives the Block Notification
Instead of a successful upload confirmation, Kevin sees the custom End User Notification Alex configured in Task 1.
Ask the group: "What would Kevin do next if he saw this message?" The ideal answer is "contact security" — not "find another way to upload." That is why the EUN language matters: a generic "access denied" page frustrates users; a clear explanation with a contact path guides them toward the right behavior.
Also note what Kevin does not see: no file content, no trigger detail, no policy name. That is intentional — you do not want to give a malicious insider a roadmap for evasion.
Task 3 — Admin Experience: Review Web Insight Log
Validate that the DLP event was correctly logged in Web Insight with full metadata.
Step 10 — Navigate to Web Insight Logs
Navigate to the Web Insight log viewer:
Step 11 — Apply DLP Engine Filter
Apply a filter to isolate DLP-triggered events:
Filter: DLP Engine = DP Project Code
Step 12 — Review Violation Metadata
The filtered log shows Kevin's upload attempt. Expand the event to review the full violation record:
The Web Insight log provides full metadata for the violation:
| Field | Value |
|---|---|
| User Identity | Kevin (Dataparity employee) |
| Source Device / IP | Lab VM |
| Cloud Application | ChatGPT |
| Policy Triggered | Block Sensitive Corporate Data Uploads |
| DLP Engine Matched | DP Project Code |
| File Name | Dataparity_Q2_2025_Workforce_Financial_Summary.docx |
| File Type | |
| URL Category | Generative AI and ML Applications |
| Action Taken | Blocked |
The specific matched content (SSNs, account numbers, project codes) is intentionally not displayed at this stage. Full incident drill-down — including trigger data — is covered in Lab 9: ZWA SOC Triage, where Priya investigates Kevin's incidents as a SOC analyst.
- The policy used Block. When would Alert-only be a better starting posture for a new DLP rule — and what metrics would you use to decide when to escalate to Block?
- Kevin uploaded to ChatGPT — a GenAI tool. How would the policy behave if he attempted the same upload to a sanctioned AI platform like Microsoft Copilot?
- The Web Insight log shows metadata but not trigger content at this stage. Why might you want to limit trigger visibility in the primary log view?
- The DLP engine is shared across Labs 6, 7, and 8. What governance process would you use to control who can modify a shared detection engine?
GenAI applications are a new and rapidly growing data exfiltration surface. Employees uploading sensitive documents to ChatGPT, Gemini, or Copilot for "analysis" may not realize they are violating data protection policies. Inline Web DLP intercepts these uploads regardless of which AI tool is used. The engine Alex built in Lab 5 now powers real-time inline protection for every web upload across Dataparity's workforce — with no per-channel reconfiguration required.
Labs 7 and 8 will apply the same engine to Endpoint DLP (removable media) and Browser DLP (copy-paste controls), demonstrating that a single detection investment can span multiple enforcement channels simultaneously.
Strong transition line: "Kevin's ChatGPT upload was blocked at the network layer. But what if Kevin decides to bypass the network entirely? In Lab 7, Kevin tries two OS-level approaches — opening the file directly in Notepad++ and copying content via clipboard — neither of which generates network traffic. That is where Endpoint DLP takes over.."
If time permits, ask the group how they would handle a scenario where the same employee needs to legitimately upload a redacted version of the payroll report to an auditor portal. This opens the door to discussing allow-list policies, user justification workflows, and step-up authentication — all of which Zscaler supports.