Deploy Endpoint DLP with Defender XDR Integration

# ---------------------------------------------------------
# WHAT: Verify MDE onboarding status and Endpoint DLP readiness
# WHY:  Endpoint DLP requires a healthy MDE sensor on each device.
#       If devices aren't onboarded or the sensor is inactive,
#       DLP policies won't monitor file activities on those endpoints.
# ---------------------------------------------------------

# Check if the MDE service (Sense) is running on the local device
# OUTPUT: Status=Running means the MDE sensor is active
Get-Service -Name "Sense" | Select-Object Name, Status, StartType

# Verify MDE onboarding state via registry
# OUTPUT: OnboardingState=1 means fully onboarded to MDE
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status"
Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue |
    Select-Object OnboardingState, OrgId, LastConnected

# Check Endpoint DLP capability via DLP-specific registry key
# OUTPUT: If present, confirms Endpoint DLP feature is enabled
$dlpPath = "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\DLP"
if (Test-Path $dlpPath) {
    Get-ItemProperty -Path $dlpPath
    Write-Host "Endpoint DLP is enabled on this device." -ForegroundColor Green
} else {
    Write-Host "Endpoint DLP registry key not found - verify licensing and policy." -ForegroundColor Yellow
}

# Bulk check: query all devices in a target OU for MDE sensor status
# WHY: Before rolling out DLP, confirm fleet-wide MDE onboarding
$computers = Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=contoso,DC=com"
foreach ($pc in $computers) {
    $status = Invoke-Command -ComputerName $pc.Name -ScriptBlock {
        $svc = Get-Service -Name "Sense" -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Computer = $env:COMPUTERNAME
            SenseRunning = ($svc.Status -eq 'Running')
            OSVersion = [System.Environment]::OSVersion.Version.ToString()
        }
    } -ErrorAction SilentlyContinue
    $status
} | Format-Table -AutoSize

# ---------------------------------------------------------
# WHAT: Configure Endpoint DLP global settings via PowerShell
# WHY:  These settings apply to ALL Endpoint DLP policies and define
#       which apps, browsers, and paths are restricted or excluded.
#       Setting these before creating policies avoids conflicts.
# PREREQ: Connect-IPPSSession (Security & Compliance PowerShell)
# ---------------------------------------------------------

# Connect to Security & Compliance PowerShell
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Add unallowed apps - these apps will be blocked from accessing
# files that match DLP policies on endpoints
# WHY: Personal cloud storage apps are common data exfiltration vectors
Set-PolicyConfig -EndpointDlpGlobalSetting -Setting UnallowedApp `
    -Value @(
        @{Value = "dropbox.exe"; DisplayName = "Dropbox"},
        @{Value = "googledrivesync.exe"; DisplayName = "Google Drive"},
        @{Value = "iclouddrv.exe"; DisplayName = "Apple iCloud Drive"},
        @{Value = "megasync.exe"; DisplayName = "MEGA Sync"}
    )

# Add unallowed Bluetooth apps
# WHY: Bluetooth transfers can bypass network DLP controls entirely
Set-PolicyConfig -EndpointDlpGlobalSetting -Setting UnallowedBluetoothApp `
    -Value @(
        @{Value = "fsquirt.exe"; DisplayName = "Bluetooth File Transfer"}
    )

# Configure browser and domain restrictions
# WHY: Monitor or block paste of sensitive data into unsanctioned web apps
Set-PolicyConfig -EndpointDlpGlobalSetting -Setting UnallowedBrowser `
    -Value @(
        @{Value = "chrome.exe"; DisplayName = "Google Chrome (unmanaged)"}
    )

# Add file path exclusions for legitimate business processes
# WHY: Backup agents and system processes generate false positives
Set-PolicyConfig -EndpointDlpGlobalSetting -Setting FilePathExclusion `
    -Value @(
        "C:\Windows\",
        "C:\Program Files\BackupAgent\",
        "C:\ProgramData\Microsoft\Windows Defender\"
    )

# ---------------------------------------------------------
# WHAT: Create an Endpoint DLP policy for financial data protection
# WHY:  Policies define what sensitive data to detect and how endpoint
#       activities are controlled (block, warn, audit). Scoping to
#       "Devices" ensures only on-device actions are monitored.
# PREREQ: Connect-IPPSSession
# ---------------------------------------------------------

# Step 1: Create the DLP compliance policy scoped to Devices
# The -EndpointDlpLocation "All" targets all onboarded endpoints
New-DlpCompliancePolicy -Name "Protect Financial Data on Endpoints" `
    -Comment "Blocks USB and cloud upload of financial data; audits print and clipboard" `
    -EndpointDlpLocation "All" `
    -Mode "Enable"

# Step 2: Create a compliance rule with sensitive information types
# and activity-specific enforcement actions
New-DlpComplianceRule -Name "Block Financial Data Exfiltration" `
    -Policy "Protect Financial Data on Endpoints" `
    -ContentContainsSensitiveInformation @(
        @{Name = "Credit Card Number"; minCount = 1},
        @{Name = "U.S. Bank Account Number"; minCount = 1},
        @{Name = "ABA Routing Number"; minCount = 1}
    ) `
    -EndpointDlpRestrictions @(
        @{Setting = "CopyToRemovableMedia"; Value = "Block"},
        @{Setting = "CloudAppEgress"; Value = "Block"},
        @{Setting = "Print"; Value = "Audit"},
        @{Setting = "CopyToClipboard"; Value = "Audit"},
        @{Setting = "BluetoothTransfer"; Value = "Block"}
    ) `
    -NotifyUser "SiteAdmin" `
    -NotifyUserType "NotifyOnly" `
    -GenerateIncidentReport "SiteAdmin"

# Verify the policy was created successfully
Get-DlpCompliancePolicy -Identity "Protect Financial Data on Endpoints" |
    Format-List Name, Mode, EndpointDlpLocation, IsValid

# ---------------------------------------------------------
# WHAT: Create tiered enforcement rules per activity and sensitivity level
# WHY:  A single policy can contain multiple rules, each targeting
#       different sensitivity levels with appropriate enforcement.
#       This allows strict protection for top-secret data and
#       lighter controls for general confidential content.
# ---------------------------------------------------------

# Rule for Highly Confidential data - strictest enforcement
# Block USB, cloud, Bluetooth, and unallowed app access with NO override
New-DlpComplianceRule -Name "Highly Confidential - Block All Exfiltration" `
    -Policy "Protect Financial Data on Endpoints" `
    -ContentContainsSensitiveInformation @(
        @{Name = "Credit Card Number"; minCount = 5},
        @{Name = "U.S. Bank Account Number"; minCount = 3}
    ) `
    -EndpointDlpRestrictions @(
        @{Setting = "CopyToRemovableMedia"; Value = "Block"},
        @{Setting = "CloudAppEgress"; Value = "Block"},
        @{Setting = "Print"; Value = "Warn"},
        @{Setting = "CopyToClipboard"; Value = "Warn"},
        @{Setting = "BluetoothTransfer"; Value = "Block"},
        @{Setting = "UnallowedApp"; Value = "Block"}
    ) `
    -BlockAccess $true `
    -BlockAccessScope "All"

# Rule for Confidential data - allow override with business justification
# WHY: Some workflows legitimately require USB transfer of confidential data
Set-DlpComplianceRule -Identity "Block Financial Data Exfiltration" `
    -EndpointDlpRestrictions @(
        @{Setting = "CopyToRemovableMedia"; Value = "Warn"},
        @{Setting = "CloudAppEgress"; Value = "Block"},
        @{Setting = "Print"; Value = "Audit"},
        @{Setting = "CopyToClipboard"; Value = "Audit"},
        @{Setting = "BluetoothTransfer"; Value = "Warn"}
    ) `
    -NotifyUser "SiteAdmin" `
    -NotifyUserType "NotifyOnly"

# Verify all rules under the policy
Get-DlpComplianceRule -Policy "Protect Financial Data on Endpoints" |
    Format-Table Name, @{N='Priority';E={$_.Priority}}, IsValid -AutoSize

# ---------------------------------------------------------
# WHAT: Create a test file with synthetic sensitive data to trigger DLP
# WHY:  You need realistic test data to validate that endpoint DLP
#       policies detect sensitive content and enforce the correct action.
#       Use well-known test credit card numbers (Luhn-valid but not real).
# IMPORTANT: Only run this on designated test devices in your pilot group.
# ---------------------------------------------------------

# Create a test directory for DLP validation
$testPath = "$env:USERPROFILE\Desktop\DLP-Test"
New-Item -Path $testPath -ItemType Directory -Force | Out-Null

# Generate a test file with synthetic financial data
# WHY: These are Luhn-valid test card numbers that DLP classifiers detect
#      but are not real financial instruments (widely used for testing)
$testContent = @"
=== CONFIDENTIAL FINANCIAL REPORT ===
Date: $(Get-Date -Format 'yyyy-MM-dd')

Customer: Test Account
Credit Card: 4111-1111-1111-1111
Credit Card: 5500-0000-0000-0004
Credit Card: 3400-0000-0000-009
Bank Account: 123456789
ABA Routing: 021000021
SSN: 078-05-1120

Total Balance: 45,230.00
=== END CONFIDENTIAL REPORT ===
"@

$testContent | Out-File -FilePath "$testPath\Financial-Report-Test.txt" -Encoding UTF8
Write-Host "Test file created: $testPath\Financial-Report-Test.txt" -ForegroundColor Cyan

# Manual testing instructions:
Write-Host "`nManual testing checklist:" -ForegroundColor Yellow
Write-Host "1. Insert a USB drive and copy the test file - expect BLOCK" -ForegroundColor White
Write-Host "2. Open the file and press Ctrl+P - expect WARN/AUDIT" -ForegroundColor White
Write-Host "3. Drag the file to a Dropbox/Google Drive folder - expect BLOCK" -ForegroundColor White
Write-Host "4. Copy file contents and paste into a browser - expect AUDIT" -ForegroundColor White
Write-Host "5. Check Activity Explorer in 15-30 minutes for events" -ForegroundColor White

// ---------------------------------------------------------
// WHAT: Hunt for Endpoint DLP alerts in the Defender XDR portal
// WHY:  The AlertInfo table centralizes all DLP alerts alongside
//       endpoint and identity signals. Cross-referencing with
//       DeviceEvents reveals the full chain of user actions that
//       preceded and followed the DLP violation.
// WHERE: Advanced Hunting in security.microsoft.com
// ---------------------------------------------------------

// Query 1: All DLP alerts from the last 7 days
// Shows alert title, severity, device, and the specific DLP policy triggered
AlertInfo
| where Timestamp > ago(7d)
| where ServiceSource == "Microsoft Data Loss Prevention"
| join kind=inner AlertEvidence on AlertId
| where EntityType == "Machine" or EntityType == "User"
| project Timestamp, AlertId, Title, Severity,
          DeviceName, AccountUpn,
          Category, DetectionSource
| order by Timestamp desc

// Query 2: Endpoint DLP activity events from DeviceEvents
// WHY: DeviceEvents captures the raw endpoint activity (USB copy,
//      print, clipboard, cloud upload) before it becomes an alert
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Dlp"
| summarize EventCount = count() by ActionType, DeviceName, bin(Timestamp, 1d)
| order by EventCount desc

// Query 3: Top devices triggering DLP events
// WHY: Identifies devices that may need additional user training
//      or represent genuine data exfiltration attempts
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Dlp"
| summarize TotalEvents = count(),
            BlockEvents = countif(ActionType contains "Blocked"),
            AuditEvents = countif(ActionType contains "Audited")
    by DeviceName
| order by TotalEvents desc
| take 20

// ---------------------------------------------------------
// WHAT: Investigate a DLP incident with full identity correlation
// WHY:  A single DLP alert may be accidental - but combined with
//       unusual sign-in patterns, risky app usage, or mass file
//       access, it can indicate insider threat or compromised account.
// ---------------------------------------------------------

// Query 1: Full user activity timeline around a DLP incident
// Replace "user@contoso.com" with the actual user from the alert
let targetUser = "user@contoso.com";
let incidentTime = datetime(2026-03-10T14:00:00Z);
// Device activity: file operations, process launches, network connections
DeviceEvents
| where Timestamp between ((incidentTime - 1h) .. (incidentTime + 1h))
| where AccountUpn =~ targetUser
| project Timestamp, ActionType, FileName, FolderPath,
          RemoteUrl, DeviceName
| order by Timestamp asc

// Query 2: Check for repeat DLP violations by the same user
// WHY: Repeat offenders may need targeted training or investigation
AlertInfo
| where Timestamp > ago(90d)
| where ServiceSource == "Microsoft Data Loss Prevention"
| join kind=inner AlertEvidence on AlertId
| where AccountUpn =~ "user@contoso.com"
| summarize IncidentCount = dcount(AlertId),
            DistinctPolicies = make_set(Title),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
    by AccountUpn
| extend DaysBetween = datetime_diff('day', LastSeen, FirstSeen)

// Query 3: Correlate DLP events with identity risk signals
// WHY: A DLP violation from a user with a risky sign-in is higher severity
AlertInfo
| where Timestamp > ago(7d)
| where ServiceSource == "Microsoft Data Loss Prevention"
| join kind=inner AlertEvidence on AlertId
| where EntityType == "User"
| join kind=leftouter (
    AADSignInEventsBeta
    | where Timestamp > ago(7d)
    | where RiskLevelDuringSignIn in ("high", "medium")
    | project AccountUpn = UserPrincipalName, RiskLevel = RiskLevelDuringSignIn,
              SignInTime = Timestamp, IPAddress, Country
) on AccountUpn
| where isnotempty(RiskLevel)
| project Timestamp, Title, AccountUpn, RiskLevel, IPAddress, Country

// ---------------------------------------------------------
// WHAT: Analyze Endpoint DLP match trends for reporting
// WHY:  Trend analysis reveals whether DLP policies are effective,
//       if specific teams need training, and whether false positive
//       rates are acceptable. This data feeds executive dashboards.
// ---------------------------------------------------------

// Query 1: Daily DLP event trend - block vs audit vs override
// WHY: Shows whether enforcement is increasing or decreasing over time
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Dlp"
| extend EventCategory = case(
    ActionType contains "Blocked", "Blocked",
    ActionType contains "Audited", "Audited",
    ActionType contains "Warned", "Warned",
    "Other")
| summarize EventCount = count() by EventCategory, bin(Timestamp, 1d)
| order by Timestamp asc
| render timechart

// Query 2: Top sensitive information types triggering DLP
// WHY: Identifies which data types are most at risk on endpoints
AlertInfo
| where Timestamp > ago(30d)
| where ServiceSource == "Microsoft Data Loss Prevention"
| join kind=inner AlertEvidence on AlertId
| where EntityType == "File"
| extend SensitiveType = tostring(parse_json(AdditionalFields).SensitiveInformationType)
| summarize MatchCount = count() by SensitiveType
| order by MatchCount desc
| take 10

// Query 3: Department-level DLP summary for compliance reporting
// WHY: Compliance teams need per-department breakdowns to demonstrate
//      policy effectiveness and identify training gaps
AlertInfo
| where Timestamp > ago(30d)
| where ServiceSource == "Microsoft Data Loss Prevention"
| join kind=inner AlertEvidence on AlertId
| where EntityType == "User"
| extend Department = tostring(parse_json(AdditionalFields).Department)
| summarize TotalAlerts = count(),
            HighSeverity = countif(Severity == "High"),
            MediumSeverity = countif(Severity == "Medium")
    by Department
| order by TotalAlerts desc

# ---------------------------------------------------------
# WHAT: Tune DLP compliance rules to reduce false positives
# WHY:  Initial deployment often catches legitimate workflows.
#       Tuning thresholds and adding exceptions balances security
#       with productivity - reducing user friction improves adoption.
# PREREQ: Connect-IPPSSession
# ---------------------------------------------------------

# Increase the minimum instance count for credit card detection
# WHY: A single credit card number in a file is often a false positive
#      (e.g., test data, personal expense reports). Requiring 5+
#      instances targets bulk financial data movement.
Set-DlpComplianceRule -Identity "Block Financial Data Exfiltration" `
    -ContentContainsSensitiveInformation @(
        @{Name = "Credit Card Number"; minCount = 5; maxCount = -1},
        @{Name = "U.S. Bank Account Number"; minCount = 2; maxCount = -1},
        @{Name = "ABA Routing Number"; minCount = 1; maxCount = -1}
    )

# Add file path exclusions for the finance team's approved workflow
# WHY: The finance team legitimately transfers financial data to
#      an approved encrypted USB drive for quarterly audits
Set-DlpComplianceRule -Identity "Block Financial Data Exfiltration" `
    -ExceptIfContentPropertyContainsWords @("Document.Department:Finance") `
    -ExceptIfFrom "FinanceTeam@contoso.com"

# Change USB enforcement from Block to Warn for Confidential data
# WHY: Blocking all USB transfers caused too many support escalations;
#      Warn with override provides a balance of security and productivity
Set-DlpComplianceRule -Identity "Block Financial Data Exfiltration" `
    -EndpointDlpRestrictions @(
        @{Setting = "CopyToRemovableMedia"; Value = "Warn"},
        @{Setting = "CloudAppEgress"; Value = "Block"},
        @{Setting = "Print"; Value = "Audit"},
        @{Setting = "CopyToClipboard"; Value = "Audit"},
        @{Setting = "BluetoothTransfer"; Value = "Block"}
    )

# Review all current rules and their exception configuration
Get-DlpComplianceRule -Policy "Protect Financial Data on Endpoints" |
    Select-Object Name, ExceptIfFrom, ExceptIfContentPropertyContainsWords,
    ContentContainsSensitiveInformation |
    Format-List