Create endpoint applications - Administrator Guide - Cortex - Cortex XDR - Cortex - Security Operations

An effective data loss prevention (DLP) system allows an organization to define specific applications as sensitive. This enables the system to monitor and control the transmission of critical information, preventing its unauthorized release.

When creating a data-in-motion rule, you can provide the source of the sensitive data and must provide the intended destination. For the source and destination for the data-in-motion rule, you must select the relevant application groups ( custom local application group). The application groups are comprised of predefined endpoint applications as defined by Palo Alto (local application).

Predefined applications are indicated by Created by: Palo Alto Networks in the All Applications table. For predefined, you do not see the details such as URLS/Domains, Process names, Signers. You cannot edit or delete these applications.

The user can only create a Custom Web Application.

Endpoint application type:

After creating the application, you can select them from the application groups.