How to Build a DLP Rule in Cato to Stop Data Leaks to ChatGPT, Claude & Gemini

Overview

To stop proprietary data reaching AI tools, build a DLP content profile containing the data types that define your sensitive content, then create a Data Control rule under the Application Control policy that targets the Generative AI Tools application category with that profile and an action of Block. Two things must be true first: TLS Inspection must be enabled for the AI traffic, and your account needs a DLP license on top of CASB. Without inspection the rule will never match, because Cato's DLP engine scans the decrypted HTTP payload — not the encrypted session.

Applies to

• Cato SASE Cloud, Cato Management Application (CMA), September 2026 navigation

• CASB license for the Application Control policy, plus a DLP license to enable Data Control rules within it

• TLS Inspection enabled for the traffic the rule will match

• Admin role with permission to edit Security policies, Data Types and Profiles

• Inline scanning limit: 50 MB per file

Before you start

• Enable TLS Inspection on GenAI traffic first. This is a hard dependency, not a recommendation — see enabling TLS inspection for GenAI traffic in Cato.

• Confirm QUIC and GQUIC are blocked in the Internet Firewall. QUIC cannot be TLS inspected, so any browser that negotiates it silently escapes DLP.

• Know which AI tools are actually in use — Resources > App Catalog and Security > GenAI Apps — so the rule covers real traffic.

• Decide in advance what "proprietary" means in your organisation. This is the part that takes longest, and it is not a Cato question.

Caution: A Block action on a broad content profile will stop legitimate work. Every rule in this article should run in Monitor for at least a week before you switch it to Block.

Why encryption and QUIC break DLP

Cato's DLP content scans are inline and proxy-based, operating on HTTP inspection of the decrypted payload. That produces two hard requirements and one common failure.

The engine needs the traffic decrypted, so TLS Inspection must cover it. It also needs the traffic to be HTTP — QUIC and GQUIC cannot be TLS inspected at all, which is why Cato's own troubleshooting guidance says to block those protocols. A Chrome session negotiating QUIC to an AI endpoint will bypass a correctly written DLP rule and produce no events, which reads exactly like a broken rule.

The third requirement is identification: the application has to be recognised. That depends on the client reaching the service by hostname rather than a direct IP, with DNS traffic visible to Cato.

Step 1 — Verify the prerequisites are actually in place

1. Go to Security > TLS Inspection and confirm inspection is enabled and that no bypass rule is catching your AI traffic.

2. Open Monitoring > Events, filter to the AI application, and check the TLS Inspection field. It must show 1. A value of 0 means the traffic is not being decrypted and no DLP rule will ever fire on it.

3. Confirm a firewall rule with event tracking enabled matches the traffic. DLP inspection depends on that match existing.

4. Confirm QUIC and GQUIC are blocked.

Do not proceed until the TLS Inspection field reads 1. Everything after this step depends on it.

Step 2 — Define what your proprietary data looks like

Predefined data types cover PII, financial data, access keys and legal content. They do not know what your source code, client names or internal document markers look like. That is what custom data types are for.

1. Go to Security > Data Types & Profiles and select the Data Types tab.

2. Click New and choose a matching method:

3. Set the Threshold — the minimum number of occurrences before the data type activates. For a dictionary, the threshold counts occurrences of any entry in it.

Thresholds are the single most useful control you have against false positives. One client name in a paragraph is normal. Forty in one upload is a customer list.

Note: If your organisation already classifies documents with Microsoft Purview sensitivity labels, start there. Matching an existing MIP label is more reliable than re-describing the same content as keywords, and it means classification stays in one place.

Step 3 — Build the content profile

1. Stay in Security > Data Types & Profiles and select the Content Profile tab.

2. Click New and name the profile — for example Proprietary - AI Upload Block.

3. Add the data types from Step 2, plus any predefined types you want in the same profile.

4. Enable OCR Scan if screenshots are a realistic leak path. Pasting a screenshot of a contract into an AI tool is common, and without OCR the image is just an image.

5. Click Apply, then Save.

Keep separate profiles for separate responses. A profile you intend to block on should be narrow and high-confidence; a profile for monitoring can be broad.

Step 4 — Create the Data Control rule

1. Go to Security > App & Data Inline. On older tenants this is Security > Security Configuration > App Control & Data Protection.

2. Create a new rule and name it — for example Block proprietary upload to GenAI.

3. Source: start with a pilot group, not Any.

4. Application: select the Generative AI Tools category, and add named applications — ChatGPT, Claude, Gemini and any others your App Catalog shows in use. Cato maintains eight system categories for AI apps in addition to the general Generative AI Tools category, so check whether your code-assistant traffic sits in a different one.

5. Activities: select upload and file-sharing activities. Leaving Activities empty matches every activity for that application, which is broader than you want for a Block rule.

6. Content Profile: select the profile from Step 3.

7. Action: set Monitor for now.

8. Apply and Save.

If your account was created after 25 March 2025, check the default recommended CASB/DLP policy before writing anything — rules 15 to 18 already monitor PII, financial data, access keys and legal data uploads to Generative AI Tools. Build on those rather than duplicating them.

Step 5 — Run in Monitor and read the events

Leave the rule in Monitor and let real traffic hit it.

1. Go to Monitoring > Events and apply the Apps Security preset filter. It surfaces the DLP profiles that were triggered, the matched data types and the file attributes.

2. For each violation, ask whether it is a real leak or a legitimate workflow. Legitimate workflows are the useful output of this stage — they tell you which teams need a sanctioned path before you close the unsanctioned one.

3. Tune thresholds and data types until the noise is gone.

A week of Monitor data is the minimum. Two is better if your month has a reporting cycle in it.

Step 6 — Switch to Block

1. Edit the rule and change the Action to Block.

2. Widen the Source from the pilot group to the full scope.

3. Save.

Consider whether to change the DLP service from its default fail-open behaviour to fail-closed, which blocks files that could not be scanned. Fail-closed is the stronger posture and the one that generates support tickets — decide deliberately rather than by default.

Verification

Test with a seeded file. Create a document containing enough of your custom data type to cross the threshold, upload it to one of the named AI tools from a machine in scope, and confirm the block. Then repeat with a clean file and confirm it goes through. Testing only the block half tells you nothing about false positives.

Check the event. In Monitoring > Events with the Apps Security preset, the violation should show the DLP profile name, the matched data types and the file attributes. Confirm the TLS Inspection field reads 1 on that same event.

Check the dashboard. Security > GenAI Apps has a Data Protection section showing Violations by Data Profile, Policy Violations Over Time and Top Users Sharing Sensitive Data. It requires the DLP license. This is where you will see whether the rule is doing anything over time.

Notes and common pitfalls

• Files over 50 MB are not scanned inline. The event shows a "Bypass By Size" verdict. Large archives are a known gap.

• Audio, video and binary files are not supported. Neither is any file type Cato cannot identify.

• CSV and TXT files lack magic headers, which makes type detection unreliable for exactly the format people export customer data into. Test these specifically.

• Pasted text is not the same as an uploaded file. File uploads are the dependable enforcement point. Whether typed or pasted prompt content triggers a content profile depends on how the application and its activities are detected. Test this in your own tenant before telling anyone the paste path is covered.

• Native desktop AI clients may pin certificates, which puts them outside TLS Inspection and therefore outside DLP. See fixing Cato TLS inspection application failures.

• Split-tunnelled traffic is never scanned. If AI domains are excluded in your split tunnel policy, no DLP rule will see them.

• Source code leaves by more than one route. A DLP rule on AI tools and controls on personal GitHub repositories address the same risk from different directions; closing one without the other moves the traffic rather than stopping it.

• Blocking without providing an alternative fails. If there is no sanctioned AI tool, people will find an unmonitored device. Pair the block with an approved tool on a corporate tenant.

FAQs

1) Do I need the DLP license, or is CASB enough?

The Application Control policy is included in the CASB license, but enabling Data Control rules within it also requires the DLP license. With CASB alone you can allow or block AI applications and their activities — block all uploads to unsanctioned AI tools, for example — but you cannot make the decision based on what is inside the file.

2) Why is my DLP rule not triggering on ChatGPT?

Work through it in this order: check the TLS Inspection field in the event reads 1; confirm QUIC and GQUIC are blocked; confirm the file is under 50 MB and of a supported type; confirm the application is being identified, which requires hostname access rather than a direct IP with DNS traffic visible to Cato; and last, check the content profile actually matches the file's content and threshold. In practice the first two account for most cases.

3) Can I block uploads to ChatGPT but allow our corporate AI tenant?

Yes. Put the sanctioned tool in an allow rule above the block rule, scoped by tenant where the application supports tenant-level control, and let the broader Generative AI Tools block rule catch everything below it. This is the pattern most organisations end up with — one approved path, everything else blocked.

4) How do I stop someone pasting text instead of uploading a file?

Partly. File uploads are the reliable control point; typed and pasted content depends on the application and activity detection, and you should verify the behaviour in your own tenant rather than assume it. Where paste cannot be reliably inspected, the practical controls are restricting which AI tools are reachable at all, and blocking personal-account access so usage stays on a tenant you can govern.