Sensitive content can be defined based on where it is located (stored) or where it is used (file extension or application).
Trellix DLP Endpoint - SaaS uses several methods to locate and classify sensitive content. Data-at-rest is the term used to describe file locations. It classifies content by asking questions like "where is it in the network?" or "which folder is it in?" Data-in-use is the term used to define content by how or where it is used. It classifies content by asking questions like "which application called it?" or "what is the file extension?"
Trellix DLP Endpoint - SaaS Discovery rules find your data-at-rest. They can search for content in endpoint computer files or email storage (PST, mapped PST, and OST) files. Depending on the properties, applications, or locations in the rule classification, the rule can search specified storage locations and apply reactions. The files can be tagged or classified to control how they are used.