Monitors and blocks classified content copied, uploaded, or synchronized to iCloud Drive storage on macOS devices. This feature prevents unauthorized exfiltration, tracks data movement to enforce corporate security policy compliance.

Trellix DLP Endpoint for macOS enforces protection only on files in an unsaved or draft state during iCloud Drive synchronization. The software does not intercept files already saved to the local device through this mechanism.

Benefits

• Prevent data exfiltration: Block unauthorized file transfers to iCloud Drive storage accounts to ensure corporate files remain in the organization

• Enforce compliance: Monitor data movement to track the movement of corporate files

Task

Create the iCloud Drive protection rule

1. In Trellix ePO, go to Menu → Data Protection → DLP Policy Manager.

2. Select the Rule Sets tab.

3. Open an existing rule set, or select Actions → New Rule Set.

4. Under Actions, select New Rule → Cloud Protection.

5. Enter a unique rule name and set the rule status to Enabled.

6. In the Enforce On section, select Trellix DLP Endpoint for Mac OS X to enforce the rule on macOS machines.

7. On the Condition tab:        

   1. Select the needed classifications or definitions.

   2. In the and top-level Subfolder name, specify the subfolder name. For more information, see section File interception behavior during iCloud synchronization.

   3. Select iCloud in the Cloud Service field.

8. (Optional) On the Exceptions tab, configure exceptions by selecting Actions → Add Rule Exception.

9. On the Reactions tab, configure the action for matching content (for example, Block, Block with Justification, or Monitor).

10. Select Save and then apply policy.

Apply policy changes

1. Go to Menu → Systems → System Tree.

2. Select the checkbox of one or more systems that you want to assign the policy to.

3. Click Wake Up Agents to push the policy to Trellix DLP endpoints immediately.
           The Wake Up Trellix Agent window opens.

4. Next to Wake-up call type, select whether to send an Agent Wake-Up Call or a
           SuperAgent Wake-Up Call.

5. Accept the default Randomization (0–60 minutes) or type a different value.
           If you type 0, agents respond immediately.

6. Click OK to send the wake-up call to the endpoints.

   Or, you can use the Break inheritance and assign the policy and settings below
   option to push the policy.

       For information, see Assign and push a policy to a system.

File interception behavior during iCloud Drive
synchronization

Trellix DLP Endpoint for macOS monitors files syncing to iCloud Drive based on their save state
and directory location.

iCloud application synchronization enables seamless cross-device collaboration. Trellix DLP
Endpoint evaluates and enforces policies on these files differently depending on whether an
item is an unsaved draft or a saved local file.

Unsaved drafts versus local file states

• Draft and unsaved files: When a user creates a new document in an iCloud-enabled app with syncing turned on, the app automatically places an untitled draft in its iCloud Drive container before the user explicitly saves it locally. As iCloud attempts to synchronize this draft across devices, Trellix DLP Endpoint inspects the content. If classified or sensitive data is detected, the agent intercepts the synchronization and enforces the configured policy action (such as blocking or quarantine).

• Local file saves: If a document is saved strictly to a local directory outside the iCloud Drive hierarchy, it does not traverse the iCloud sync pipeline. Consequently, it remains outside the scope of iCloud-specific protection rules.

Configuring iCloud sync subfolder paths

To apply DLP protection rules to iCloud synchronization workflows, configure the designated subfolder paths as outlined below.

User-created subfolders in iCloud Drive

For custom subfolders created directly in the root of iCloud Drive, use the following directory format:

None~/Library/Mobile Documents/com~apple~CloudDocs/<MySubFolder>/

Application-specific iCloud sync folders

iCloud-compatible macOS apps generate dedicated default containers inside ~/Library/Mobile Documents/. Typical system paths include:

• Numbers: ~/Library/Mobile Documents/com~apple~Numbers/Documents

• Pages: ~/Library/Mobile Documents/com~apple~Pages/Documents

Important: When defining DLP rules for application-specific sync paths, the path must point to a user-created subfolder within the app's directory, rather than the root app container itself.

• Correct: ~/Library/Mobile Documents/com~apple~Numbers/MySubFolder/
  (Targets the user-created subfolder within the app container.)

• Incorrect: ~/Library/Mobile Documents/com~apple~Numbers/
  (Targeting the base container directly will prevent the rule from triggering as expected.)