Abstract: Techniques presented herein describe data loss prevention (DLP) methods for saving a file to a destination over a network via an application, such as a productivity application having such features. A DLP agent injects components to the productivity application intercept save operations initiated by a user. When the user initiates a save operation for a file, the components suspend the operation and store a current version of the file (including unsaved file data) in a temporary location accessible to the DLP agent on disk. The DLP agent evaluates the current version of the file and file destination based on network and security policies to determine whether to allow or block the save operation.

Abstract: Systems and methods for Zero-day Data Loss Protection (DLP) having enhanced file upload processing are provided. One method may include capturing and sending file upload context (e.g. folder name, metadata, an active URL, etc.) associated with the scheduled file or folder upload to a DLP filesystem driver. For example, the method may include detecting whether a single/multi-file upload, a folder upload, or a drag-and-drop operation exists, through interception of the shell dialog API, the browse folder API, or the drop process interface, respectively. Further, the method may include generating a file upload cache including the file upload context, prior classification entries, and a timestamp indicating when the scheduled file or folder upload was last modified; such that, the DLP filesystem driver may intercept and process the file open call based upon the file upload cache. Accordingly, the file may be processed in accordance with a prior file classification, file/domain filter, or DLP policy.