Claude: sensitive data

1. 01Claude trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 02Every match was blocked. The control is working; keep the policy and use these events to target awareness at the 1 person involved.

• ●Medium38ClaudeNetwork3 people
• ●Medium43ClaudeEmail1 person
• ●Medium40ClaudeSIEM · Splunk (demo)1 person
• ●Medium41ClaudeCode · GitHub (demo)0 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. dlp_activity · Sep 6, 2026
   2 DLP events for Claude by 1 person in 30 days: 2 blocked, 0 warned, 0 overridden, 0 audit only; types: Email Address, All Full Names
   Detail

   {
     "domains": [
       {
         "count": 2,
         "domain": "claude.ai"
       }
     ],
     "byAction": {
       "warn": 0,
       "audit": 0,
       "block": 2,
       "unknown": 0,
       "override": 0
     },
     "policies": [
       {
         "name": "Endpoint DLP - Confidential",
         "count": 2
       }
     ],
     "applications": [
       {
         "count": 2,
         "application": "chrome.exe"
       }
     ],
     "sensitiveTypes": [
       {
         "name": "Email Address",
         "count": 1,
         "matches": 25
       },
       {
         "name": "All Full Names",
         "count": 1,
         "matches": 8
       }
     ]
   }

2. dlp_block · Aug 30, 2026
   FileUploadedToCloud 'board-deck-draft.pptx' to claude.ai by [email protected]: All Full Names ×8 (block)
   Detail

   {
     "policies": [
       "Endpoint DLP - Confidential"
     ],
     "recordId": "ual-0105",
     "application": "chrome.exe"
   }

3. dlp_block · Sep 6, 2026
   TextPastedToBrowser to claude.ai by [email protected]: Email Address ×25 (block)
   Detail

   {
     "policies": [
       "Endpoint DLP - Confidential"
     ],
     "recordId": "ual-0106",
     "application": "chrome.exe"
   }

4. corroboration
   Also found by another lane (mdca:34211)
   Detail

   {
     "findingKey": "mdca:34211"
   }

5. corroboration
   Also found by another lane (mail:anthropic-claude)
   Detail

   {
     "findingKey": "mail:anthropic-claude"
   }