DeepSeek

1. 01DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.
2. 02Device telemetry names the exact machines and accounts reaching chat.deepseek.com. Use it to target coaching rather than blanket blocks.

• ▲Critical75DeepSeekNetwork2 people
• ◆High70DeepSeek: sensitive dataPurview DLP2 people
• ◆High62DeepSeekSIEM · Splunk (demo)1 person

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. endpoint_telemetry · Sep 12, 2026
   Defender for Endpoint saw DeepSeek on 2 devices (2 accounts) in 30 days: device connections to chat.deepseek.com
   Detail

   {
     "domains": [
       {
         "host": "chat.deepseek.com",
         "count": 2
       }
     ],
     "signals": {
       "network": 2,
       "process": 0,
       "software": 0,
       "extension": 0,
       "model_file": 0,
       "local_server": 0
     },
     "software": [],
     "processes": [],
     "extensions": [],
     "deviceNames": [
       "LT-MIA",
       "LT-NOAH"
     ]
   }

2. corroboration
   Also found by another lane (mdca:40311)
   Detail

   {
     "findingKey": "mdca:40311"
   }