Patent ID: 9230096
Filing Date: 2016-01-05
CPC Classification: G06F

Claim Text:
1. A method comprising: identifying, by a data loss prevention (DLP) manager, a startup event of a guest virtual machine, wherein the DLP manager is in a security virtual machine; installing, by the DLP manager, a DLP component in the guest virtual machine, the DLP component to communicate with the DLP manager; receiving, by the DLP manager, a file system event that is intercepted by the DLP component and that is initiated within the guest virtual machine, wherein the file system event comprises a file in at least one of a write event, a copy event, a paste event, a move event, or a deletion event, and wherein the file is not stored in the security virtual machine; retrieving, by the DLP manager, a DLP profile associated with the guest virtual machine from a profile repository, the DLP profile comprising a DLP policy and a response rule; identifying, by the DLP manager, a device associated with the file system event; determining, by the DLP manager, that the DLP profile requires monitoring of the identified device; monitoring, by the DLP manager, data associated with the file system event that is to be stored on the identified device; and enforcing, by the DLP manager, the response rule associated with the file system event initiated within the guest virtual machine when the file system event violates the DLP policy.