drop endpoint dlp usb block log · parse device id + file hash + policy · runs locally
drop endpoint dlp usb block log · local only
heuristic screener · vendor schema varies · not definitive proof