OEM knowledge base
What DLPST knows about each vendor, exactly as collected from the vendor's own website and documentation - every line links to its source. Items that could not be verified on an official page are listed separately and are never used as facts.
Symantec (Broadcom)
Symantec DLP 26.1 with Enforce, detection servers, cloud detectors, CloudSOC CASB and DSPM · research date 2026-09-18
Products
| Product | Category | Delivery | Description | Source |
|---|---|---|---|---|
| Symantec DLP Core | DLP suite (endpoint, network, storage) | on-prem, iaas (AWS/Azure/Oracle Cloud), virtual appliance | One of two DLP solution sets. Includes protection for endpoints, network and storage, plus Sensitive Image Recognition and Information Centric Analytics (UEBA) per the 2026 product brief. Centrally managed by the on-prem Enforce Server (Enforce Platform). | docs.broadcom.com |
| Symantec DLP Cloud | Cloud-delivered DLP (CASB + cloud detectors for web and email) | saas, hybrid (policies managed by on-prem Enforce or in CloudSOC) | Extends DLP policies to cloud environments with full CASB controls (CloudSOC) plus DLP cloud connectors for web (Cloud SWG) and email gateways. Includes the Cloud Detection Service and Cloud Service for Email. | docs.broadcom.com |
| Enforce Server / Enforce Platform | Management console | on-prem, iaas | Central management platform: policy authoring and deployment, incident remediation and workflow, reporting, system administration. Always provided regardless of modules deployed. Only one Enforce Server can be active per deployment. | techdocs.broadcom.com |
| DLP Endpoint Prevent | Endpoint DLP (data in use) | on-prem agent + Endpoint Server | Agent-based monitoring and blocking on Windows and macOS: removable media, CD/DVD, clipboard, email, HTTP/HTTPS, FTP, IM, network shares, print/fax, application file access, cloud storage sync apps. | techdocs.broadcom.com |
| DLP Endpoint Discover | Endpoint data-at-rest discovery | on-prem agent + Endpoint Server | Scans endpoint local drives for sensitive data; each agent scans ~5 GB/hr; can quarantine locally or to network. Only Endpoint Discover capabilities are supported on the Linux agent. | techdocs.broadcom.com |
| DLP Network Monitor | Passive network DLP | on-prem server on SPAN/TAP | Captures and analyzes network traffic (SMTP, FTP, HTTP, IM, custom protocols) via SPAN or network tap with NIC or Napatech high-speed capture cards. | techdocs.broadcom.com |
| DLP Network Prevent for Email | Inline email DLP (MTA-integrated) | on-prem, iaas, hosted | In-line SMTP email management with standard MTAs and hosted email services; blocks, reroutes or tags messages; TLS supported. | techdocs.broadcom.com |
| DLP Network Prevent for Web | Inline web DLP (ICAP) | on-prem, iaas | Integrates with HTTP/HTTPS/FTP proxies via ICAP (RFC 3507, REQMOD/RESPMOD, Secure ICAP); ProxySG recommended/tested. | techdocs.broadcom.com |
| DLP Network Discover / Network Protect (DLP for Storage) | Data-at-rest discovery and remediation | on-prem server or Network Discover cluster, iaas | Scans file shares (SMB/NFS/DFS), SharePoint, Exchange, Domino, SQL databases, PST; Network Protect adds quarantine/copy/restore/MPIP labeling on top of Discover (no separate server). High Speed Discovery via Network Discover clusters. | techdocs.broadcom.com |
| DLP API Detection Server | REST content inspection for on-prem apps | on-prem, iaas | Detection REST API 2.0 endpoint that on-prem applications submit content to for inspection; replaces the DLP REST API appliance. | techdocs.broadcom.com |
| DLP Cloud Detection Service (CDS) | Hosted detection (CASB REST detector, Cloud SWG detector) | saas (Symantec-managed), hybrid with on-prem Enforce | Symantec-hosted detectors that inspect content from CloudSOC (CASB) and Cloud SWG; managed from on-prem Enforce or from CloudSOC (Cloud Management SaaS). Cloud SWG is purchased separately. | techdocs.broadcom.com |
| DLP Cloud Service for Email | Hosted email DLP | saas, hybrid | Cloud detector for outbound mail from on-prem Exchange, Microsoft 365 Exchange Online or Google Workspace Gmail; delivery via Symantec Email Security.cloud or M365/Gmail reflect mode. | techdocs.broadcom.com |
| Symantec CloudSOC CASB | CASB (API Securlets + inline Gatelets), Shadow IT audit | saas (US and EU tenants) | Securlets (API connectors, data-at-rest) for AWS, Azure, Box, Google Workspace, Office 365, Salesforce, ServiceNow, Slack; Gatelets for data in motion; Audit/Shadow IT; Risk Analytics; can host Cloud Managed DLP. | techdocs.broadcom.com |
| Symantec CloudSOC Data Security Posture Management (DSPM) | DSPM | saas | Component of the CloudSOC Data Security Platform: data catalog, classifications, tags, insights and dashboard built from Securlet DAR scans and Cloud Managed DLP endpoint scans. Requires an active Cloud DLP REST detector. | techdocs.broadcom.com |
| Cloud Managed DLP Endpoint | SaaS-managed endpoint DLP | saas (CloudSOC console) | Same DLP Agent technology as on-prem, managed through CloudSOC; Windows/macOS; supports endpoint DSPM scans. | techdocs.broadcom.com |
| Symantec Information Centric Analytics (ICA) | UEBA / user risk scoring | on-prem | ICA 6.6 required for User Risk based detection in DLP; provided with DLP Core per product brief. | techdocs.broadcom.com |
| Symantec Cloud SWG / ProxySG (related, separate) | Secure web gateway | saas, on-prem appliance | Separate Symantec web gateway products that integrate with DLP (ICAP for ProxySG; Cloud Detection Service for Cloud SWG). Cloud SWG is purchased separately. | techdocs.broadcom.com |
Architecture components & published requirements
| Component | Role | Minimum | Recommended | Capacity | Source |
|---|---|---|---|---|---|
| Enforce ServerWindows or RHEL server (physical, Type-1 hypervisor VM, AWS/Azure/Oracle Cloud) | Central management: policy authoring/deployment, incident persistence to Oracle, remediation, reporting, REST APIs. Services: DLP Manager, Detection Server Controller, Incident Persister, Notifier, Detector Service. | 4 cores / 8 GB RAM / 500 GB disk - Minimum supported: 4-core CPU, 8 GB RAM (DLP Manager min 2 GB, Detection Server Controller min 1 GB, Incident Persister min 2 GB; Notifier 1 GB/min 256 MB), 500 GB disk, 1 Gb/100 Mb NIC. Default content size for detection 30 MB. | 16 cores / 128 GB RAM / 1000 GB disk - Large installation: 16-core CPU, 128 GB RAM (Manager 24 GB, Detector Service 24 GB, Incident Persister 24 GB, Notifier 1 GB), 1 TB SSD or SAN, 1 Gb NIC. | Small: 10 users/10 detection servers; Medium: 20/50; Large: 30/100+ Enforce Server users / detection servers managed (sample tiers)Increase DLP Manager Max Memory from 2048 MB to 4096 MB if >50 policies, >50 detection servers or >50,000 agents (https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/pdf/symantec-security-software/information-security/data-loss-prevention/symantec-data-loss-prevention-help-center-26-1.pdf (section: Increase the Max Memory)). | techdocs.broadcom.com |
| Oracle database (incident/config DB)Dedicated Oracle server (three-tier, recommended for medium/large) or co-located with Enforce (two-tier); Amazon RDS for Oracle supported on AWS; dedicated Azure VM on Azure | Stores policies, configuration and incidents (incident data is the largest consumer of space). Two-tier (same host as Enforce) or three-tier (dedicated DB server). | 2 cores / 8 GB RAM / 500 GB disk - Small installation: 2-core CPU, 8 GB RAM, 500 GB-1 TB disk. | 6 cores / 32 GB RAM / 2048 GB disk - Large installation: 6-core CPU, 32 GB RAM (pga_aggregate_limit 4 GB, sga_target 24 GB, memory_target=0 / AMM disabled), 2 TB-32 TB disk. | Small 10,000/day; Medium 50,000/day; Large 100,000/day Daily incident volume (sample tiers)Incident Counter default threshold 1,000,000 stored incidents (system event 2316); disk depends on number of policies, attachment storage and retention. Incident attachments can be stored externally on a file system to save DB space. | techdocs.broadcom.com |
| Network Monitor ServerWindows or RHEL detection server; physical or Type-1 VM (capture cards via PCI passthrough) | Passive capture and analysis of network traffic from SPAN/TAP. | 4 cores / 12 GB RAM / 140 GB disk - Small: 4-core, 12 GB (Detector 8-10 GB, Enforce Connector 2 GB), 140 GB, 1 NIC to Enforce + 1 generic capture NIC. | 8 cores / 32 GB RAM / 140 GB disk - Large: 8-core, 32 GB (Detector 28-30 GB, Enforce Connector 2 GB), 140 GB, Napatech high-speed packet capture card. | Windows native capture 300; Linux native capture 650; Napatech NT4E/NT40A01 900 x 4 capture interfaces Supported pre-filter bandwidth per server (Mbps)Test HW: 2x quad-core Xeon E5620, 16 GB RAM, single IDM policy; add servers as traffic grows; estimates assume equal load and no redundancy. | techdocs.broadcom.com |
| Network Prevent for Email ServerWindows/RHEL detection server, on-prem or AWS/Azure/Oracle Cloud; commonly N:N paired with MTAs behind load balancing | Inline SMTP MTA-integrated inspection (forwarding or reflecting mode) with block/reroute/tag; TLS. | 4 cores / 12 GB RAM / 140 GB disk - Small detection-server profile (Network Prevent/Discover/Cloud Prevent for Email/Endpoint/API): 4-core, 12 GB (Detector 8-10 GB, Enforce Connector 2 GB), 140 GB. | 8 cores / 32 GB RAM / 140 GB disk - Large detection-server profile: 8-core, 32 GB (Detector 28-30 GB). | 88 msg/s (~316,800 msg/hour derived) at 0.26 s latency on an 8-core VM with 8 message chains, 5 GB EDM index, TLS Messages per second per serverSizing table: 70 and 80 msg/s each need 1x 8-CPU physical server or 1x 8-CPU VM or 1x 16-CPU VM; scales linearly; CPU-bound; keep CPU <=90%; tested with 139 policies, 70 KB avg message; no redundancy included. | techdocs.broadcom.com |
| Network Prevent for Web ServerWindows/RHEL detection server paired with ICAP proxy (ProxySG recommended); on-prem or AWS/Azure | ICAP server for proxies (REQMOD/RESPMOD); blocks requests or removes HTML content. | 4 cores / 12 GB RAM / 140 GB disk - Small detection-server profile. | 8 cores / 32 GB RAM / 140 GB disk - Large detection-server profile. | Small dataset (6.6 KB avg) 10 Mbps @83 ms; Medium (220 KB) 47 Mbps @628 ms; Large (2.03 MB) 207 Mbps @1167 ms HTTP throughput per 8 vCPU server (AWS m4.2xlarge, 32 GB, 16 connections, 139 policies)Sizing (medium profile): 64 Mbps = 1x 8 vCPU; 128 Mbps = 2x 8 vCPU; 256 Mbps = 4x 8 vCPU. Inspects requests >1 KB in test (default 4 KB). CPU-bound; ~5% virtualization overhead; keep CPU <=90%. ICAP defaults: 25 max simultaneous request and response connections. | techdocs.broadcom.com |
| Network Discover Server (with optional Network Protect)Windows/RHEL detection server; on-prem or AWS/Azure/Oracle Cloud | Scans data at rest in repositories; Network Protect adds quarantine/copy/MPIP classification actions. | 4 cores / 12 GB RAM / 140 GB disk - Small profile; + ~150 MB for incremental scan indexes (5 MB per incremental target + 50 bytes per item); +50 GB if using web server scanner. | 8 cores / 32 GB RAM / 140 GB disk - Large profile; ~1 GB for incremental scan indexes. | Not published as a fixed number Scan throughputThroughput depends on network bandwidth, CPU cores, repository load, file sizes/counts, policy complexity. MessageChain.NumChains recommended = 0.8 x vCPUs (or cores). | techdocs.broadcom.com |
| Network Discover Cluster - Data nodeWindows/RHEL; reserve CPU and RAM in virtualized environments | Coordinates File System / SharePoint High Speed Discovery scans across worker nodes. | 8 cores / 32 GB RAM / 500 GB disk - Small/medium: 8-core, 32 GB, 500 GB SSD recommended; DetectionServerController max memory 6 GB (small) / 12 GB (medium). | 16 cores / 32 GB RAM / 2048 GB disk - Large: 16-core, 32 GB, 2048 GB SSD recommended; DetectionServerController max memory 24 GB. | Small/medium sample: up to 10 worker nodes; large sample: 3+ clusters with up to 44 worker nodes each (~100 worker nodes) Worker nodes per clusterParallel scan limit recommended 1-3. | techdocs.broadcom.com |
| Network Discover Cluster - Worker nodeWindows/RHEL | Performs content extraction/detection for High Speed Discovery scans. | 8 cores / 12 GB RAM / 140 GB disk - Small/medium: 8-core, 12 GB, 140 GB. | 16 cores / 32 GB RAM / 250 GB disk - Large: 16-core, 32 GB, 250 GB. | Add worker nodes when average CPU ~80%; add RAM when DLP-process RAM >80% Scale-out triggerIf CPU <50%, increase parallel scans or remove nodes. | techdocs.broadcom.com |
| Endpoint Prevent Server (Endpoint Server)Windows/RHEL detection server; can sit in DMZ or public cloud; load balancer supported (incl. AWS ELB, Azure LB) | Relays policies to DLP Agents and incidents to Enforce; performs two-tier detection (EDM/IDM) for agents. | 4 cores / 12 GB RAM / 140 GB disk - Small detection-server profile. | 8 cores / 32 GB RAM / 140 GB disk - Large detection-server profile. | Tested: 30,000 agents with transient connections; 10,000 with persistent connections (15.7 Endpoint Server Scalability Guide, cited by KB 374445) Agents per Endpoint ServerKB states no hard limit. Advanced setting defaults: EndpointCommunications.MaxActiveAgentsPerServer 90000, MaxActiveAgentsPerServerGroup 150000, MaxConcurrentConnections 90000 (https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/pdf/symantec-security-software/information-security/data-loss-prevention/symantec-data-loss-prevention-help-center-26-1.pdf (section: Advanced server settings)). Fewer agents supported with more retained data, two-tier detection and frequent communication. VMs supported only within recommended agent counts. | knowledge.broadcom.com |
| API Detection ServerWindows/RHEL detection server; on-prem, AWS, Azure, Oracle Cloud; L4 load balancer recommended | REST (Detection REST API 2.0) inspection for on-prem applications. | 4 cores / 12 GB RAM / 140 GB disk - Small detection-server profile. | 8 cores / 32 GB RAM / 140 GB disk - Large detection-server profile. | Default 50 concurrent requests (RestDetection.MaximumAllowedConcurrentRequests); default max request 30 MB Concurrent connections / request size429 errors when overloaded; clients should retry with exponential backoff; health check on port 8080. | techdocs.broadcom.com |
| Cloud Prevent for Email detection serverWindows/RHEL detection server; AWS/Azure supported; SIR (OCR + Form Recognition) supported on Azure | Detection server for Microsoft 365 email integration (self-hosted, e.g., on Azure/AWS). | 4 cores / 12 GB RAM / 140 GB disk - Small detection-server profile. | 8 cores / 32 GB RAM / 140 GB disk - Large detection-server profile. | not published separately throughputNo dedicated benchmark found; Network Prevent for Email figures are the closest official reference. | techdocs.broadcom.com |
| Cloud detectors (Cloud Detection Service REST/CASB, CDS for Cloud SWG, Cloud Service for Email)SaaS (Symantec-managed); on-prem Enforce + Oracle required for Enforce-managed mode; Enforce needs outbound TCP 443 | Symantec-hosted detection for CloudSOC, Cloud SWG and cloud email; incidents flow to Enforce (or CloudSOC when cloud-managed). | Hosted service | Hosted service | 20 GB combined maximum Policy + profile index memory per cloud detectorContact Support to exceed 20 GB. | techdocs.broadcom.com |
| OCR Server (on-prem, Sensitive Image Recognition)Dedicated Windows server (physical or VM); OCR Server version must match detection server version | Extracts text from images/scanned PDFs for detection servers (not supported on DLP Agents). OCR in the Cloud is an alternative with no OCR Server. | 4 cores / 1.45 GB RAM / 32 GB disk - 3.0 GHz+; minimum 4 logical cores; RAM = 250 MB + 300 MB per logical core; 32 GB disk. | 8 cores / 2.7 GB RAM / 32 GB disk - Recommended 8 logical cores -> 2.7 GB RAM; set Num.Ocr.Workers = logical cores. | Computed with official OCR Server Sizing Estimator spreadsheet (busy-hour msg rate, % messages with images, images/message, avg OCR time ~1.5 s, workers, utilization) OCR servers per detection serverDetection servers extract only the first 10 pages/images of multipage PDF/TIFF by default. | techdocs.broadcom.com |
| DLP Agent (Windows, macOS, Linux)Installed on endpoints/VDI; connects to Endpoint Server on TCP 10443 (default); managed by on-prem Enforce or by CloudSOC (Cloud Managed DLP Agent) | Endpoint monitoring/prevention (Windows, macOS) and Endpoint Discover scanning (Windows, macOS, Linux). | 2 GB disk - 64-bit CPU; 2 GB free disk for install (Linux across /var, /opt, /tmp); RAM per OS vendor recommendation; more disk for policies/EDM/EMDI/incident cache. | Not specified beyond minimum. | ~5 GB/hour per agent Endpoint Discover scan rateAgent IDM: up to 30,000 indexed documents (60 MB default); ~2 KB RAM per file for partial matching, ~40 bytes per file exact-only. | techdocs.broadcom.com |
| Remote EDM / EMDI / IDM indexersWindows/Linux host near the data source | Index large structured/unstructured data sources off the Enforce Server. | EDM indexer default memory handles <=500 million cells; +3 bytes per additional cell (e.g., 2 billion cells -> ~7 GB). | Size to largest index (serial) or sum of indexes (parallel). | EDM: 4,294,967,294 rows / 6 billion cells; EMDI: 4 million rows, 32 columns, 128 million cells; IDM server: ~1,000,000 documents per 2 GB profile Index limits | techdocs.broadcom.com |
| Domain Controller AgentInstalled on AD domain controllers; connects to Enforce over HTTPS 443 (Windows) / 8443 (Linux) | Resolves user identities for incidents (e.g., Network Monitor) by reading DC logon events. | Not specified | Not specified | n/a n/a | techdocs.broadcom.com |
| CloudSOC console (Cloud Managed DLP / DSPM / CASB)SaaS; US or EU regional tenant; access via AuthHub/Enterprise Console | SaaS management console for Cloud Managed DLP policies, CASB securlets/gatelets, DSPM catalog and dashboards, incident investigation. | SaaS - no customer infrastructure | SaaS | 15 minutes Cloud Managed DLP agent check-in intervalIncidents may take up to 15 minutes to appear. | techdocs.broadcom.com |
Sizing rules
| Topic | Rule | Value | Source |
|---|---|---|---|
| Deployment tier - sizing factors | Size by: Enforce users, number of detection servers, Discover cluster worker nodes, data volume to scan, daily incident volume, network traffic, EDM/EMDI/IDM profile size, Form Recognition profile size. | 8 factors | techdocs.broadcom.com |
| Tier: Small | Sample small deployment | 10 Enforce users; 10 detection servers; 1 Discover cluster (<=10 workers, 1 scan target, minimal policies); 10,000 incidents/day; 30-40 Mbps monitored traffic | techdocs.broadcom.com |
| Tier: Medium | Sample medium deployment (three-tier) | 20 Enforce users; 50 detection servers; 1 Discover cluster (<=10 workers, <=10 targets, <=50 policies); 50,000 incidents/day; 30-40 Mbps | techdocs.broadcom.com |
| Tier: Large | Sample large deployment (three-tier) | 30 Enforce users; 100+ detection servers; 3+ Discover clusters with up to 44 worker nodes each (~100 workers), 10 targets, 100 policies; 100,000 incidents/day; >40 Mbps | techdocs.broadcom.com |
| Installation tiers | Three-tier (dedicated Oracle server) or two-tier (Oracle on Enforce host); medium and large are three-tier; small can be three-tier. | two-tier | three-tier | techdocs.broadcom.com |
| Enforce Server minimum | Minimum supported hardware | 4 cores / 8 GB / 500 GB | techdocs.broadcom.com |
| Enforce Server by tier | Minimum recommended hardware | Small 8c/32 GB/500 GB; Medium 12c/64 GB/500 GB SSD; Large 16c/128 GB/1 TB SSD/SAN | techdocs.broadcom.com |
| Oracle DB by tier | Dedicated DB server hardware | Small 2c/8 GB/0.5-1 TB; Medium 4c/32 GB/0.5-1 TB (SGA 16 GB, PGA limit 4 GB); Large 6c/32 GB/2-32 TB (SGA 24 GB, PGA limit 4 GB); disable AMM (memory_target=0) | techdocs.broadcom.com |
| Detection servers by tier | Network Discover, Network Prevent, Cloud Prevent for Email, Endpoint Prevent, API Detection, Network Monitor | Small 4c/12 GB/140 GB; Medium 4c/16 GB/140 GB; Large 8c/32 GB/140 GB (Detector process 8-10 / 12-14 / 28-30 GB; Enforce Connector 2 GB) | techdocs.broadcom.com |
| Discover cluster by tier | Data node / worker node | Small & Medium: data 8c/32 GB/500 GB SSD, worker 8c/12 GB/140 GB; Large: data 16c/32 GB/2048 GB SSD, worker 16c/32 GB/250 GB; SymantecDetectionServerController max memory 6/12/24 GB | techdocs.broadcom.com |
| Default inspection content size | Default max content size for detection; tune for larger files | 30 MB | techdocs.broadcom.com |
| Incremental scan index disk | Overhead per incremental scan target and per item | 5 MB per target + 50 bytes per item (~150 MB small/medium, ~1 GB large) | techdocs.broadcom.com |
| Web server scanner disk | Extra disk for Network Discover servers running web server scanner (deprecated in 25.1) | +50 GB | techdocs.broadcom.com |
| Oracle /opt free space (Linux) | Two-tier (DB on Enforce) vs three-tier | Two-tier: 500 GB small/medium, 1 TB large; three-tier Enforce: 10 GB /opt, 100 MB /boot | techdocs.broadcom.com |
| Linux partitions | /var holds logs, EDM/IDM/Form Recognition indexes, incremental indexes, pcap | /var 15 GB small/medium, 46 GB large; swap = RAM; /home 6 GB and /tmp 1.2 GB with Oracle | techdocs.broadcom.com |
| Oracle versions | Supported DB | Oracle 19c EE or 19c SE2 (latest RUs); AL32UTF8 required; Oracle Client on Enforce must match DB version in three-tier | techdocs.broadcom.com |
| Incident count | Incident Counter raises system event 2316 above threshold; incident report performance degrades as count grows | Default threshold 1,000,000 incidents | techdocs.broadcom.com |
| Large database tablespace alerts | For databases >= 1 TB adjust tablespace thresholds | Warning 85%, Severe 95% | techdocs.broadcom.com |
| Database growth drivers | DB size depends on # policies (initial and over time), incident attachments stored, incident retention; incident data is largest consumer. No per-incident storage formula published. | variable | techdocs.broadcom.com |
| Enforce DLP Manager memory | Raise DLP Manager Max Memory from 2048 MB when environment exceeds thresholds | >50 policies OR >50 detection servers OR >50,000 agents -> 4096 MB | techdocs.broadcom.com |
| Endpoint Server capacity (tested) | Agents per Endpoint Server from Endpoint Server Scalability Guide (15.7) | 30,000 transient-connection agents; 10,000 persistent-connection agents | knowledge.broadcom.com |
| Endpoint Server advanced limits | Default advanced settings | MaxActiveAgentsPerServer 90,000; MaxActiveAgentsPerServerGroup 150,000; MaxConcurrentConnections 90,000 | techdocs.broadcom.com |
| Endpoint load balancer | Recommended LB settings for Endpoint Server pools | 1 Gbps throughput; source-IP persistence longer than agent polling period; 24-hour SSL session timeout | techdocs.broadcom.com |
| Agent failover | Agent retries original Endpoint Server before failing over | 60 minutes (default) | techdocs.broadcom.com |
| Endpoint Discover rate | Per-agent local scan throughput | ~5 GB/hour per agent | techdocs.broadcom.com |
| Agent disk | Free disk for agent install | 2 GB (more for policies, EDM/EMDI, incident cache) | techdocs.broadcom.com |
| Network Monitor throughput | Supported pre-filter bandwidth per server | Windows native 300 Mbps; Linux native 650 Mbps; Napatech NT4E/NT40A01 900 Mbps x 4 capture interfaces | techdocs.broadcom.com |
| Network Monitor server count | Servers needed (Windows native / Linux native / Napatech) | 50 Mbps: 1/1/1; 100: 1/1/1; 500: 2/1/1; 750: 3/2/1; 900: 4/2/1; 900x4 interfaces: N/A/N/A/1 (no redundancy) | techdocs.broadcom.com |
| Network Monitor test hardware | Benchmark platform | 2x quad-core Xeon E5620 2.4 GHz, 16 GB RAM, single IDM policy on 20 MB doc | techdocs.broadcom.com |
| Network Prevent for Email throughput | Single server, 5 GB EDM index, TLS, 8-core VM, 8 message chains | 88 messages/second (~316,800/hour derived), 0.26 s latency | techdocs.broadcom.com |
| Network Prevent for Email server count | No redundancy/TLS in estimate | 70 or 80 msg/s -> 1x 8-CPU physical or 1x 8-CPU VM or 1x 16-CPU VM; scales linearly | techdocs.broadcom.com |
| Network Prevent CPU headroom | Keep CPU at or below threshold | <=90% CPU | techdocs.broadcom.com |
| Network Prevent for Web throughput | AWS m4.2xlarge 8 vCPU/32 GB, 1 vCPU:1 message chain, 139 policies | 10 Mbps (6.6 KB files), 47 Mbps (220 KB), 207 Mbps (2.03 MB) | techdocs.broadcom.com |
| Network Prevent for Web server count | Medium data set (220 KB avg), no redundancy | 64 Mbps -> 1x 8 vCPU; 128 Mbps -> 2x 8 vCPU; 256 Mbps -> 4x 8 vCPU | techdocs.broadcom.com |
| Virtualization | Supported on any Type-1 hypervisor; expect degradation vs physical; size from own tests | NPW ~5% throughput degradation on large data sets when virtualized | techdocs.broadcom.com |
| Discover cluster scaling | Worker node scaling | Add workers at ~80% avg CPU; add RAM at >80% RAM; parallel scan limit 1-3 | techdocs.broadcom.com |
| Discover message chains | MessageChain.NumChains | 0.8 x vCPUs (virtual) or 0.8 x CPU cores (physical) | techdocs.broadcom.com |
| EDM limits | Max rows / cells; indexer memory | 4,294,967,294 rows; 6 billion cells; default indexer <=500M cells, +3 bytes/cell above | techdocs.broadcom.com |
| EMDI limits | Max index size | 4 million rows; 32 columns; 128 million cells | techdocs.broadcom.com |
| IDM limits | Documents per profile | ~1,000,000 docs on server (2 GB); 30,000 on agent (60 MB); agent partial ~2 KB RAM/file, exact ~40 bytes/file | techdocs.broadcom.com |
| OCR Server sizing | Hardware and RAM formula | Min 4 logical cores (8 recommended), 3.0 GHz+; RAM = 250 MB + 300 MB x logical cores; 32 GB disk; use OCR Server Sizing Estimator | techdocs.broadcom.com |
| Cloud detector limits | Combined memory for deployed policies and profile indexes | 20 GB max per cloud detector | techdocs.broadcom.com |
| API Detection | Defaults | Max request 30 MB; 50 concurrent requests; L4 load balancer recommended | techdocs.broadcom.com |
| HA/DR - incident buffering | If RTO for Enforce+Oracle is up to 8 hours, configure agents and servers to buffer incidents | Buffer up to 24 hours of incident data locally | techdocs.broadcom.com |
| HA/DR - detection redundancy | Horizontal scale with load balancing | N+1 or N+2 for Network Prevent for Email/Web; N+1 load-balanced Endpoint Servers | techdocs.broadcom.com |
| HA/DR - Enforce | Active-passive only | 1 active Enforce Server per deployment | techdocs.broadcom.com |
| HA/DR testing | Verify failover, backup and restore | At least yearly (quarterly at most for full DR test) | techdocs.broadcom.com |
| Release lifecycle | Release cadence and support | Nine-month release cycle since 16.1; YY.N numbering (e.g., 26.1); each release from 25.1 supported 30 months | techdocs.broadcom.com |
Network ports
| From | To | Port | Protocol | Purpose | Source |
|---|---|---|---|---|---|
| Admin browser | Enforce Server (Windows) | 443 | TCP/HTTPS | Enforce administration console | knowledge.broadcom.com |
| Admin browser | Enforce Server (Linux) | 8443 | TCP/HTTPS | Enforce administration console on Linux | knowledge.broadcom.com |
| Enforce Server | Oracle database | 1521 | TCP | Oracle listener (default) | techdocs.broadcom.com |
| Enforce Server | Detection servers / Discover cluster data node | 8100 | TCP (TLS) | Enforce-to-detection-server communication; configurable to any port >1024, same port for all detection servers | techdocs.broadcom.com |
| DLP Agents | Endpoint Prevent Server | 10443 | TCP (TLS) | Agent-server communication (default, configurable) | techdocs.broadcom.com |
| HTTP proxy (ICAP client) | Network Prevent for Web | 1344 | TCP/ICAP | ICAP REQMOD/RESPMOD (recommended value) | techdocs.broadcom.com |
| Upstream MTA | Network Prevent for Email | 10025 | TCP/SMTP | SMTP listener for incoming connections from MTA (RequestProcessor ServerSocketPort) | techdocs.broadcom.com |
| Network Prevent for Email | MTA | 10026 | TCP/SMTP | Port used by the detector on the MTA to resend messages (MTAResubmitPort). Install checklist also verifies telnet NPE->MTA on 25 and MTA->NPE on 10026. | techdocs.broadcom.com |
| Network Prevent for Email | Downstream MTA | 25 | TCP/SMTP | Mail forwarding / connectivity check | techdocs.broadcom.com |
| Enforce Server | Symantec cloud services (pki-scep.symauth.com, gw.csg.dlp.protect.symantec.com) | 443 | TCP/TLS outbound | Cloud Service for Email / Cloud Detection Service connectivity (no transparent proxy; explicit proxy supported) | techdocs.broadcom.com |
| Discover cluster nodes | Discover cluster nodes | 47500-47520 | TCP | Cluster discovery port range (default) | techdocs.broadcom.com |
| Discover cluster nodes | Discover cluster nodes | 10800-10820 | TCP | Cluster client port range (default) | techdocs.broadcom.com |
| Network Discover grid | Grid leader | 39990 | TCP | Network Discover grid leader (16.1+, bi-directional) | knowledge.broadcom.com |
| Detection server | OCR Server | 8555 | TCP | OCR processing | knowledge.broadcom.com |
| Load balancer / client | API Detection Server | 8080 | TCP/HTTP | Health check | techdocs.broadcom.com |
| Domain Controller Agent | Enforce Server | 443 (Windows) / 8443 (Linux) | TCP/HTTPS | User identity events | techdocs.broadcom.com |
| Enforce Server | SMTP server | 25 | TCP/SMTP | Alerts and notifications | knowledge.broadcom.com |
| Enforce / detection servers | Syslog/SIEM | 514 | TCP (per KB) | Log to a Syslog Server response rule / event logging | knowledge.broadcom.com |
| Enforce Server | LDAP / AD | 389 / 636 | TCP | Directory connection (unsecure / secure) | knowledge.broadcom.com |
| Enforce Server | Kerberos KDC | 88 | UDP | AD (Kerberos) authentication | knowledge.broadcom.com |
| Outlook (local) | DLP Agent (localhost) | 4631, 4641, 4651 | TCP | Outlook on-send add-in communication | knowledge.broadcom.com |
| Enforce Server | Data Insight server | 443 | TCP/HTTPS | Data Insight integration | knowledge.broadcom.com |
| Admin workstation | Windows DLP servers | 3389 | TCP/RDP | Optional remote desktop for setup | techdocs.broadcom.com |
Supported platforms
- Endpoint Os
- Windows 11 Pro/Enterprise 23H2-25H2 (x64 and ARM64), Windows Server 2019, Windows Server 2022, Windows Server 2025 (Desktop Experience, Credential Guard), macOS 14 Sonoma (deprecated), macOS 15 Sequoia, macOS 26 Tahoe, macOS 27 Golden Gate, RHEL 8.6-8.10 (Endpoint Discover only), RHEL 9.0-9.7 (Endpoint Discover only), Ubuntu 24.04 LTS (Endpoint Discover only), VDI: Azure Virtual Desktop (Win 11 Enterprise single/multi-session), Citrix Virtual Apps/Desktops, VMware virtual desktops/apps, Windows 365 Cloud PCs
- Any SMTP-compliant MTA or hosted email service (Network Prevent for Email; forwarding or reflecting mode), Microsoft 365 Exchange Online (Cloud Service for Email via inbound connector / reflect mode; Cloud Prevent for Email), Google Workspace Gmail (Cloud Service for Email, reflect mode), On-prem Microsoft Exchange 2010/2013/2016 (Cloud Service for Email), Symantec Email Security.cloud (delivery/enforcement), Symantec Messaging Gateway 10.6-10.9, Symantec PGP Universal Gateway Email 2.63/3.3.x, Endpoint: Outlook (Office 2021/2024, M365 on-send web add-in), Lotus Notes 8.5/9.0
- Web Proxy
- Any ICAP (RFC 3507) compliant proxy - REQMOD/RESPMOD, Symantec ProxySG (recommended/tested; Secure ICAP), Symantec Cloud SWG (via Cloud Detection Service), Symantec Web Gateway 5.2.7, Endpoint HTTPS monitoring: Edge, Chrome (Content Analysis Connector), Firefox, Safari
- Cloud Apps
- CloudSOC Securlets: AWS, Azure, Box, Google Workspace, Office 365 (Email, OneDrive, SharePoint, Copilot), Salesforce, ServiceNow, Slack, Cloud Detection Service contextual attributes/securlets also list Amazon S3, Cisco Spark, Dropbox, Google Calendar, Google Drive, Gmail, SAP, Yammer, plus many gatelets, Endpoint cloud sync apps: Dropbox, Box Drive/Sync, OneDrive, Google Drive for Desktop, Endpoint GenAI/collab categories: ChatGPT, Microsoft Copilot, Teams, Zoom, Slack, WhatsApp, Signal, Telegram
- Iaas
- AWS (Enforce two-tier, Amazon RDS for Oracle three-tier, Cloud Prevent for Email, NP Web, NP Email, Endpoint Prevent, Network Discover, API Detection), Microsoft Azure (Enforce two/three-tier on Azure VMs, Cloud Prevent for Email incl. SIR, NP Web, NP Email, Endpoint Prevent w/ Azure LB, Network Discover, API Detection), Oracle Cloud IaaS / Bare Metal (Enforce two-tier, NP Email, Endpoint Prevent, Network Discover, API Detection), Type-1 hypervisors (VMware ESXi, Hyper-V), CloudSOC DSPM cloud storage: AWS, Azure, Google
- Databases
- Oracle 19c (Discover target; JDBC 19.8), Microsoft SQL Server 2017/2019 on Windows (jTDS 1.3.1), IBM DB2 11.5, HCL Domino 12.0, DLP own repository: Oracle 19c EE / SE2
- Repositories
- SMB/CIFS file shares (Windows Server 2016/2019; SMB 2.x/3.0.2 incl. SMB3 encryption for High Speed Discovery), NFS v3/v4 (Windows 2016/2019, RHEL 8.x), DFS, Content Root Enumeration via Active Directory, SharePoint Server 2019 and Subscription Edition (High Speed Discovery only SE), Microsoft Exchange Server 2016/2019 on-prem (EWS), Outlook PST files (Outlook 2016), Web servers (web server scanner - deprecated), Endpoints (Endpoint Discover: Windows, macOS, Linux), Cloud repositories via CloudSOC Securlets/DSPM: Box, Google Drive, OneDrive, SharePoint Online (M365 Sites), Salesforce, ServiceNow, AWS/Azure/Google storage, Veritas/Enterprise Vault Data Insight integration for data owners/risk
Detection technologies
- Described Content Matching (DCM) - data identifiers, keywords, regex, file properties - Pattern and keyword detection; >130 out-of-the-box data identifiers per product brief; 65 policy templates in 26.1 docs (brief says 70+). docs.broadcom.com
- Exact Data Matching (EDM) - Fingerprints structured data sources; up to 4,294,967,294 rows / 6 billion cells; remote EDM indexer; two-tier detection for agents. techdocs.broadcom.com
- Exact Match Data Identifiers (EMDI) - Smaller exact-match indexes deployable to agents; up to 4M rows, 32 columns, 128M cells. techdocs.broadcom.com
- Indexed Document Matching (IDM) - Fingerprints unstructured documents for exact/partial/derivative matching; ~1M docs server, 30k on agent; remote IDM indexer. techdocs.broadcom.com
- Vector Machine Learning (VML) - Trained ML profiles for hard-to-describe IP such as source code and financial reports. docs.broadcom.com
- Form Recognition - Detects scanned or electronically filled forms against a gallery of blank forms (part of Sensitive Image Recognition). techdocs.broadcom.com
- OCR (on-prem OCR Server and OCR in the Cloud) - Extracts text from images, screenshots, scanned PDFs for text-based rules; not supported on DLP Agents; Sensitive Image Recognition add-on license for on-prem. techdocs.broadcom.com
- Directory Group Matching (DGM) / Synchronized & Profiled DGM - Detect based on sender/recipient identity from directory or EDM profile. techdocs.broadcom.com
- User Risk Based Detection - Policy rules and response conditions on ICA user risk scores for Network Monitor, NP Web, NP Email, Endpoint Prevent. techdocs.broadcom.com
- MPIP tag / label detection - Content Matches MPIP Tag rule; read MPIP-protected content; apply MPIP labels via Endpoint and Network Protect response actions. techdocs.broadcom.com
- File type / custom file type identification and metadata detection - Binary-signature file type identification (330+ file types per brief), endpoint metadata detection. docs.broadcom.com
- Contextual attributes for cloud applications (incl. M365 Copilot) - Rules on CASB/Cloud Detection Service attributes (app name, exposure, Copilot conversation/interaction type, attachments). techdocs.broadcom.com
- CloudSOC DSPM data profiles and classifications - Pre-defined and custom data profiles (e.g., PII, SSN by country) that classify files into the DSPM data catalog. techdocs.broadcom.com
Not verified on an official page (not used as fact)
- Maximum agents per Endpoint Server for DLP 26.1: the only official capacity figures (30,000 transient / 10,000 persistent) come from the 15.7 Endpoint Server Scalability Guide as summarized in KB 374445; the guide PDF attachment could not be downloaded to verify test hardware.
- Network Discover / High Speed Discovery throughput (GB/hour or files/hour per server or per worker node): no official figures found in 26.1 docs (only tuning factors).
- Oracle database storage-per-incident formula (KB per incident): not published in DLP 26.1 docs; only growth drivers and tier disk ranges (500 GB-1 TB; 2-32 TB).
- An 'enterprise' tier beyond 'Large' is not defined in 26.1 docs (only small/medium/large).
- Network Monitor/Prevent performance benchmarks were measured on older hardware/OS (Xeon E5620, RHEL 7.5, Windows 2016, AWS m4) and are carried forward unchanged in 26.1 docs.
- Network Prevent for Email hourly throughput (~316,800 msg/hour) is derived from the official 88 msg/s figure, not stated directly.
- FedRAMP status: Broadcom investor news reports Cloud SWG FedRAMP authorization and a Symantec blog reported CASB/DLP 'In Process', but neither page could be fetched/verified; DLP/CloudSOC FedRAMP authorization is unconfirmed.
- Cloud Detection Service / Cloud Service for Email data center regions and data residency options not documented in sources reviewed (CloudSOC tenants: US or EU).
- CloudSOC DSPM support for databases (RDS, Snowflake, etc.) or on-prem file shares: not found.
- CloudSOC DSPM depth for AWS/Azure/GCP (which storage services - S3, Blob, GCS - and whether object content is scanned) is only stated as 'Supported Cloud Storages: AWS, Azure, Google'.
- OCR Server OS support is inconsistent: the 26.1 system requirements say same Windows versions as Enforce (not 2012), while the OCR sizing section still lists Windows Server 2012 R2 / 2016.
- Licensing/SKU packaging (which features are in DLP Core vs add-on, e.g., Sensitive Image Recognition, ICA) differs between the 2026 product brief and the Help Center wording.
- Port 8555 (OCR), 39990 (Discover grid), 514 syslog protocol and Outlook add-in ports are from knowledge base article 160297 (older versions) and were not re-confirmed in 26.1 docs.
- Hardware sizing for Cloud Prevent for Email servers specifically (only grouped with generic detection-server profile).