You can log any write to a removable drive, such as a USB drive with Application and Device control. 

A violation of a DLP policy will generate an incident back on your enforce platform , it does not matter if you have added a response rule to the policy that has been violated or not.

Please be aware the "Endpoint: Notify" response rule allows the copy operation to take place and notifies the user that the action violated a policy, and can optionally prompt the user to justify that action they just took.

Application and Device control applies to SEP not DLP, i believe there is an issue with these forums where DLP posts are also appearing in the SEP forum.

Steve Randall

Thanks for the input. I have a follow up question... Is there a way to have multiple policy actions? For example, can you have a"SSN' policy that notify only and another to block and then assign endpoint agents to the appropriate "SSN" policy?

Thank you