The Endpoint Agent consists of three components:
EDPA - Monitors content. Also monitors and restarts the watchdog process.
WatchDog - Monitors and restarts the DLP Agent.
Agent UI - For creating messages to user.
The combined footprint takes ~20MB, less than 50% of a typical AV agent. Policies will increase the footprint, especially keyword policies like HIPAA. The combined footprint can grow to ~40MB with more than 20 policies.