'Prevent: Encrypt' response rule supports Removable Media (USB) destinations for the ICE integration in DLP 15MP1.
Other channels, such as 'Copy to Network Share' and HTTPS (Chrome), will result in a block action to prevent the data from leaving the endpoint.
In order to utilize the ICE integration response rule, Prevent: Encrypt, without impacting normal business operations, a response rule conditon is required.
The response rule condition 'Protocol or Endpoint Monitoring' should be used in this case to allow the Prevent: Encrypt response rule to trigger when Removable Media channel is detected.
All other channels will not be affected by this response rule.