You will need to ensure the traffic is steered and SSL decrypted before any possible controls can be applied. DLP controls based on File Profile will also require that we are detecting the activity you are applying the DLP policy on so if you are not seeing the download activity in the application events you won't be able to natively do this. Please reference this guide I wrote for WhatsApp to ensure you are steering and SSL decrypting the traffic. If you are unable to block based on the file attributes once steered and SSL Decrypted, if you are leveraging Chrome you can use the developer tools to inspection and trace the network events to identify the URL or Header attributes associated with the download to configure and block that part of the session. Alternatively, you can leverage this guide to block WhatsApp outright to avoid the potential major data exfiltration vector.
In order to view this content, you will need to sign in to your account. Simply click the "Sign In" button belowSign In