I am interested in how DLP systems work. I have noticed that developers of DLP say that the software can see messenger traffic including end-to-end solutions. I understand MITM, certificate change, but in the case of end-to-end, how does it work? There is encryption between two devices, the third device cannot see it, isn't that correct? It must decrypt for analyzing traffic.
It will depend on the specific implementation of the specific product and the specific message traffic.
Data Loss Prevention tools tend to work in one of two ways: they sit on the network and look at logs, read emails, read file shares; or they are installed as a desktop agent which, the vendors assert, has full access to every keystroke, window, file and memory object. DLP vendors, IMHO, like to assert much. The network DLP products may require that the end user organisation tags data of interest. The product then uses its magic unicorn to identify all those documents with that tag. The agent-based products will know what files are being touched and can therefore assign a risk weighting to actions and hence report on them via the dashboards that they seem to love.
To read a message then could be as simple as the keystrokes being captured, could be the window being asked to report on its contents, it could be that the tool has the message certs and it implements a MITM as you say. It could be as simple as reading the message store from the message server.
Regulated institutions such as financial service trading floors may have a requirement to monitor and record all instant messages being used. Many years ago I implemented IMLogic which was an IM compliance tool used by an investment bank as their traders used all the IM clients to have personal calls with external parties. They had a client that intercepted messages and sent them to the server for storage: nothing particularly clever.
The DLP products can only report on what they know: I expect that it would be possible to write your own chat client that they could not inspect if you had full end-to-end encryption.
The only way to be absolutely sure about how a specific vendor monitors a specific chat channel is to ask them.