McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverRemediating incidentsAdd remedial action rulesAdd remedial action rules to rules that will be used in a Discover scan. When the rule hits, the actionwill be applied.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 From the Actions menu under Data‐at‐Rest, select Add Action Rule.3 Type in a name for the action rule.4 Open Email Notification to alert one or more users to the action.5 Open Syslog Notification and select Enable to log the incident.6 Open Incident Reviewer and select Incident Status to assign a reviewer.7 Open Incident Status to define its stage of resolution and select Enable to log the incident.8 Open Remediation Policy and select the corrective action that is to be taken.9 Click Save.Apply remedial action rulesApply remedial actions to discovered incidents by adding them to rules. The actions are applied whenthe rule is matched against on data at risk. If the rule detects sensitive data, the action defined in therule will be taken.If McAfee DLP Discover and McAfee DLP Monitor devices are managed by McAfee DLP Manager, everyrule can be configured to deploy one action to each of the three incident types.Rescan to produce updated results, then verify that the action rule applied to the rule implements thecorrect remedial action.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click the policy defined in the scan, then click a rule.3 Click the Actions tab.4 Click Add Action.5 Select a remedial action from the Data‐at‐Rest menu.6 Click Save.116 McAfee Data Loss Prevention 9.2.2 Product Guide