McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverRemediating incidents2 From the Actions menu, select Add Action Rule.• If you want to copy an incident from the dashboard, click Details, select Remediate | Action, thenselect the Copy action rule from the sub‐menu.• If you want an incident to trigger a copy action, add the to the rule and clickSave, then start a Discover scan that applies the rule containing the action rule.3 Type in a name for the action rule.4 Open Email Notification to alert one or more users when the action is triggered.You can use Dynamic Variables to inform users of the prevented action automatically.For example, ##Filename found by the ##Rule violated the ##Policy and was copied to .For example, ##Filename found by ##ScanOperation violated the ##Policy and was copied to.5 (Optional) Open Syslog Notification and select Enable to log the incident.6 Open Incident Reviewer to assign a reviewer when the action takes place (recommended).7 Open Incident Status to change the stage of resolution when the action takes place (recommended).8 Open Remediation Policy and select Copy from the Action list.9 Select the export location from the Destination drop‐down list.10 Click Save.Move discovered filesMove discovered files to a quarantined location after a remedial action has been applied to an incident.When you copy, move, delete or encrypt a file, McAfee DLP Discover leaves a trace file at the originallocation to leave a record of the remedial process that has been applied.You can use Dynamic Variables to automatically inform users that the file has been moved to a quarantinedlocation.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 From the Actions menu, select Add Action Rule.• If you relocate an incident from the dashboard, click Details and select Remediate | Action, thenselect the Move action rule from the sub‐menu.• If you want an incident to trigger a move, add to the rule and click Save,then start a Discover scan that applies the rule containing the action rule.3 Type in a name for the action rule.118 McAfee Data Loss Prevention 9.2.2 Product Guide