McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverRemediating incidentsDelete discovered filesDelete discovered files by a delete action when they are found by a Discover scan. After this is done,the file cannot be recovered.When you copy, move, delete or encrypt a file, McAfee DLP Discover leaves a trace file at the originallocation to leave a record of the remedial process that has been applied.You can use Dynamic Variables to automatically inform users that the file has been deleted.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 From the Actions menu, select Add Action Rule.• If you relocate an incident from the Incident Details page, select its checkbox and select Remediate |Action and select the Move action rule from the sub‐menu.• If you want an incident to trigger a move, add the to a rule and click Save,then start a discovery scan that applies the rule containing the action rule.3 Type in a name for the action rule.4 Open Remediation Policy as appropriate.You can use Dynamic Variables to inform users of the prevented action automatically.For example, ##Filename found by the ##Rule found by the ##ScanOperation was deleted.5 Add File Marker Text to change the stage of resolution when the action takes place (recommended).6 Click Save.7 Apply the new action rule to one or more rules.8 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Classify | Discover Scan Operations.• On your McAfee DLP appliance, select Classify | Discover Scan Operations.9 When the Scan Operations page appears, select a scan.10 From the Actions menu, select Rescan.11 Check the results to verify that the file has been deleted.Revert remediated filesRevert remediated files to reverse an action that has been applied to a file that was found during ascan.Deleted incidents cannot be reverted or recovered.If data is moved to quarantine an incident, the action can be reverted. If remediation actions fail, errormessages appear.120 McAfee Data Loss Prevention 9.2.2 Product Guide