McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP DiscoverGetting scan statistics and reports 4Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 Select one or more incident checkboxes.3 From the Remediate menu, select Revert.4 Click OK to confirm, or Cancel.5 You might want to rescan to verify that the action has been reverted.Getting scan statistics and reportsWhen you run a scan operation, files that have been registered or matched to rule conditions areindexed and fetched from the repository. Incidents found by the crawler are displayed under theData‐at‐Rest vector.Scan results are first displayed on the Scan Statistics dashboard. Statistics describing the status of thescan are displayed under Statistics on the Scan Operations page.Incidents found by a scan operation are reported on the Data‐at‐Rest dashboard. Files are downloadeddirectly to McAfee DLP Discover from the host on which they were detected, but the files are not savedindefinitely. They are fetched from the source when needed and the cache is flushed regularly tooptimize disk utilization and keep copies of sensitive information from being stored on the system.The index keeps running in the background until all files are reported, even if the task has completed.To maximize performance during CIFS, NFS, or Documentum inventory scans, the crawler updates thedatabase only after 100,000 files have been processed. If fewer files are detected, the counters areupdated after the scan has been completed.Scan results are reported on the Data‐in‐Use dashboard, but the scan metadata is available on the ScanOperations Statistics page.Statistics include the parameters defined in the scan and processing information about the crawl, suchas files processing, number of incidents retrieved, and success of the run.When you run a scan operation, files that have been registered or matched to rule conditions areindexed and fetched from the repository. While files are being fetched, counters increment as nodesare identified and shares are authenticated. The incident database is updated every 15 minutes untilthe conclusion of the task.View scan resultsWhen you run a scan, files that have been registered or matched to rule conditions are indexed andfetched from the repository, and any incidents detected are displayed on the Incidents dashboard underthe Data‐at‐Rest vector.You can find the results of in‐progress or completed scans on the Scan Statistics page. View specificmatches for each incident by clicking its Details icon.After a standalone McAfee DLP Discover is registered to McAfee DLP Manager, the number of totalincidents displayed will not include incidents that were reported before the appliance was added to thenetwork. Because a few documents might be re‐registered after a reboot or restart, duplicate incidentsmight be reported.McAfee Data Loss Prevention 9.2.2 Product Guide 121