McAfee Data Loss Prevention 9.2.2 Product Guide

5Integrating5McAfee DLP EndpointMcAfee DLP Endpoint is integrated into the network product suite through the ePolicy Orchestrator orMcAfee DLP Manager management console. McAfee DLP Endpoint adds protection for Data‐in‐Use tothe product suite by monitoring and managing devices and user activities at network endpoints.What is McAfee DLP Endpoint?McAfee DLP Endpoint is an agent solution that monitors enterprise users’ actions through thecomputers and devices they use in the course of their work. It prevents compromise of sensitive dataat a variety of network endpoints — not only on computers, but on removable media, printers,clipboards, screens, windows, and defined shares and paths. Through McAfee DLP Manager, significantevents that occur at those endpoints can be delivered to the unified product suite, integrated into theincident workflow, and resolved with appropriate actions.The software is managed by ePolicy Orchestrator and deployed through a DLP client of McAfee Agent,which distributes policies to endpoints and enforces them by generating and storing significant eventsin an evidence folder. After the events are accessed by McAfee DLP Manager, they are displayed on theePolicy Orchestrator and McAfee DLP Manager Data‐in‐Use dashboards.ContentsHow McAfee DLP Endpoint works with McAfee DLP ManagerTypical scenariosViewing eventsConfiguring McAfee DLP Endpoint in McAfee DLP ManagerMaintaining compatibility with installed agentsUnified policies and McAfee DLP EndpointTagging and trackingControlling devicesHow McAfee DLP Endpoint works with McAfee DLP ManagerIntegration of McAfee DLP Endpoint into the network product suite begins when a trust relationship isestablished between ePolicy Orchestrator and McAfee DLP Manager. After credentials are used toauthenticate the connection, ePolicy Orchestrator extensions for McAfee DLP Endpoint and the networkproduct suite cooperate to allow communication with McAfee Agent (through a client plugin).When the unified policy is distributed through ePolicy Orchestrator to endpoints and a match isdetected, an event is generated at the endpoint. It is encrypted, then delivered through the McAfeeDLP client to an evidence folder that is usually located on ePolicy Orchestrator. At pre‐defined postingMcAfee Data Loss Prevention 9.2.2 Product Guide 129