McAfee Data Loss Prevention 9.2.2 Product Guide

5Integrating McAfee DLP EndpointTypical scenarios3 On the Add Rule or Edit Rule page, select Concept from the Content menu and click ?.4 From the Template menu, select the Banking and Financial Sector document set.5 Click Apply.6 From the Endpoint menu, select Protect Clipboard, click ?, select the Enable checkbox, and click Apply.7 Click the Actions tab and click Add Action, then select Clipboard Reaction from the Data‐in‐Use menu.If you want to add other reactions, such as notifying the owner of the documents or storingevidence of the attempt to copy content, go to the Action Rules page, open the Clipboard Reaction actionrule, and modify it to include those actions.8 Click Save.Protect data with Document Scan ScopeIf you have to find and control documents in which a known word or phrase appears in a specificlocation in a Microsoft Office document, you can use Document Scan Scope to find them quickly and keepthem from being distributed.The Document Scan Scope feature allows you to search for strings in the header, footer, and/or body ofMicrosoft Office documents. This feature improves system performance because the agent need notextract and analyze content from complete documents.Both network and endpoint applications support document properties, but because Date Creation and DateModified are Windows parameters, the network applications do not support those properties.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Add a new policy and rule, or open existing ones.Make sure the policy is active and the Inherit Policy State state of the rule is set to Enabled.3 Open the Content category, and enter keywords that can be found in the documents you want toprotect into the value field, such as Confidential.4 Open the Endpoint category and select Document Scan Scope.5 Open the Source/Destination category, select URL and is none of, and enter a name and domain (forexample, yourcompany.com).By selecting a negative condition, you exclude that domain, ensuring that documents exchangedlegitimately within your company will not be affected — but all others being sent out of yourintranet will be processed.6 Click ? and select the Body, Footer, and/or Header checkboxes from the Select items window.The keywords you typed in will be matched to those portions of the Microsoft Office document.7 Click Apply.132 McAfee Data Loss Prevention 9.2.2 Product Guide