McAfee Data Loss Prevention 9.2.2 Product Guide

Integrating McAfee DLP EndpointTypical scenarios 58 Click the Action tab, click Add Action, and select an action from the Data‐in‐Use actions.In this case, you might want to add an Email or WebPost reaction to block, monitor, and storeevidence of the activity, whether they are found online or offline (in computers that are on‐site, ordisconnected from the network). Those reactions also allow notification and requests forjustification, so you might want to modify the rule if those actions are not needed.9 Click Save.When you check the Data‐in‐Use dashboard, you might find the strings you identified reported asincidents.Keep data from being printed to fileMcAfee DLP Endpoint can be configured to block print functionality that allows printing to the AdobePDF or Microsoft Image Writer file types. If the Protect PDF/Image Writers rule is deployed, McAfee DLPprinter drivers are installed in place of third party drivers. This prevents users from printing sensitivedata to a file.For example, if you suspect that local users are attempting to print and email corporate confidentialdocuments, you might use the following procedure to detect that activity, extract the content of thedocument to the evidence server, and notify a manager that the attempt has been made.McAfee DLP Endpoint uses Microsoft Word and Adobe Reader plug‐ins to improve performance.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy and a rule, or create new ones.Make sure the policy is active and the Inherit Policy State state of the rule is set to Enabled.3 On the Add Rule or Edit Rule page, select Template from the Content category menu and click ?.The Templates pop‐up menu appears.4 From the pop‐up menu, select the Select All checkbox for Office Applications and Apply.5 From the Source/Destination menu, select Email Address and enter the user's email address in the valuefield, or select the Any Email Address checkbox.6 From the Endpoint menu, select Protect PDF/Image Writers, click ?, select the Enable checkbox, and clickApply.7 Click the Actions tab and Add Action, then select Printer Reaction from the Data‐in‐Use menu.Review the reaction settings in the Actions column. If they do not match your objectives, go to ActionsRules and edit the rule, or create a new one.8 Click Save.When an attempt is made to print office documents to common file types, the reaction defined inthe action rule will be applied.McAfee Data Loss Prevention 9.2.2 Product Guide 133