McAfee Data Loss Prevention 9.2.2 Product Guide

Integrating McAfee DLP EndpointViewing events 5View endpoint eventsYou can view events detected by McAfee DLP Endpoint on the McAfee DLP Manager Data‐in‐Usedashboard.The roles users play in an organization determine what types of events they are allowed to view. Ifyou cannot see them, you might not have the right permissions set. Contact your administrator.Click the column icon above the dashboard to change the display of event attributes. For example, youmight want to display the columns that disclose the origin or destination of an event, its owner, andwhat activity generated it. By clicking Details, you can view more attributes of the event, create a report,or assign it to a case.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 Select the Data‐in‐Use vector.The default Incident Listing page appears.3 Click Details for more information.The Incident Details page appears.4 Click any tab on the page to get additional information about the event.If a document link is available, it will open if the supporting software is installed. If there is anotherlink inside the document, it is likely to be the database object that triggered the incident.Events reported to McAfee DLP ManagerSpecific events are distributed through ePolicy Orchestrator to McAfee DLP Manager dashboards.Administrative Events• Agent enters bypass mode• Agent leaves bypass mode• User returned from safe modeNon‐administrative Events• Device plugged in • Device access• Device unplugged • Web post protection• New device class found • Application file access protection• Network file system protection • Clipboard protection• Removable storage protection • Screen capture protection• Email protection • Discovery• Printing protection • Email Storage Discovery• Network protectionMcAfee Data Loss Prevention 9.2.2 Product Guide 139