McAfee Data Loss Prevention 9.2.2 Product Guide

5Integrating McAfee DLP EndpointUnified policies and McAfee DLP EndpointPolicy modifications are posted every 30 seconds to keep up with updated rule definitions, but you candefine a more conservative transfer interval (up to two hours, or 7200 seconds) by editing the TimeDuration for Posting Policy Definition setting.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Sys Config | Endpoint Configuration |Miscellaneous and click Manage Endpoints.• On your McAfee DLP appliance, select System | Endpoint Configuration | Miscellaneous and click ManageEndpoints.2 Select the Generate Policy for Endpoint checkbox.3 In the Time Duration for Posting Policy Definition field, enter a number between 30 and 7200 seconds.The policy is generated, posted from McAfee DLP Manager to ePolicy Orchestrator, saved in thedatabase, forwarded to the connected agents, and updated at the defined interval.4 Click Submit.Unified policies and McAfee DLP EndpointIn McAfee Host DLP, rule definitions shared a single global policy definition for all rules. In the unifiedpolicy design, the global policy is used to add McAfee DLP Endpoint functionality to the networkproduct suite.The networked products protect email and webmail through the unified rules, but there is someduplication of functionality because McAfee Host DLP (McAfee DLP Endpoint) already protected thatdata.Unified rules specifically incorporate Endpoint parameters, such as the protection rules and tagging, butthe Content category and much of the Source/Destination category contain additional parameters that canbe used on endpoints as well as networks. For example, the GeoIP location feature is supported onlyby the network products.The unified rules can also use data captured by McAfee DLP Monitor or scanned by McAfee DLPDiscover scans to adapt to changing conditions.Because all of these capabilities are integrated into the unified policy design, one rule can beconfigured to add incidents and events to all three dashboards (Data‐in‐Motion, Data‐at‐Rest, Data‐in‐Use). Forexample, a Payment Card Industry policy that has been deployed on McAfee DLP Manager can be usedto identify privacy violations in network traffic, in data repositories, and on endpoints.You can use templates to add frequently‐used actions and conditions to a rule, increasing its efficiencyand scope. If the rule is to be applied to endpoints, select Template from the Endpoint category and click ?to launch the available selection. If none are available, add a new one on the Policies | Templates | AddTemplate page using the Endpoint component type.Endpoints might be computer‐ or user‐defined, but computer assignment groups are outside of thescope of unified policy management, and can only be defined in ePolicy Orchestrator. Endpoints can bemonitored from McAfee DLP Manager by adding user‐based parameters (such as groups andorganizational units) to a rule.142 McAfee Data Loss Prevention 9.2.2 Product Guide