McAfee Data Loss Prevention 9.2.2 Product Guide

Integrating McAfee DLP EndpointUnified policies and McAfee DLP Endpoint 5Unified policy content strategyBecause the network product suite uses a classification engine that differs from that used by McAfeeDLP Endpoint, a different content strategy is used to deploy unified rules to endpoints.McAfee DLP Endpoint uses built‐in dictionaries with terms that are commonly used in health, banking,finance, and other industries, and text patterns that identify known strings and complex patternsthrough the use of POSIX regular expressions. File properties and registered document repositories,which are identified by location‐based tags, are also used to classify content, and whitelists define textthat should be ignored by the tracking mechanism.The McAfee DLP Monitor classification engine sorts all data into content types and stores it on theMcAfee DLP appliances. Data is also classified by source and destination (including geographiclocation), file properties, protocols, and database components (including data sorted into tables,columns and rows), and because it is analyzed and parsed, it can also be queried.The attributes of the captured objects can be viewed on any rules page on the unified policiesdashboard, and the same rule definitions can be used to find incidents and violations in networktraffic, data repositories, and on endpoints. Actions can also be pre‐programmed to resolve incidentsand events for all three types of data.Because of these differing data designs, endpoint parameters can be combined with all of the networkproduct parameters that can be defined in unified rules. There is no need for repetitive rule setting,since all protection rules can use the same defined parameters.In a unified policy, rules that have a Content Type specified might match similar file types, even if thatfile type is not specified. For example, if a rule has a Content Type of JPEG specified, matchingconnections with other image types, such as BMP or GIF, will trigger the rule.Integration into the unified workflowMcAfee DLP Endpoint events are integrated into the same workflow as McAfee DLP Monitor, McAfeeDLP Discover, and McAfee DLP Prevent.Through McAfee DLP Manager, all of the McAfee DLP products share the ability to view, group andfilter results in different configurations, get details on the attributes of the objects found, preparereports, and manage related events by adding them to cases.Events detected at network endpoints are stored in an evidence folder and copied over to McAfee DLPManager in a data stream. Because they are not indexed, they are not searchable, but the data sharesall other aspects of the unified workflow.How McAfee DLP Endpoint rules are mappedWhen McAfee DLP Endpoint was integrated into McAfee Data Loss Prevention, its global policy andexisting rule structure had to be adapted to the unified policy design.In the networked product suite, rules are organized under many sets of international policies that canhave multiple owners. Unified policy design preserves this hierarchy by feeding McAfee DLP Endpointparameters into this structure as attributes, or rule types. The merged structure is changed to .McAfee Data Loss Prevention 9.2.2 Product Guide 143