McAfee Data Loss Prevention 9.2.2 Product Guide

5Integrating McAfee DLP EndpointUnified policies and McAfee DLP EndpointAdd a reactionAdd a reaction by adding a Data‐in‐Use action rule.If multiple actions are selected, they will be applied simultaneously when an event is detected. Forexample, a Removable Media reaction might block, monitor, and store evidence of a significant event,whether the device is on‐ or off‐site.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 From the Actions menu under Data‐in‐Use, select Add Action Rule.Endpoint actions can be taken if the detected device is on‐ or off‐site (online or offline). Select oneor both.3 Enter a name for the action rule.4 Select one or more actions to be taken.If the event detected is to be encrypted, provide an encryption key. Consult the updated EndpointEncryption for Files and Folders 4.0 Product Guide for more information.If the event detected is significant, select a Severity from the drop‐down list.If users are to be notified when the event is detected, enter a message. Entering link text or a URLis optional.5 Click Save.After you have created the endpoint action rule, apply it to one or more rules.Apply a reactionApply a reaction by selecting a Data‐in‐Use action rule and adding it to a rule.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies and click on a rule that hasone or more endpoint parameters.• On your McAfee DLP appliance, select Policies and click on a rule that has one or more endpointparameters.2 Click the Actions tab and select Add Action.3 Select one or more Data‐in‐Use actions to be taken when a protected endpoint is detected.4 Click Save.Extending McAfee DLP Discover scans to endpointsRegistered index packages found by McAfee DLP Discover are shared with other McAfee DLPappliances, and also with the McAfee DLP client, which distributes them to endpoints and controls filescontaining registered content.McAfee DLP Endpoint uses document registration and location‐based tagging to identify sensitive dataat rest on endpoints. Confidential files that were created after a tag was applied to a group of filesmight not be detected by a rule, so they could be accessed by an endpoint user. But if the location isscanned, those files at risk will be protected because they are in a defined location path.146 McAfee Data Loss Prevention 9.2.2 Product Guide