McAfee Data Loss Prevention 9.2.2 Product Guide

5Integrating McAfee DLP EndpointTagging and trackingspecific documents by applying the appropriate tag. After they are created, manual tags are pushed tousers at endpoints by the McAfee Agent client.The ability to classify documents with tags encourages users to take independent action to protect fileswithin their areas of responsibility. For example, users at medical facilities might be trusted to applyHIPAA tags to patient records that must be kept confidential by law.If the Allow Manual Tagging checkbox is not selected, file tagging can still be done manually — but only byadministrative users, who can tag or remove files individually or in groups.Application-based taggingTags that identify applications are applied when a file is saved using a specific application, and the tagdisplays whenever the user opens the file. When used with other properties of a unified rule, they canbe used to control files created by that application.Simple application‐based tagging rules monitor or block all files created by the application, butaddition of other rule parameters can qualify or extend those actions when used in a more specificcontext.Application tagging might be only one property of a unified rule. When an application definition isapplied, or applications sharing a particular strategy are used (for example, all applications areeditors), an application tag might be applied to a group of documents.How application tagging worksApplications can be deployed with tagging and protection rules by creating application definitions, thenapplying them to unified rules. They can also be applied manually, or by using a Discover CIFS scan.Importing an applications list and creating application definitions are efficient ways of handlingapplication‐related tagging and protection rules.For example, system administrators might import a list of all relevant applications available within theenterprise, create application definitions based on their needs, and implement these definitions withrelevant rules to maintain policies.When a user opens files with an application that is defined in a rule by an application definition, itproduces one event on the McAfee DLP Monitor per application session, not per sensitive file opened.The event includes all files that matched the specified conditions in that application session. Forexample, if the Store Evidence parameter is selected on the Data‐in‐Use action rule page, only files from thecurrent session are stored.The Enterprise Application ListThe Enterprise Application List contains a set of commonly‐used applications. You can add applicationsto the list, delete them, or add an application definition that bundles related applications.When an application is added to the Enterprise Application List, application‐based tags are applied tomatching files when they are found.Applications must be defined in the Enterprise Applications List before they can be referenced in a rule.If the applications you want to use do not appear on the list, you must add them.When an Endpoint application tag is used with unified rule parameters and associated action rules,files that are detected on endpoints, in network traffic, and repositories can be controlled with onerule. Application‐based tags might be used alone or collected in application definitions.For example, users who open Adobe Photoshop files on endpoints or on network shares might beallowed to view, but not modify those files — or they might not be visible at all. But before buildingsuch a rule, the .psd executable file would have to be added to the Enterprise Action List so that it is150 McAfee Data Loss Prevention 9.2.2 Product Guide