McAfee Data Loss Prevention 9.2.2 Product Guide

Integrating McAfee DLP EndpointTagging and tracking 510 Select Tags — Application Based and click ?.The Application Definition pop‐up menu appears.The Application Definition condition can be used for the Application Protection Rule or combined withapplication tagging.11 Click Apply.12 Click + to add another element.13 Select Apply Tag Label and select a tag from the pop‐up menu.14 Click Apply, then Save.Application definitionsApplication definitions consist of groups of related applications. They are bundled by type to facilitatetheir use in unified rules.When an application definition is created, it is automatically added to a template that can be used inrules to find any files created by the applications in the defined group.Application definitions can be identified by any of the following parameters:• Command line — Allows command line arguments, for example: java‐jar, that can controlpreviously uncontrollable applications.• Executable file hash — The application display name, with an identifying SHA‐2 hash.• Executable file name — Normally the same as the display name (minus the SHA‐2 hash), butcould be different if the file is renamed.• Original executable name — Identical to the executable file name, unless the file has beenrenamed.• Product name — The generic name of the product, for example Microsoft Office 2003, if listed inthe executable file's properties.• Vendor name — The company name, if listed in the executable file's properties.• Window title — A dynamic value that changes at runtime to include the active filename.• Working directory — The directory where the executable is located. One use of this parameter isto control U3 applications.With the exception of the SHA‐2 applications, all parameters accept substring matches.You can add applications to application definitions from the Enterprise Applications List, or create themdirectly.The same application can be included in several application definitions, and can therefore be assignedmore than one of the four strategies. McAfee DLP Endpoint software resolves potential conflictsaccording to the following hierarchy of application types: archiver > trusted > explorer > editor. Inother words, editors have the lowest ranking. For example, if an application is an editor in one definitionand anything else in another, McAfee DLP Endpoint software does not treat the application as an editor.McAfee Data Loss Prevention 9.2.2 Product Guide 153