McAfee Data Loss Prevention 9.2.2 Product Guide

2Using2McAfee DLP MonitorThe McAfee DLP interface supports basic and advanced searches. You can save searches as rules touse the same parameters again.You can learn to form queries by examining some of the standard rules under the policies listed underthe Policies tab. The parameters used in existing rules might suggest combinations that are useful infinding the data you need.However, searching is role‐based, and if you need permission to use this feature, consult youradministrator.Logical operators are supported in value fields in the interface, but only when using concept andkeyword conditions under the Content category.ContentsHow data is captured and processedTypical scenariosSearch basicsUsing logical operators in queriesSupported content typesRules used by the capture engineFinding incidents using keywords and conceptsUse concepts to find incidentsFind data by time, transmission method, or locationSearching for email files or IP addressesFinding document properties in contextHow data is captured and processedThe capture engine classifies and parses data by content type. Each object is made up of manyattributes that are stored with it in the databases.The core component of McAfee DLP is a capture engine that allows reassembly of packets that havebeen extracted from network traffic or repositories by McAfee DLP Monitor, McAfee DLP Prevent, orMcAfee DLP Discover.The reassembled objects are classified into object types that are saved in the appliance databases.Each object has many attributes, all of which can be retrieved by queries.McAfee Data Loss Prevention 9.2.2 Product Guide 17