McAfee Data Loss Prevention 9.2.2 Product Guide

7Usingthe Incidents dashboardIncidents reported by the McAfee DLP products are captured, detected, or generated by the McAfeeDLP products and stored in three different databases.Table 7-1 McAfee DLP dashboardsDashboardDefinitionData‐in‐Motion Incidents are produced by McAfee DLP Monitor when its rules match data in thenetwork stream.Data‐at‐RestData‐in‐UseContentsIncidents are produced by McAfee DLP Discover when a scan finds sensitive data innetwork repositories or databases.Events are produced by McAfee DLP Endpoint when data violations are found atnetwork endpoints, and they are copied over from McAfee ePolicy Orchestrator toMcAfee DLP Manager.Finding incidentsTypical scenariosSort incidentsFilter incidentsGetting incident detailsSet up incident viewsGenerating reportsCustomizing dashboardsControlling dashboard settingsFinding incidentsIf incidents are being generated by the McAfee DLP products but are not reported to the dashboards,check to verify that all requirements are met.Table 7-2 Troubleshooting tipsRequirementPolicies must be activated.A time frame must be set.Systems must be up.Systems must be processing data.Previous incident configurations must bereleased.Capture filters must be configuredcorrectly.TipIn the Policy tab, check the State column.In the Filter by frame, check the Timestamp.In the System tab, check the Health icons.In the System tab, click the Statistics icon.In the Filter by frame, click Clear All.In the System tab, check to see what Capture Filters areactive.McAfee Data Loss Prevention 9.2.2 Product Guide 173