McAfee Data Loss Prevention 9.2.2 Product Guide

7Using the Incidents dashboardTypical scenariosTable 7-2 Troubleshooting tips (continued)RequirementData must be accessible (McAfee DLPMonitor).Scans must be set up, or data must beregistered (McAfee DLP Discover).Events must be generated (McAfee DLPEndpoint).TipIn the Capture tab, enter a common keyword.In the Classify tab, verify that Scan Operations are active;on the Policies tab, check for Registered Documents.In the System tab, check Endpoint Configuration | ManageEndpoints to verify that an Endpoint policy is beinggenerated.Typical scenariosIncidents can be viewed, sorted, filtered, assigned to cases, and used in reports to display the mostsignificant violations found by McAfee DLP systems. Some typical use cases follow.Tasks• Find policies violated by a user on page 174If you have a lot of incidents to sort through, it might be hard to find the ones that arerelated to a particular user.• Find high-risk incidents on page 175When you have a high volume of violations to search through, it might be difficult to findthe most significant ones.Find policies violated by a userIf you have a lot of incidents to sort through, it might be hard to find the ones that are related to aparticular user.This case helps you to find policies that were violated by a user by keying on attributes that identifythe user.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 Select UserID, UserName, or UserEmail and equals, then type the user's ID, name, or email address in thevalue field.If you don't have exact information but want to guess at the identity of a sender or recipient, selectthe Sender or Recipient filter, add a like or not like condition, and type a string that might match somecharacters in the user's ID, name or email address.3 In the Group by menu, the policies violated by the user are listed.• Click a policy to display the incidents generated by its rules.• Click an incident and select Details to determine the policy and rule that generated it.If the policy did not generate incidents, it is not listed.4 From the Filter by menu, select a time from the Timestamp sub‐menu.174 McAfee Data Loss Prevention 9.2.2 Product Guide