McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorHow data is captured and processedCaptured data is indexed and analyzed in different databases that hold Data in Motion and Data at Rest. Youcan query the repositories directly using the options available in the user interface, or save queriesthat are to be run regularly as rules.Data in Use events are stored in an ePolicy Orchestrator database. The capture engine does not producethese events, so the database cannot be queried.When an object matches a query or rule, the result is reported to the McAfee DLP dashboards as anincident. Incidents can be sorted and filtered according to their attributes so that the most significantinformation can be identified and displayed.You need not search or save rules to get results. Standard policies that contain collections of rulesautomatically search live data in real time to produce incidents.How the capture engine worksThe capture engine captures, analyzes, and stores all network data. When the capacity of the McAfeeDLP Monitor appliance nears capacity, the earliest captured data is wiped by default — but time‐basedwiping can be configured from 30–180 days.The core component of McAfee DLP Monitor is a capture engine that extracts packets from networktraffic. The packets are indexed and analyzed, classified into object types, and saved in databases oncapture partitions. On McAfee DLP Discover appliances, significant data found during scan operationsis sorted and stored.You can query the McAfee DLP Monitor and McAfee DLP Discover databases directly using the optionsavailable in the user interface, and save queries you intend to run regularly as rules.When an object matches a query or rule, the result is reported to the dashboard as an incident.Standard policies that contain sets of rules automatically search captured data to produce incidents, andconcepts that match related parameters to network data can be used as a shortcut to find text‐baseddata quickly.How classification worksMcAfee DLP Monitor captures and indexes all monitored traffic. Placement of the appliance on thenetwork determines what is monitored.After the data is classified and analyzed, incidents can be extracted from the database by rules orqueries. When a query or rule matches any stored attribute, the entire database object it belongs to isreported to the dashboard as an incident.Microsoft Active Directory and OpenLDAP servers can be used with McAfee DLP Manager to extendcapture functionality beyond the local network.Captured data is retrievable from three different locations in the user interface. Attributes of databaseobjects are reflected in matching parameters available on the search, rules, and capture filters pages.There are three methods of extracting data from the capture database.• Extraction by query — Use the parameters available on the Basic and Advanced Search pages to querycaptured data.• Extraction by rules — Use the parameters available on the Add or Edit Rules pages to routinely findand display incidents in captured data.• Extraction by capture filter — Use the parameters available on the Content Capture Filter page to storeor ignore entire categories of captured data, limiting the amount of data that has to be recognizedand indexed by the capture engine.18 McAfee Data Loss Prevention 9.2.2 Product Guide