McAfee Data Loss Prevention 9.2.2 Product Guide

8Working with casesManage case permissionsTask1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 Find credit card violations on the dashboard, then select one or more incident checkboxes.3 Click Assign to Case, then select New Case or Existing Case from the sub‐menu.• If you select New Case, complete the Case Details page, and click Apply.• If you select Existing Case, choose a case on the list, click its Assign link, complete the Case Detailspage, and click Apply.If you cannot see the Assign column, expand your dashboard.4 From the Options menu, select Customize Case Config and add attributes that might help you to put eachincident into a customized context.For example, you might add a source field that allows you to type a note on the Case Details pageabout the origin of the incident.5 From the Options menu, select Customize Columns and rearrange the dashboard to display only the mostuseful attributes of the object found.6 From the Options menu, select Customize Case Config and select Owner and Submitter checkboxes to keepthe stakeholders updated on the progress of the case.7 On the Case List, open the credit card violation case and examine each of the incidents in the case tofind out what they have in common.8 Update the Notes field on the Case Details page each time a new violation is added to the case, orwhenever you or your collaborators find another piece of the puzzle.By cooperating in developing the case, you and your colleagues can act as a team to find out howcredit card violations are generated, devise a process to prevent more of them, and if the data lossis not accidental, build a legal case against the perpetrators.Manage case permissionsThere are two levels of case permissions: administrators can assign case permissions to groups ofusers whose roles require case access; and users who have been given case permissions can manageaccess to specific cases.Administrators have permissions to assign, manage, export, and delete case permissions to usergroups, and they can also override permissions assigned to individual users. Case users can assignread, write, and delete permissions for a case to other groups or individual users.Access to the case permissions page requires at least case‐level read and delete permissions, plustask‐level management permission assigned by an administrator. If write permission is assigned on thecase management page, read access is included, even if that permission is not explicitly assigned.190 McAfee Data Loss Prevention 9.2.2 Product Guide