McAfee Data Loss Prevention 9.2.2 Product Guide

9Managing9policies and rulesPolicies are made up of groups of related rules that are matched to data and events in network trafficand repositories. When a rule hits on an object that matches the rule definition, an incident isgenerated and reported.Related rules are collected in policies that target specific issues. Many standard policies arepre‐installed on McAfee DLP Monitor, and users can choose which ones to activate and deploy.For example, the Payment Card Industry policy contains four rules. Two contain concepts that useregular expressions with algorithms to match any type of credit card number, and two monitor thedata contained in magstripes.After McAfee DLP Monitor has captured and processed data for some time, violations that are found bythe rules under standard policies are reported to the Incidents dashboard.When McAfee DLP Endpoint is deployed as a standalone product, all of its deployed rules are managedby a single global DLP policy. When it is installed as part of the network DLP product suite, its globalpolicy is woven into the unified policy design, and the global policy is implicit (it is not visible on theMcAfee DLP dashboards as a separate entity). Violations are reported as "events" that can be viewed onthe Data‐in‐Use dashboard.ContentsHow policies and rules can be usedTypical scenariosManaging policiesAdd, modify, and deploy policiesManage rulesIdentify exceptions to rulesHow policies and rules can be usedPolicies and rules can be used to analyze trends and customize your protection strategy. You can alsouse existing policies by modifying their parameters.Analyzing trends in data matchingYou can analyze trends in data matching by using the Chart and Compare features on the Edit Policy andEdit Rule pages.By checking these graphical aids for each of your active policies, you can easily analyze the trend ofthe rule hits and the number of matches found by each rule, and tune them if they are not producingsignificant results consistently.McAfee Data Loss Prevention 9.2.2 Product Guide 199