McAfee Data Loss Prevention 9.2.2 Product Guide

9Managing policies and rulesTypical scenarios3 Open the Content category.The Edit Rule page appears.4 From the Content menu, select Concept | is any of, then click ?.The Concept pop‐up menu appears.5 Select the Select All checkboxes on financial concept categories, or open them and select specificdocument types.You might select BANK‐STMT from the Banking and Financial Sector category, or CONFIDENTIALfrom the Corporate Financial category.6 Click Apply.7 Click the Action tab.8 Click + and Add Action, then select the Block and Notify Sender action to protect the material and notifythe sender of the violation.9 Click Save.Modify alphanumeric patterns in rules that produce falsepositivesIf you are looking for personal identification numbers that violate privacy standards, but product partnumbers that also match the pattern are being erroneously reported, you can define an exception thatwill eliminate those results.The exception you create refines the rule to recognize only the patterns in the PINs so that onlylegitimate privacy violations are reported to the dashboard.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 Select an incident that reported a part number as a privacy violation.3 In the Group by menu in the left pane, select Rule, then the privacy rule that produced the errors.All incidents produced by that rule are listed.4 Select the checkboxes of the false positive incidents.5 Click Tune Rule.The Edit Rule page appears with Exceptions selected. All of the parameters on the page are rule valuesthat you can modify.6 Type in text describing the exception in the Notes box, then redefine the parameters.For example, if the part number has the same pattern as an identification number, but is precededby "PN#", add a Content element that specifies Keywords | contain none of | .204 McAfee Data Loss Prevention 9.2.2 Product Guide