McAfee Data Loss Prevention 9.2.2 Product Guide

Managing policies and rulesTypical scenarios 97 If there is no difference in the pattern, consider eliminating another element the incidents have incommon.For example, if all of the reported part number incidents come from the same department, create aSource/Destination element that specifies an email domain or UserOrganization.8 Click Save.After the rule runs, evaluate the incidents retrieved and make revisions if the results still do notmeet your criteria.Track intellectual property violationsSuppose you know that your company has lost intellectual property to a Chinese firm, and you suspectthat the leak came from an insider in your Shanghai branch. You can create rule parameters that findthe leaked documents and the suspected violator, then monitor his or her activities to build a legalcase and prevent any more data loss.Before you beginYou must have an Active Directory server and McAfee ® Logon Collector connected to theMcAfee DLP system.You can track down the violation by identifying the information compromised, the recipient of theinformation, and the suspected user by creating rules with parameters that will pull relatedinformation from the directory server.If you don't know the user's name, you can gradually develop his identity by searching for users inShanghai, searching the user groups in your Engineering division, and identifying a sub‐group thatmight contain the user. You might not know in advance what you might find, but you can use what youdiscover to ask the next logical question.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Open an existing policy, or create a new one.3 From the Actions menu, select Add Rule.The Add Rule page appears.4 Type in a name and optional description.5 Open the Content category and add content that describe the lost intellectual property.For example, you might add keywords, an exact phrase found in the leaked documents, a file type,or a concept that will retrieve similar content.6 Open the Source/Destination category and add a destination that might describe the recipients of thedata.For example, you might have an IP addresses, domains, or a geographic locations that will help todefine the recipient.7 Click Save.McAfee Data Loss Prevention 9.2.2 Product Guide 205