McAfee Data Loss Prevention 9.2.2 Product Guide

9Managing policies and rulesManaging policies8 After the rule retrieves incidents, click Details and examine the Incident Details page.If a user ID or email address is reported, you can add that information to your rule so that you canmonitor all of that user's transactions.9 If you find significant results, add an action rule to the rule and redeploy it.For example, you might block, quarantine, redirect, or notify an administrator of any newviolations.Managing policiesPolicies are containers for groups of rules that monitor conditions related to a single issue.When an incident is produced by the rules of a policy, the Group by window displays the name of thepolicy that produced it.Standard policies are installed on McAfee DLP Monitor, McAfee DLP Discover, or McAfee DLP Preventappliances before shipment. Characteristics like geographic location, industry sector, and businesstype might determine which ones are active. But customized policies can be created at any time toapply to specific business operations.There are three basic policy types.Table 9-1 Policy typesPolicy type Function ExamplesCompliance Regulatory SOX, HIPAA, PCI, PII, GLBA, FISMA, ITAR, SB 1386Intellectual propertyHigh Business ImpactinformationContentsCompetitive Customer lists, Price/Cost lists, Target Customer lists, newdesigns, company logos, source code, formulas, processadvantages, pending patentsFinancialPolicy inheritancePolicy activationActivate or deactivate policiesBoard minutes, financial reports, merger/acquisitiondocuments, product plans, hiring/firing/RIF plans, salaryinformation, acceptable use standardsPolicy inheritanceInheritance establishes the relationship of a rule to its policy.Policies can be in Active or Inactive states. They are Inactive by default, and must be set to an Active statebefore their rules can be matched to data. Rules can also be active or inactive (enabled or disabled),but the state is not set by the user. The Inherit Policy State of a rule determines whether it is Enabled orDisabled.For example, if the Inherit Policy State of a rule is set to Enabled, it mirrors the state of the policy, and runsat the same time as the other rules. But if it is set to Disabled, the rule does not inherit the state of thepolicy, whether it is Active or Inactive.When a rule is first created, its inheritance state is Disabled by default, because it might have to betested before it is finalized. During the tuning process, a rule must be run, its hits evaluated, and itsparameters modified until it produces significant incidents and events. Once it is producing reliableresults, its connection to its policy state can be Enabled so that all of the policy's rules (assuming thepolicy is in an Active state) can run as a unit.206 McAfee Data Loss Prevention 9.2.2 Product Guide