McAfee Data Loss Prevention 9.2.2 Product Guide

Managing policies and rulesAdd, modify, and deploy policies 9Add policiesAdd custom policies to the standard policies that are pre‐installed on McAfee DLP appliances.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Policies.• On your McAfee DLP appliance, select Policies.2 From the Actions policy, select Add Policy.3 Type in a name and optional description.4 Select an Owner.Standard policies are owned by admin by default. If another policy owner is needed but not listed,add the user to a new or existing user group.5 Set State to Active if you are going to use the rule immediately. An inactive policy cannot produceincidents.6 Select Data‐at‐Rest or Data‐in‐Motion if you want to limit the rule to static or dynamic data.7 Select one or more device checkboxes to publish the policy to specific appliances. Select None if youwant to publish the policy at a later time.8 Click Save.The next step is to add rules. You will also want to assign access rights to the policy at UserAdministration | Groups | Policy Permissions.Policy field definitionsPolicy field definitions are explained to assist in setting correct values.Table 9-2 Policy field definitionsOptionNameDescriptionOwnerStateRegionSuppressincidentsDevicesDefinitionPolicy names must use only alphanumeric characters. Non‐alphanumeric charactersmight generate an error message.Optional.A group whose members can access the policy. If you are logged in as a member ofone of the default groups, only that group is displayed, and other options are notavailable.Policies can only have one of two states: active or inactive. New policies are inactiveby default to allow users to build a customized system. Using only the policies thatmeet their objectives optimizes performance and makes the most efficient use of theMcAfee DLP system.Policies usually belong to a group that is defined by a region. The default region isNorth America.Suppress incidents to keep them from being reported to dashboards while rules arebeing tuned. Selecting Data‐in‐Motion suppresses all incidents found in moving networktraffic. Selecting Data‐at‐Rest suppresses all incidents found in static file or databaserepositories. There is no suppression option available for Data‐in‐Use events.McAfee DLP devices that are attached to McAfee DLP Manager are listed so that youcan deploy them by publishing policies to one or more of them. The None checkbox isused for policies that are not yet deployed. Selecting the Host checkbox creates apolicy that will be deployed to the host when an endpoint is registered.McAfee Data Loss Prevention 9.2.2 Product Guide 209