McAfee Data Loss Prevention 9.2.2 Product Guide

9Managing policies and rulesManage rules3 On the Edit Policy page, select a Devices checkbox.4 Click Save.Manage rulesRules contain patterns that are matched against data in network traffic and repositories to produceincidents and events. When the rules of a policy detect a significant object, it is saved in a database,then reported to a dashboard.Standard policies that are pre‐installed on McAfee DLP Monitor, McAfee DLP Discover, or McAfee DLPPrevent appliances contain groups of related rules. The rules filed under them are enabled by defaultso that they will run whenever the policy runs.New rules are disabled by default because their states must be defined before they are used with apolicy. Usually they are tuned to assure efficacy before state is defined.Custom rules can be created at any time to address issues specific to business operations. The systemcan manage 512 active rules, but if that limit is exceeded, some can be deactivated to allow additionof new rules.Users' permissions to manage rules depend upon group membership, which must be configured by anadministrator.Tasks• Add rules on page 213Add rules by searching captured data, then saving the search when it returns reliableresults.• Find rules on page 213Find existing rules by typing a rule name or keyword into the Find Rule by Name field.• View rule parameters on page 214View rule parameters by opening the policy the rule is filed under, then opening the rule.• Tune rules on page 214Tune rules by testing them on historical data before applying them to data captured in realtime. By testing each rule before its policy is applied, you can eliminate parameters thatproduce false positives.• Copy rules to policies on page 215Rules can be copied from one policy to another.• Disable rule inheritance on page 216Pre‐installed policies contain rules that inherit the active or inactive states of their policiesby default. They are designed to act as a group and run whenever the policy runs.• Reconfigure rules for web traffic on page 216Reconfigure rules to monitor web traffic by modifying them to look for HTTP activity.• Delete rules on page 217Delete rules individually or in groups.• Modify rules on page 217Modify rules to assure their efficacy. Rules can be modified many times, or tuned, beforethey are finalized.212 McAfee Data Loss Prevention 9.2.2 Product Guide