McAfee Data Loss Prevention 9.2.2 Product Guide

Managing policies and rulesManage rules 9Add rulesAdd rules by searching captured data, then saving the search when it returns reliable results.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting.• On your McAfee DLP appliance, select Capture.2 Select either Basic Search or Advanced Search.3 Enter a query that might retrieve significant results. If significant incidents are reported, do one ofthe following:• Click Save as Rule.• Modify the parameters until the needed results are returned, then click Save as Rule.The Edit Rule page appears.4 Enter a rule name and add an optional description.5 Assign the rule to a policy by selecting one from the Policy menu.Store the new rule in a policy containing rules like it.6 Select a Severity to rate the importance of the rule.7 In the Inherit Policy State area, select the Enabled radio button.If the rule is to be tuned, leave it in Disabled state so it can be run independent of its policy until itreports the needed results reliably.8 Make any needed changes to the parameters of the rule.9 Click Save.Find rulesFind existing rules by typing a rule name or keyword into the Find Rule by Name field.The policy that contains the rule you want to find must be listed on the Policies page, but need not beactive. For example, if you looked for the word Passport, but had only Asia Pacific region policieslisted, you would find Chinese, but not Canadian passport numbers.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 In the Find Rule by Name field, type a rule name or keyword.For example, to find an Australian driver's license rule, type Queensland or Victoria.3 Click Go.McAfee Data Loss Prevention 9.2.2 Product Guide 213