McAfee Data Loss Prevention 9.2.2 Product Guide

Managing policies and rulesManage rules 97 Examine the design of the rule, and determine why it produced the incorrect hit.If you launch the Edit Rule page directly from the Tune Rule button on the Incidents or Incidents Detailspages, the Exceptions page is populated with the current values of the rule under the tab. You canthen modify the values as needed.8 Change one or more parameters that you think might produce a better result.For example, if the text pattern of your rule matched all Microsoft Office documents, but youneeded only spreadsheet data, deselect Select All in the Office Applications category to retrieve onlyMicrosoft Excel documents.9 Click Test Rule.The Advanced Search page appears and displays a text report of all of the parameters of the rule.10 Modify the rule to eliminate the parameters that produced the incorrect results.The Advanced Search page appears, displaying a text report of all of the parameters of the rule.11 Repeat the process until your rule retrieves the correct results.12 Click Save.Copy rules to policiesRules can be copied from one policy to another.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a Policy Name to open the Edit Policy page.3 Click a Rule name to open a rule.4 In the Rule Name field, enter a new name.If a similar name is needed, add a single character or space to distinguish it from the original.5 (Optional) Type in a new description.6 Assign the rule to a different policy by selecting one from the Policy menu.The new rule will be stored in the selected policy.7 Select a Severity to rate the importance of the rule.8 Set the Inherit Policy State to Enabled.If the rule is to be tuned, leave it in Disabled state so it can be run independent of its policy until itreports the needed results reliably.9 Make any needed changes to the parameters of the rule.10 Click Save.11 Open the policy containing the new rule to verify that it has been copied over.McAfee Data Loss Prevention 9.2.2 Product Guide 215