McAfee Data Loss Prevention 9.2.2 Product Guide

9Managing policies and rulesManage rulesDisable rule inheritancePre‐installed policies contain rules that inherit the active or inactive states of their policies by default.They are designed to act as a group and run whenever the policy runs.New rules are disabled by default because they have not yet been proved to be effective, and theirrule definitions might need modification. After tuning and testing, new rules should be enabled so thatthey run at the same time as the other rules of the policy.Clone a standard rule and use its parameters to build a new one. Disable inheritance immediately todisconnect it from the original policy and rule.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a Policy Name to open the Edit Policy page.3 Click a Rule name to open the Edit Rule page.4 Change the Inherit Policy State parameter to Disabled.5 Click Save.If the rule needs further definition, consider tuning it until it returns the results you need.Reconfigure rules for web trafficReconfigure rules to monitor web traffic by modifying them to look for HTTP activity.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Select a policy, then a rule that you want to adapt to web traffic.The Edit Policy page appears.3 Enter a new name and an optional description.4 Click Save As.The Save As button appears when you start typing in the name field.5 In the Protocol category, click X to delete any existing protocol parameters.If there are none, the X button is not accessible.6 Select Protocol | is any of, then click ?.The Protocols pop‐up menu opens.7 From the Internal Protocols categories, select the HTTP checkboxes.8 Click Apply and Save.216 McAfee Data Loss Prevention 9.2.2 Product Guide