McAfee Data Loss Prevention 9.2.2 Product Guide

Managing policies and rulesIdentify exceptions to rules 9Delete rulesDelete rules individually or in groups.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy name to open the Edit Policy page.3 Select the rules to be deleted.4 Delete rules in one of two ways.• From the Actions menu, select Delete.• In the Delete column, click the trash can icon of the rule to be deleted.Modify rulesModify rules to assure their efficacy. Rules can be modified many times, or tuned, before they arefinalized.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy name to open the Edit Policy page.3 Click a rule name to open the Edit Rule page.4 Make changes to parameters as appropriate.5 Click Save.Identify exceptions to rulesWhen rules literally match network data but do not produce useful information, the resulting incidentis referred to as a false positive. Adding exceptions to rules that produce false positives identifies theattributes that match irrelevant data, and keeps the classification engine from reporting them to thedashboard again.Tune rules using historical data to prevent false positive matches.McAfee Data Loss Prevention 9.2.2 Product Guide 217