McAfee Data Loss Prevention 9.2.2 Product Guide

9Managing policies and rulesIdentify exceptions to rulesIdentify false positivesIdentify incidents as false positives by making a note of the incorrect parameters on the Edit Rules page.You can tune the rule in the same operation.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 On the dashboard, locate a false positive incident.3 Identify the incident as a false positive in one of two ways. Edit Rule• Select the checkbox of the incident and click Tune Rule.• Click Details, then click Tune Rule.4 When Exceptions page opens, add a note to the parameter that is producing the false positive.5 If appropriate, edit the values to redefine the exception.6 Click Save.Define exceptionsDefine exceptions by searching captured data until you find the parameters that work correctly. Thenadd the useful parameters and the exceptions to a rule.Eight exceptions are supported for each rule, so you can define precisely the conditions that are not tobe matched. The capture engine will drop any incident matching the exceptions.Exceptions apply to real‐time searches only.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy name, then a rule that needs an exception definition, or add a new rule.3 Click the Exceptions tab.4 Open Exception 1, enter a note describing the exception, then use the components to define theexception you found while searching.5 If additional parameters are needed, create more exceptions.6 Click Save.218 McAfee Data Loss Prevention 9.2.2 Product Guide