McAfee Data Loss Prevention 9.2.2 Product Guide

10Managing action rulesAction rules work by applying actions when rules generate incidents. Actions might be preventive,corrective, or protective, and the actions available depend on whether McAfee DLP Prevent or a proxyserver is used to implement them.When a rule produces an incident, use of an action rule can resolve problems in network traffic, triggera remedial action in data repositories, or react to an action that has been taken at a network endpoint.Differences between action and protection rulesMcAfee DLP Endpoint protection rules are pre‐configured with reactions to events that occur atendpoints. Because the design of endpoint and network McAfee DLP products differs, action andprotection rules work in different ways.• McAfee DLP network products allow action rules to have multiple actions that are attached to manydifferent rules. Each of those rules can deploy the action once to network traffic, a repository, orendpoints.• The McAfee DLP Endpoint product uses protection rules to apply reactions to many differentendpoints that might be online (on‐site) or offline (in contact with a domain controller) when aviolation occurs.How action rules work in different McAfee DLP productsPreventive, corrective, or protective actions are applied depending on whether they are used inData‐in‐Motion, Data‐at‐Rest, or Data‐in‐Use.• If preventive action is to be taken, action rules are applied to Data‐in‐Motion, which monitors emailand webmail in network traffic. This feature requires configuration of an MTA (Mail TransportServer) or proxy server with McAfee DLP Prevent, which must be registered to McAfee DLPManager.• If corrective action is to be taken, action rules are applied to Data‐at‐Rest, which identifies data at riskin network repositories. This feature requires McAfee DLP Discover, which must be registered toMcAfee DLP Manager.• If protective action is to be taken, action rules are applied to Data‐in‐Use, which identifies problemsat endpoints. This feature requires McAfee DLP Endpoint, which must be registered to McAfee DLPManager.If McAfee DLP Monitor and McAfee DLP Discover devices are both managed by McAfee DLP Manager,every rule can be configured to deploy one action of each of the three incident types.ContentsHow McAfee DLP Prevent uses action rulesHow McAfee DLP Endpoint uses action rulesHow McAfee DLP Discover uses action rulesAdd, modify, or delete action rulesMcAfee Data Loss Prevention 9.2.2 Product Guide 221