McAfee Data Loss Prevention 9.2.2 Product Guide

10Managing action rulesHow McAfee DLP Prevent uses action rulesHow McAfee DLP Prevent uses action rulesDepending on whether McAfee DLP Prevent is configured with an MTA (Mail Transport Agent) or aproxy server, McAfee DLP Prevent can take up to eight different actions when a significant incident isdetected.McAfee DLP Prevent might use action rules to perform any of the following actions:• Allow email that is determined to be legitimate.• Block confidential data breaches.• Bounce email that violates policies.• Encrypt authorized transmissions.• Monitor traffic and record incidents in a system log.• Notify supervisory personnel of a violation.• Quarantine suspicious traffic.• Redirect messages that violate policy.McAfee DLP Prevent can also capture network traffic for later forensic analysis, and block thetransmission of sensitive data sent using specific protocols (for example, HTTP, SMTP, HTTP POST,etc.).How McAfee DLP Endpoint uses action rulesDepending on what protection rules McAfee DLP Endpoint is configured to deploy, up to nine differentonline and offline actions can be applied when a significant event is detected.McAfee DLP Endpoint might use action rules to perform any of the following actions:• Block confidential data breaches. • Quarantine reported events.• Delete email that violates policies. • Request justification for blocked actions.• Encrypt authorized transmissions. • Tag files.• Monitor events. • Store evidence of violations.• Notify users of violations.Online and Offline optionsFor each reaction provided by a protection rule, you must select an Online, Offline status, or both.These terms refer to where a computer is located in relation to the internal network, so they might beconsidered "on‐site" or "off‐site".Specifically, online/offline status is determined by whether or not the ePolicy Orchestrator IP addresscan be resolved with a DNS query. In other words, a user who is offline is not in contact with anetwork domain controller.222 McAfee Data Loss Prevention 9.2.2 Product Guide