McAfee Data Loss Prevention 9.2.2 Product Guide

Managing action rulesAdd, modify, or delete action rules 104 From the Actions categories, select the components of the action rule.Selection of components in Data‐at‐Rest or Data‐in‐Use action rules determines whether or notadditional information is needed.5 Click Save.Apply action rulesApply action rules to rules monitoring data in motion, scanning data at rest, or identifying significantevents on endpoints. When an incident is detected, the applied action rule is activated.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 Select the action rule to be applied.• For Data‐in‐Motion, open the Prevent Action category and select an action from the list.• For Data‐at‐Rest, open the Remediation Policy category and select an action from the list.• For Data‐in‐Use, open the Data‐in‐Use Policy category and select one or more actions.3 Click Save.Assign responsibility for actionsAssign responsibility for actions by setting up action rules. For example, reviewers might be assignedto monitor results when incidents are found by a rule containing an action rule.The Incident Reviewer parameter applies to Data‐in‐Motion and Data‐at‐Rest action rules. It cannot be used toreact to Data‐in‐Use events.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 Click a rule.The Edit Action Rule page launches.3 From the Incident Reviewer menu, select a group or user.The existing groups and users are displayed.4 Click Save.Change incident status with action rulesChange the status of incidents on the fly by defining action rules that are applied when they are found.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.McAfee Data Loss Prevention 9.2.2 Product Guide 225