McAfee Data Loss Prevention 9.2.2 Product Guide

Managing action rulesAdd, modify, or delete action rules 102 Open the action rule to be modified.3 Open the Actions components and edit the parameters.4 Click Save.Log actions takenIf a syslog server has been configured to receive log entries, you can log actions to be taken when arule hits.The Syslog Notification parameter applies to Data‐in‐Motion and Data‐at‐Rest action rules. It cannot be used forData‐in‐Use events.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 Click the action rule to be modified.3 Open the Syslog Notification category.4 Select Enable.5 Click Save.Notify users of actions takenNotify users of actions taken when incidents are found by setting up email notifications in action rules.For example, users who are tasked with monitoring results might be automatically informed ofdevelopments for incidents that are collected in cases.The Email Notification parameter applies to Data‐in‐Motion and Data‐at‐Rest action rules. It cannot be used forData‐in‐Use events.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Action Rules.• On your McAfee DLP appliance, select Policies | Action Rules.2 Click an action rule, or create a new one.3 On the Edit Action Rule page, open the Email Notification component.4 Type a valid email address into the From field.Email addresses are invalid if they include special characters (for example, &, *, %), but if validaddresses are also included, notification will still be sent to those users.5 Type one or more addresses into the To and Cc fields.6 (Optional) Select checkboxes to notify managers, reviewers, senders, or recipients.The options available depend on the McAfee DLP appliance. Managers can be identified only if anActive Directory server has been added, but other categories are user‐defined. Reviewer is the onlyoption available on McAfee DLP Discover.McAfee Data Loss Prevention 9.2.2 Product Guide 227