McAfee Data Loss Prevention 9.2.2 Product Guide

11Managing conceptsMcAfee DLP uses content and session concepts to match patterns in traffic on the application orsession layers. Content concepts are used to find data in motion or at rest, and session concepts areused to recognize content found in data being exchanged between clients and servers.ContentsTypical scenariosTypes of conceptsHow content concepts workRegular expression syntax for conceptsAdd, apply, restore, and delete conceptsTypical scenariosMcAfee DLP content concepts are useful for performing routine monitoring tasks. This sectiondiscusses two typical scenarios and provides the high‐level steps for each.Identify Human Resources violationsEmployees who have legitimate complaints about managers or coworkers might not feel that it is safeto come forward, and you might have to develop the case by getting concrete evidence of violations.If you suspect such a situation, you can a customized concept that monitors internal communicationsto find and stop Human Resources violations before they damage employee relationships or morale.For example, you might edit the standard HATE‐RACISM concept to include unacceptable languageyou've heard in the workplace, create a policy and add it to a rule that monitors chat and emailtransmissions, and let it run to verify its efficacy.You might also add an action rule to automatically assign any incidents found to the legal team.You might have to wait for some time to allow the capture engine to index new data so the new conceptpattern can be matched to the developing data stream. The amount of time you must wait depends onthe time frame in which you might expect to find the pattern. For example, if you suspect that violationsare occurring regularly, you might wait a few hours or a day. If not, you might check the incidentsdashboard for results on a daily or weekly basis.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | DLP Policies | Concepts.• On your McAfee DLP appliance, select Policies | Concepts.2 Open the Acceptable Use concepts category and click HATE‐RACISM.The Edit Concept page appears.McAfee Data Loss Prevention 9.2.2 Product Guide 231