McAfee Data Loss Prevention 9.2.2 Product Guide

Managing conceptsAdd, apply, restore, and delete concepts 11Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies | Concepts.• On your McAfee DLP appliance, select Policies | Concepts.2 Click Add Concept.3 Type in a name (uppercase only) and an optional description.4 Click ? to file the concept under a category.All concepts in a category can be used in queries and rules.5 If one of the available algorithms matches the aim of the new concept, you can select it from theAlgorithm menu to fine‐tune the pattern match.An expression might match a pattern correctly, but its granularity might not be fine enough toeliminate imprecise results. Adding an algorithm to the definition evaluates the patternarithmetically to ensure a perfect match.For example, U.S. Social Security and credit numbers might be 9 or 16 digits, but each digit has asignificance beyond the pattern. Social Security numbering signifies the date and birthplace of thecardholder, while some credit card digits identify the issuer (such as MasterCard or Visa). Thealgorithm mathematically verifies authenticity of these additional characteristics in addition to thenumbering patterns.6 If you want to upload a list of existing expressions or patterns, click Browse and select the file.7 Click Import Expressions to load expressions from a file, or enter expressions in the Expression field.The size of the imported file cannot exceed 10K.Escape all metacharacters to ensure literal interpretation (for example, www\.deadspin\.com).8 If you want to edit the list of expressions, or just keep a copy, click Export Expressions to save them toyour desktop. You can debug them in a text editor, then reimport.9 If you don't have a document to upload, or want to use text and regular expressions to build a newconcept, enter a value in the Expression 0: field. Click + to add an expression, and repeat until allexpressions are added.10 Click Validate, then enter a sample string. If it matches, go on to the next step. The Matches Stringreturns a true or false acknowledgement.11 Use one of the concept conditions (Count, Percentage Match, Number of lines/bytes, Proximity) to modify theaction of the concept.Concept conditions narrow the match to specific circumstances. For example, if you want thesystem to wait until the concept patterns are found three times before being reported to thedashboard, select greater than from the Condition menu, and enter 3 in the value field.12 Click Save.When creating concepts that have multiple words, you must escape spaces between words with abackslash (for example, hello\_world). Other metacharacters and ASCII characters (such as&#x0020, &#x0009, &#x000C, and &#x200B for space, tab, form feed, and zero‐width space) can alsobe used to define concept expressions.McAfee Data Loss Prevention 9.2.2 Product Guide 235