McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorTypical scenariosTask1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Basic Search.• On your McAfee DLP appliance, select Capture | Basic Search.2 Select Input Type | GeoIP Location and click ?.3 Select one or more country names from the pop‐up menu.4 Click Apply, then Search and examine the incidents on your dashboard.If you do not see locations in your results, click Columns and add Source, Destination, Sender or Recipientcolumns to the dashboard.Search for social networking activityEmployees who are accustomed to using social networking sites might not realize how much time theyare spending on activities that reduce their productivity, or how much sensitive information might beleaked when they use such sites in the workplace.This case helps you to find out how much social networking activity is occurring on your network byidentifying all traffic to and from specific web sites.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting.• On your McAfee DLP appliance, select Capture.2 On the Basic Search page, select an Input Type and click ?.• Select Protocols, then HTTP_Post from an Internet Protocols menu. Click Apply, then Search.• Select Keywords, type keywords (for example, facebook or deadspin), then Search.Find postings to message boardsEmployees sometimes spend company time posting to Internet sites that are not work‐related.This case helps you to identify that activity by targeting the protocol that is used to transmit suchpostings.This filter identifies all posting traffic. If you know what web site it is being posted to, add a Content |equals parameter and type its name (for example, webrats.com).Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 From the Filter by menu, select a time from the Timestamp sub‐menu.3 Click the plus icon to add a filter and select Protocol | equals.4 Click ?, select a protocol from the pop‐up list, then click Apply.5 Click Apply.24 McAfee Data Loss Prevention 9.2.2 Product Guide