McAfee Data Loss Prevention 9.2.2 Product Guide

Managing McAfee DLP systemsUsing capture filters 13Using capture filtersMcAfee DLP Monitor indexes all content moving over the network, but you can use capture filters tofilter out large portions of network traffic that do not require analysis by the capture engine.Filtering network data can cut down on the vast amounts of data captured and analyzed, so it isimportant to tune the system using capture filters when it is set up. When deployed, capture filtersconstrain the network data stream by recognizing only the most significant data for investigation, andas a result, performance is enhanced.You can also use capture filters to store critical sessions and applications‐level data.When the capture engine captures and indexes all TCP/IP traffic, it is broken down into content types.Anything that cannot be identified is tagged Unknown.ContentsTypical scenariosHow content capture filters workHow network capture filters workTypes of capture filtersAdd content capture filtersAdd network capture filtersCopy capture filtersDeploy capture filtersView deployed capture filtersRemove deployed capture filtersReprioritize capture filtersModify capture filtersTypical scenariosUse the following use cases to get a general understanding of how capture filters can be used tocontrol the data recognized by the capture engine.Tasks• Filter out traffic using common IP addresses on page 249Filter out portions of traffic using one or more IP addresses that comprise a large portion ofyour network traffic. Drop or store that data to reveal more significant traffic.• Manage data capture with network capture filters on page 250Manage data capture using multiple capture filters that instruct the capture engine toignore successive levels of traffic, while making an exception for a subset of traffic within adefined flow. You can use port numbers to filter specific types of traffic.• Exempt users from detection on page 251Even network administrators might not be privileged to peruse certain information found innetwork data streams.Filter out traffic using common IP addressesFilter out portions of traffic using one or more IP addresses that comprise a large portion of yournetwork traffic. Drop or store that data to reveal more significant traffic.For example, you might drop specific IP addresses that are well‐known within your intranet, a range ofaddresses, or all addresses on a subnet. These addresses, also known as elements, will be removedfrom consideration by the capture engine. In addition, you might expand drop all of the sessionscontaining those elements, or you might opt to store only the metadata defining them.McAfee Data Loss Prevention 9.2.2 Product Guide 249