McAfee Data Loss Prevention 9.2.2 Product Guide

Managing McAfee DLP systemsUsing capture filters 137 From the Protocol pop‐up menu, select Chat Protocols | AOL_Chat and Apply.8 Click Save to complete the AOL chat filter.9 Click Create Network Filter to create another filter.10 Type a filter name (for example, SSH_traffic) and an optional description.11 From the Action menu, select Ignore.12 Open the Protocol category and select Port | source is any of, then type 443 into the value field.This stores incoming encrypted data. Traffic through ports and port ranges is bidirectional, so youmust define source and destination transmissions separately. You will have capture both sides ofexcluded transmission to capture both sides of the chat within it.13 Click + to add a parameter.14 Repeat the process, but select Port | destination is any of and type 443 into the value field.This stores outgoing encrypted data.15 Select the checkbox of the device on which you want the filter deployed.To decide later, click None.16 Click Save.A new Ignore filter, which excludes encrypted data from processing by the capture engine, is addedto the existing capture filter list.17 In the Network Filters list, use the Priority icons to reorder the filters.When a network capture filter is applied to the network data stream, its position in the list indicatesits priority. Because the BASE filter instructs the system to store all data that has not been droppedfrom the data stream, it must always run last.The AOL_chat Store filter must run first, because the SSH_traffic Ignore filter will eliminate whatremains of the port 443 traffic.18 Let the system run. After some time, you can search for AIM chats in the captured data on theIncidents page.Exempt users from detectionEven network administrators might not be privileged to peruse certain information found in networkdata streams.Before you beginEndpoint features require deployment of McAfee DLP Endpoint and an added evidenceserver.This case helps you to ensure absolute security for one or more endpoints that have access to topsecret information by protecting them from detection by the capture engine.Alternately, use this procedure with a user or group name, or an email address.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Sys Config | System Administration.• On your McAfee DLP appliance, select System | System Administration.McAfee Data Loss Prevention 9.2.2 Product Guide 251