McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorSearch basicsTask1 Select a page in the user interface that displays configurable parameters, using one of theseoptions:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open any category.3 Click + to define a new parameter.4 Select either of the following methods to delete parameters:• In category frames, click ‐ to delete a single parameter.• Beside category names, click X to delete multiple parameters.Retrieve data from directory serversIf a directory server is registered to McAfee DLP Manager, you can retrieve data from it by user name,group, city, country, or organization.Before you beginAn Active Directory or OpenLDAP server must be registered to McAfee DLP Manager.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Source/Destination category.3 Select a User parameter.User name, group, city, country and organization parameters are supported on directory servers.For example, select User Organization.4 Select sender is any of or sender is none of.Recipient values are not supported.5 Click ? and select a directory server from the menu.The AD pop‐up window appears.6 Type a pattern into the search field, or click Find.If no pattern is entered, a list of user values found in the directory server appears.7 Click one or more values and click Apply.For example, select the Contractors organization.The Advanced Search page reappears.8 Add more parameters that will narrow the search.For example, add email addresses that contractors might be using to distribute proprietaryinformation, and an Engineering Drawing content parameter that contains intellectual property.9 Click Search or Save as Rule.26 McAfee Data Loss Prevention 9.2.2 Product Guide