McAfee Data Loss Prevention 9.2.2 Product Guide

13Managing McAfee DLP systemsAdding servers to McAfee DLP systemsUse the filtering process to locate user attributes in dashboard results.Figure 13-1 Filter for user attributesBefore filtering, add columns to the dashboard to display the user attribute results you are looking for.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Incidents.• On your McAfee DLP appliance, select Incidents.2 At the top of the Incidents page, select a vector: Data‐in‐Motion, Data‐at‐Rest, or Data‐in‐Use.These dashboards display incidents or events from McAfee DLP Monitor, McAfee DLP Discover, orMcAfee DLP Endpoint, respectively.3 In the Filter by pane, select a time frame.4 Click + to add a filter.5 From the filter list, select a user attribute from the list.If customized attributes are used on the directory server, they must be mapped to those in this list.6 Select a comparator, such as equals or not equal, and enter required information in the value field.7 Click Apply.LDAP columns available for displayThe columns available reflect the scope of data available. Not all of these parameters can be used forsearching captured data or implementing rules. In an ad hoc search, some Active Directory attributes(user names, companies, email, managers, titles) are not displayed.There are many more columns available than there are searchable network elements — many wereadded to the McAfee DLP product suite interfaces to support McAfee DLP Endpoint. You can use themto display additional attributes that are reported, but not displayed by default.The following columns are available.• User Custom • UserManager• UserCity • UserName• UserCompany • UserGroup268 McAfee Data Loss Prevention 9.2.2 Product Guide