McAfee Data Loss Prevention 9.2.2 Product Guide

Managing McAfee DLP systemsAdding servers to McAfee DLP systems 13monitored. By leveraging multiple user attributes, it is now possible to identify end users conclusively,regardless of what email or IP addresses they are using.When a SID is retrieved from the Active Directory server, all of its associated attributes, such asdomain name, location, department and user group, come with it. That collection of information canthen be used in rules, templates, action rules, and notifications to find and stop security violations byspecific users.Adding DHCP servers to DLP systemsDLP systems can accurately resolve the sources and destination of network transmissions by usingDHCP (Dynamic Host Configuration Protocol) services. A DHCP server might be added to the system toprovide those services.Senders and recipients can be easily identified if they have static IP addresses, but dynamic addressesare more commonly used. Because they change frequently, it is often difficult to pinpoint the sourcesand destinations of transmissions.DHCP servers automatically assign IP addresses from an appropriate pool to the clients connecting tothe system. The server then extracts, parses and loads log files to resolve the address to a host name,and the information is passed along to the DLP system.If McAfee Logon Collector is used with an Active Directory server, user mapping returns better results.Add DHCP servers to DLP systemsAdd DHCP (Dynamic Host Configuration Protocol) servers to DLP systems to provide accurate locationinformation about incidents that have been identified by DLP systems. If there is no Active Directoryserver, DLP processes query the DHCP server to map IP addresses to users.DHCP servers are used by most ISPs (Internet Service Providers) to assign dynamic addresses to thehosts they administer. Because dynamic addresses expire at specified times, hosts using them can betracked only through DHCP server records.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Sys Config | System Administration | DHCPServers.• On your McAfee DLP appliance, select System | System Administration | DHCP Servers.2 From the Actions menu, select Add DHCP.3 Type in a name for the server and an optional description.4 Select the Server Type.Internet Systems Consortium, Solaris and Microsoft Windows types are supported.5 Select an Access Mode to retrieve directory information, get and put log files, and perform relatedtransfer tasks.The access mode determines the method of transfer. SMBClient access mode is supported only forWindows Server.6 Type in the IP Address/Name, Username, and Password to log on to the server.7 Type in the Folder/Share name, if needed.McAfee Data Loss Prevention 9.2.2 Product Guide 271