McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorUsing logical operators in queriesTask1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Sys Config | User Administration.• On your McAfee DLP appliance, select System | User Administration.2 Click Details for the user.3 Type an email address into the Email field.4 Click Apply.Clone searchesIf you want to use the same search repetitively, you can clone it so that you can repeat the processwithout re‐selecting all of your parameters.You can clone the search, but get different results by modifying one or two parameters before clickingSearch again.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting.• On your McAfee DLP appliance, select Capture.2 On the Advanced Search page, select search terms and click Search.3 In the page header, click Search List.4 Click Clone Search.The Advanced Search page reappears, displaying the parameters entered for the previous query.5 Click Search to restart the search, or modify parameters before clicking Search again.Using logical operators in queriesMcAfee DLP supports specific logical operators in queries.All operators, including Exact Match, are case‐insensitive. For example, if you search for a term in ALLCAPS, the system will return that in capital letters, initial caps, and lowercase letters.In Exact Match, word stemming takes precedence. For example, if you search for information, thekeyword will be stemmed to inform, which will return all strings that contain that stem word. Includeadditional words in your query to find the word to prevent stemming.Word stemming queries do not require any notation. Do not use asterisks or tildes.You can use an OR logical operator (|| or OR) instead of a comma to construct a query. But youcannot use AND operators between URLs and email fields.28 McAfee Data Loss Prevention 9.2.2 Product Guide