McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP MonitorUse concepts to find incidents 24 Enter a compound concept query using logical expressions in the Value field.The logical expressions supported are + AND ‐ ! NOT .5 Click Search.For example, the expression concept:VISA +concept:MASTERCARD !concept:DISCOVER !concept:AMEX finds credit card numbers that are in Visa or MasterCard format, but notDiscover or American Express.Exclude concepts to filter resultsWhen you exclude content concepts from a query, you can focus results by filtering out irrelevantcollections of data.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy to open it and select a rule that retrieves too many results.Because a rule is a search that has been saved, this procedure also relates to an over‐broadsearch.3 Open the Content category.4 Click on + to add a parameter to the rule.5 Select Concept | is none of and click ?.The Concepts pop‐up menu appears.6 Open one or more concept categories.7 Select one or more concepts.8 Click Apply.9 Click Save.For example, if you wanted to find credit cards using any possible numbering pattern exceptAmerican Express, you could select the AMEX concept to exclude those results from a generalpayment card query.McAfee Data Loss Prevention 9.2.2 Product Guide 45