McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorSearching for email files or IP addressesFind email by addressFind email sent or received by entering an email address in the value field.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting.• On your McAfee DLP appliance, select Capture.2 Enter an email address in one of two ways:• On the Basic Search menu, type one or email addresses separated by commas (no space), andclick Search.• On the Advanced Search page, open the Source/Destination category, select Email Address | is any of andtype one or more email addresses separated by commas (no space), then click Search.Find email attachmentsFind email attachments by searching for the protocols used to send them.For example, HTTP_Webmail_Attach is used to find webmail attachments, and SMTP_Attach andPOP3_Attach find email attachments.Attachments larger than 50 MB cannot be reported.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Protocol category and click ?.3 Open the Mail Protocols category.4 Select one or more attachment types.5 Click Apply.6 Click Search or Save as Rule.Find email by bccFind email by searching for email addresses on the bcc: line.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Source/Destination category.3 Select Email BCC | is any of and type the bcc address into the value field.4 Click Search or Save as Rule.52 McAfee Data Loss Prevention 9.2.2 Product Guide