McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP MonitorSearching for email files or IP addresses 2Find email by ccFind email by searching for email addresses on the cc: line.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Source/Destination category.3 Select Email CC | is any of and enter the cc address in the value field.4 Click Search or Save as Rule.Find email by domainFind email in discovered data by searching for domain names.The capture engine parses email addresses into three tokens, making it possible to find eachcomponent separately.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Discover category.3 Select Domain Name | contains any of and enter one or more domain names in the value field.4 Click Search or Save as Rule.Find email by portFind email by using searching for email types that are transported through well‐known ports.For example, SMTP mail usually uses port 25, while HTTP webmail uses port 80.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Protocol category.3 Select Port | is any of.Use is none of or use source or destination options to exclude or focus results.4 Enter a port number in the value field.5 Click Search or Save as Rule.Find email by protocolFind email by searching for the protocols used to send it.For example, use the SMTP protocol to find corporate email, or the HTTP_Webmail protocol to findpersonal webmail.McAfee Data Loss Prevention 9.2.2 Product Guide 53