McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP MonitorSearching for email files or IP addresses 22 Enter an email subject in one of two ways:• On the Basic Search menu, type the subject, then click Search.• On the Advanced Search page, open the Source/Destination category, select Email Subject | contains any ofand type the subject, then click Search.Find webmail by portFind webmail by port by searching using well‐known port 80 for web traffic in your query.By default, a port search returns results in both directions, but in separate flows. A port search isespecially useful when the direction of traffic is known, but for complete results, define both source anddestination values.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Protocol category.3 Select Port | source is any of and type 80 in the value field.4 Select Port | destination is any of and type 80 in the value field.5 Click Search or Save as Rule.Find webmail by protocolFind webmail by searching for communications that use port 80. Web traffic commonly uses port 80.You can use Basic Search to find all traffic on a single port quickly, but such a search is likely to return toomany results. Use Advanced Search to add parameters that will focus your query.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Protocol category.3 Select Protocol | is any of and click ?.The Protocols pop‐up menu appears.4 Open the Mail Protocols category.5 Select one or more webmail types.6 Click Apply.7 Click Search or Save as Rule.McAfee Data Loss Prevention 9.2.2 Product Guide 55