McAfee Data Loss Prevention 9.2.2 Product Guide

2Using McAfee DLP MonitorSearching for email files or IP addresses2 Find an IP address in captured data in one of two ways:• On the Basic Search page, select IP Address, and type one or more IP addresses.• On the Advanced Search page, open the Source/Destination category, select IP Address, and type one ormore IP addresses.3 Click Search.Examples192.168.3.22510.1.0‐10.0.1‐255172.16.1.1/24Find a range of IP addressesFind incidents generated from specific IP addresses by entering them into value fields. Define multipleaddresses or address ranges by separating them with commas or dashes.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Source/Destination category.3 Select IP Address | is any of and enter the IP addresses, separated by a comma, in the value field.Identify IP address ranges by separating IP addresses with a dash.192.168.1.244,172.25.3.100‐172.25.3.1994 Click Search or Save as Rule.Find IP addresses on subnetsFind subnetted IP addresses by using subnet masks in a query.Subnet searching is supported whether or not network and host portions of an IP address are standardclassful IP (address fields separated into four 8‐bit groups).CIDR (Classless Inter‐domain Routing) notation is supported.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search.• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Source/Destination category.3 Select IP Address | is any of and enter the subnetted IP addresses in the value field.For example, for subnet mask 255.255.255.128, you can type 192.168.2.1/25.4 Click Search or Save as Rule.62 McAfee Data Loss Prevention 9.2.2 Product Guide