McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP MonitorFinding document properties in context 2Exclude IP addresses from search resultsExclude single IP addresses or IP address ranges from search results to focus your query.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Reporting | Advanced Search..• On your McAfee DLP appliance, select Capture | Advanced Search.2 Open the Source/Destination category.3 Select IP Address | is none of and enter an IP address or range in the value field.Add another parameter to narrow the focus of the query.4 Click Search or Save as Rule.Finding document properties in contextCapture of document properties in context makes it possible to retrieve document metadata. Values inproperties fields can be extracted only when they are associated with other values, increasing thegranularity of search results.For example, using the name of an author as a keyword in a search or rule would successfully retrievethat name from any location in the capture database. But using that name with the Microsoft WordAuthor property retrieves only the keyword in the defined context.Types of document propertiesThree document property types can be used to extract content in context from the capture database— predefined metadata, metadata added by users, or property values only.Table 2-22 Types of document propertiesProperty typePredefinedpropertiesDefinitionStandard properties shared by most document types, such as author, keywords,subject, and title.PDF files only support predefined properties.Custom properties User‐defined properties added to the document metadata, allowed by someapplications such as Microsoft Word. A user‐defined property can also reference astandard document property that is not on the predefined properties list, butcannot duplicate a property that is on the list.User‐defined custom properties in Microsoft Office 2007 and 2010 files are notsupported.Any propertyAllows definition of a property by value alone. This useful in cases where thekeyword has been entered in the wrong property parameter, or when theproperty name is unknown. For example, adding the value Secret to the Anyproperty parameter classifies all documents that have the word Secret in at leastone property.McAfee Data Loss Prevention 9.2.2 Product Guide 63