McAfee Data Loss Prevention 9.2.2 Product Guide

3Managing3McAfee DLP PreventMcAfee DLP Prevent provides protection for email, webmail, chat, webposts, and other types ofcontent transmitted via SMTP or ICAP. By analyzing communications forwarded from email or proxyservers, marking detected policy violations, and returning processed messages to the appliance, whichexecutes the preventive, corrective, or protective actions.A single rule can have one of each of the three action rule types so that the parameters of any rulecan be applied to Data‐in‐Motion, Data‐at‐Rest, or Data‐in‐Use. Each action rule can be configured toautomatically notify users that a preventive, corrective, or protection action has been applied. It mightalso include parameters that place a record of the incident or event in a system log, assign it to one ormore reviewers, or apply a status to an incident or case that indicates its stage of resolution.McAfee DLP Prevent uses multi‐threaded processing, which allows SMTP or ICAP traffic to pass quicklythrough the monitor port, decreasing response time and enhancing performance.ContentsHow McAfee DLP Prevent can be usedHow McAfee DLP Prevent worksConfiguring McAfee DLP PreventHow McAfee DLP Prevent can be usedTo get a general understanding of how McAfee DLP Prevent can be used to resolve policy violations inSMTP and ICAP traffic, edit Data‐in‐Motion action rules.Use McAfee DLP Prevent to capture network traffic for later forensic analysis or block the transmissionof sensitive data sent using specific mail protocols (for example, HTTP POST, SMTP_Request, etc.)When violations are found in network email, McAfee DLP Prevent is used with action rules to controldata in motion on the network. To implement a range of actions, you can combine several action ruleparameters in one rule:• Block confidential data breaches• Encrypt authorized transmissions• Monitor traffic, allowing email but still generating incidents• Quarantine suspicious traffic• Bounce email that violates policies• Notify supervisory personnel• Record incidents in a system logMcAfee Data Loss Prevention 9.2.2 Product Guide 65