McAfee Data Loss Prevention 9.2.2 Product Guide

3Managing McAfee DLP PreventHow McAfee DLP Prevent works• Allow email that is determined to be legitimate• Redirect email to other users or groupsWhen McAfee DLP Prevent finds violation in webmail, the only action available is to block the message.To use McAfee DLP Prevent with McAfee DLP Endpoint, create action rules containing Endpointprotection rules to control data in use at network endpoints.To use McAfee DLP Prevent with McAfee DLP Discover, create action rules containing the remedialactions (copy, move, encrypt, delete) to control data at rest in network repositories.How McAfee DLP Prevent worksMcAfee DLP Prevent receives messages routed from an email or proxy server, analyzes them to detectpolicy violations, adds message headers defining the appropriate actions, and returns them to thedesignated server for enforcement.McAfee DLP Prevent can support up to 30 concurrent SMTP connections.McAfee DLP Prevent 9.2.x monitors SMTP or ICAP traffic, depending on whether it is inter‐operatingwith email or proxy servers — but cannot support both SMTP and ICAP traffic on the same appliance.How McAfee DLP Prevent works with emailIf an email user violates any of the policies deployed through McAfee DLP Manager, McAfee DLPPrevent applies the appropriate action and returns the transmission to the email gateway. Forexample, if his message contains privacy information, an action rule might be triggered to quarantinethat transmission and notify InfoSec.1 A host sends an email message to the designated email gateway.2 The message is relayed to the Smart Host (also known as the downstream MTA), which routes it tothe McAfee DLP Prevent appliance.The Smart Host and email server might be the same machine. If so, a white list must be added toprevent email looping.3 On receiving the email, the McAfee DLP Prevent appliance evaluates it against existing rules.4 If a rule matches, McAfee DLP Prevent adds an X‐RCIS‐Action header and stores the event in itsdatabase.5 The McAfee DLP Prevent then sends the email back to the Smart Host, which relays it back to theemail server.6 Based on the action specified in the X‐RCIS‐Action header appended by the Prevent appliance, themessage is allowed, blocked, bounced, encrypted, monitored, quarantined or redirected.7 The software sends notification of the action to the defined user.66 McAfee Data Loss Prevention 9.2.2 Product Guide