McAfee Data Loss Prevention 9.2.2 Product Guide

More documents

Recommendations

Info

ContentsFind host names in data at rest . . . . . . . . . . . . . . . . . . . . . . . . 109Find domain names in data at rest . . . . . . . . . . . . . . . . . . . . . . . 109Find share names in data at rest . . . . . . . . . . . . . . . . . . . . . . . . 110Find file name patterns in data at rest . . . . . . . . . . . . . . . . . . . . . . 110Find repository types in data at rest . . . . . . . . . . . . . . . . . . . . . . . 110Find file paths in data at rest . . . . . . . . . . . . . . . . . . . . . . . . . 111Find file owners in data at rest . . . . . . . . . . . . . . . . . . . . . . . . . 111Find catalogs in data at rest . . . . . . . . . . . . . . . . . . . . . . . . . . 111Find schema names in data at rest . . . . . . . . . . . . . . . . . . . . . . . 111Find table names in data at rest . . . . . . . . . . . . . . . . . . . . . . . . 112Find column names in data at rest . . . . . . . . . . . . . . . . . . . . . . . 112Find records and rows in data at rest . . . . . . . . . . . . . . . . . . . . . . 112Find signature percentage matches in data at rest . . . . . . . . . . . . . . . . 113Search with the DocReg concept . . . . . . . . . . . . . . . . . . . . . . . . 113Remediating incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114Types of remedial action . . . . . . . . . . . . . . . . . . . . . . . . . . . 114Compliance with FIPS standards . . . . . . . . . . . . . . . . . . . . . . . . 114Review remedial actions . . . . . . . . . . . . . . . . . . . . . . . . . . . 115Add columns to display remedial actions . . . . . . . . . . . . . . . . . . . . . 115Add remedial action rules . . . . . . . . . . . . . . . . . . . . . . . . . . . 116Apply remedial action rules . . . . . . . . . . . . . . . . . . . . . . . . . . 116Set up locations for exported files . . . . . . . . . . . . . . . . . . . . . . . 117Copy discovered files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117Move discovered files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118Encrypt discovered files . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Delete discovered files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120Revert remediated files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120Getting scan statistics and reports . . . . . . . . . . . . . . . . . . . . . . . . . . 121View scan results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121Export reports of scan statistics . . . . . . . . . . . . . . . . . . . . . . . . 122Get historical scan statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 123Types of task status messages . . . . . . . . . . . . . . . . . . . . . . . . . 123Types of system status messages . . . . . . . . . . . . . . . . . . . . . . . . 124Configuring McAfee DLP Discover . . . . . . . . . . . . . . . . . . . . . . . . . . . 125Register McAfee DLP Discover to McAfee DLP Manager . . . . . . . . . . . . . . . 125Republish McAfee DLP policies . . . . . . . . . . . . . . . . . . . . . . . . . 126McAfee DLP Discover scan permissions . . . . . . . . . . . . . . . . . . . . . 126McAfee DLP Discover registration permissions . . . . . . . . . . . . . . . . . . . 1275 Integrating McAfee DLP Endpoint 129How McAfee DLP Endpoint works with McAfee DLP Manager . . . . . . . . . . . . . . . . 129Typical scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130Keep data from being copied to removable media . . . . . . . . . . . . . . . . . 131Keep data from being cut and pasted . . . . . . . . . . . . . . . . . . . . . . 131Protect data with Document Scan Scope . . . . . . . . . . . . . . . . . . . . . 132Keep data from being printed to file . . . . . . . . . . . . . . . . . . . . . . . 133Protect data from screen capture . . . . . . . . . . . . . . . . . . . . . . . 134Protect data by identifying text in title bars . . . . . . . . . . . . . . . . . . . . 134Keep data from being printed on network printers . . . . . . . . . . . . . . . . . 135Create user list templates to control access . . . . . . . . . . . . . . . . . . . 136Keep data from being printed on local printers . . . . . . . . . . . . . . . . . . 137Protect data using specific encryption types . . . . . . . . . . . . . . . . . . . 137Viewing events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138View endpoint events . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139Events reported to McAfee DLP Manager . . . . . . . . . . . . . . . . . . . . 139Configuring McAfee DLP Endpoint in McAfee DLP Manager . . . . . . . . . . . . . . . . . 1406 McAfee Data Loss Prevention 9.2.2 Product Guide
ContentsDefine unmanaged printers . . . . . . . . . . . . . . . . . . . . . . . . . . 140Add an Agent Override password . . . . . . . . . . . . . . . . . . . . . . . . 140Maintaining compatibility with installed agents . . . . . . . . . . . . . . . . . . . . . 141Manage endpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141Unified policies and McAfee DLP Endpoint . . . . . . . . . . . . . . . . . . . . . . . 142Unified policy content strategy . . . . . . . . . . . . . . . . . . . . . . . . . 143Integration into the unified workflow . . . . . . . . . . . . . . . . . . . . . . 143How McAfee DLP Endpoint rules are mapped . . . . . . . . . . . . . . . . . . . 143Adding endpoint parameters to rules in McAfee DLP Manager . . . . . . . . . . . . 144Using protection rules in McAfee DLP Manager . . . . . . . . . . . . . . . . . . 145Extending McAfee DLP Discover scans to endpoints . . . . . . . . . . . . . . . . 146Tagging and tracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148Using tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149Application-based tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . 150Location-based tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157Controlling devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159Device classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159Classifying devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160Controlling devices with device definitions . . . . . . . . . . . . . . . . . . . . 161Using device rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165Device parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1686 Managing the Home page 171How the Home page is used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171Customize the Home page . . . . . . . . . . . . . . . . . . . . . . . . . . 171Assign Home page permissions . . . . . . . . . . . . . . . . . . . . . . . . 1727 Using the Incidents dashboard 173Finding incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173Typical scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174Find policies violated by a user . . . . . . . . . . . . . . . . . . . . . . . . . 174Find high-risk incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175Sort incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175Sort incidents by attribute . . . . . . . . . . . . . . . . . . . . . . . . . . 175Sort incidents by policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176Delete incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176Delete similar incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176Filter incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177Set a time filter for incidents . . . . . . . . . . . . . . . . . . . . . . . . . 177Filter incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177Group incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178Clear filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178Getting incident details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178View incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178Get case status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179View related incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179Find the concept that matched . . . . . . . . . . . . . . . . . . . . . . . . . 179Find match strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180Set incident states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180Get incident history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181Set up incident views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181Save home views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181Select pre-configured views . . . . . . . . . . . . . . . . . . . . . . . . . . 182Select view vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182Select graphical views . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182Copy views to users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183McAfee Data Loss Prevention 9.2.2 Product Guide 7
Page 1: Product GuideRevision AMcAfee Data
Page 8 and 9: ContentsDelete views . . . . . . .
Page 10 and 11: ContentsTypical scenarios . . . . .
Page 12 and 13: Contents12 McAfee Data Loss Prevent
Page 14 and 15: PrefaceFind product documentationTi
Page 16 and 17: 1McAfee DLP ManagerMcAfee DLP data
Page 18 and 19: 2Using McAfee DLP MonitorHow data i
Page 20 and 21: 2Using McAfee DLP MonitorTypical sc
Page 26 and 27: 2Using McAfee DLP MonitorSearch bas
Page 28 and 29: 2Using McAfee DLP MonitorUsing logi
Page 30 and 31: 2Using McAfee DLP MonitorSupported
Page 38 and 39: 2Using McAfee DLP MonitorRules used
Page 40 and 41: 2Using McAfee DLP MonitorFinding in
Page 42 and 43: 2Using McAfee DLP MonitorFinding in
Page 44 and 45: 2Using McAfee DLP MonitorUse concep
Page 46 and 47: 2Using McAfee DLP MonitorFind data
Page 52 and 53: 2Using McAfee DLP MonitorSearching
Page 54 and 55:
2Using McAfee DLP MonitorSearching
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
2Using McAfee DLP MonitorFinding do
Page 66 and 67:
3Managing McAfee DLP PreventHow McA
Page 68 and 69:
3Managing McAfee DLP PreventConfigu
Page 70 and 71:
3Managing McAfee DLP PreventConfigu
Page 72 and 73:
4Using McAfee DLP DiscoverTypical s
Page 74 and 75:
4Using McAfee DLP DiscoverTypical s
Page 76 and 77:
4Using McAfee DLP DiscoverRegisteri
Page 78 and 79:
4Using McAfee DLP DiscoverRegisteri
Page 80 and 81:
4Using McAfee DLP DiscoverCrawling
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
4Using McAfee DLP DiscoverOptimizin
Page 88 and 89:
4Using McAfee DLP DiscoverOptimizin
Page 90 and 91:
4Using McAfee DLP DiscoverManaging
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
4Using McAfee DLP DiscoverScan stat
Page 106 and 107:
Page 108 and 109:
4Using McAfee DLP DiscoverSearch di
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
4Using McAfee DLP DiscoverRemediati
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
4Using McAfee DLP DiscoverGetting s
Page 124 and 125:
4Using McAfee DLP DiscoverGetting s
Page 126 and 127:
4Using McAfee DLP DiscoverConfiguri
Page 128 and 129:
4Using McAfee DLP DiscoverConfiguri
Page 130 and 131:
5Integrating McAfee DLP EndpointTyp
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
5Integrating McAfee DLP EndpointVie
Page 140 and 141:
5Integrating McAfee DLP EndpointCon
Page 142 and 143:
5Integrating McAfee DLP EndpointUni
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
5Integrating McAfee DLP EndpointTag
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
6Managing the Home pageHow the Home
Page 174 and 175:
7Using the Incidents dashboardTypic
Page 176 and 177:
7Using the Incidents dashboardSort
Page 178 and 179:
7Using the Incidents dashboardGetti
Page 180 and 181:
7Using the Incidents dashboardGetti
Page 182 and 183:
7Using the Incidents dashboardSet u
Page 184 and 185:
7Using the Incidents dashboardGener
Page 186 and 187:
7Using the Incidents dashboardCusto
Page 188 and 189:
7Using the Incidents dashboardContr
Page 190 and 191:
8Working with casesManage case perm
Page 192 and 193:
8Working with casesAdd, delete, or
Page 194 and 195:
8Working with casesModify casesYou
Page 196 and 197:
8Working with casesCustomize cases3
Page 198 and 199:
8Working with casesCustomize cases4
Page 200 and 201:
9Managing policies and rulesHow pol
Page 202 and 203:
9Managing policies and rulesTypical
Page 204 and 205:
9Managing policies and rulesTypical
Page 206 and 207:
9Managing policies and rulesManagin
Page 208 and 209:
9Managing policies and rulesAdd, mo
Page 210 and 211:
9Managing policies and rulesAdd, mo
Page 212 and 213:
9Managing policies and rulesManage
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
9Managing policies and rulesIdentif
Page 220 and 221:
9Managing policies and rulesIdentif
Page 222 and 223:
10Managing action rulesHow McAfee D
Page 224 and 225:
10Managing action rulesAdd, modify,
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
11Managing conceptsTypical scenario
Page 234 and 235:
11Managing conceptsAdd, apply, rest
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
12Using templatesTypical scenariosT
Page 242 and 243:
12Using templatesAdd, modify, and d
Page 244 and 245:
12Using templatesAdd, modify, and d
Page 246 and 247:
13Managing McAfee DLP systemsConfig
Page 248 and 249:
13Managing McAfee DLP systemsConfig
Page 250 and 251:
13Managing McAfee DLP systemsUsing
Page 252 and 253:
Page 254 and 255:
Page 256 and 257:
Page 258 and 259:
13Managing McAfee DLP systemsAdding
Page 260 and 261:
Page 262 and 263:
Page 264 and 265:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 274 and 275:
13Managing McAfee DLP systemsManagi
Page 276 and 277:
Page 278 and 279:
Page 280 and 281:
13Managing McAfee DLP systemsTechni
Page 282 and 283:
13Managing McAfee DLP systemsTechni
Page 284 and 285:
14Disaster recovery backup and rest
Page 286 and 287:
Page 288 and 289:
Page 290 and 291:
15Technical supportCreate a technic
Page 292 and 293:
Indexdevice class (continued)status
Page 294 and 295:
Indexuser groupscreating 275deletin
show all

McAfee Data Loss Prevention 9.2.2 Product Guide

Create successful ePaper yourself

Delete template?

Save as template?