McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverTypical scenariosCreate a one-time scan that runs until it completesWhen you schedule a scan with a start time but no end time, it will run until it completes.Before you beginDetermine the repository type, the credentials used to access it, and the scan mode thatfits the task. For example, if you are scanning a Windows repository to find HIPAAviolations, you will want to create a CIFS Discover scan.Alternatively, you could run the complete scan at the desired time by selecting Start from the Actionsmenu on the Scan Operations page. It will run to completion as long as you do not select Abort or Stop afterthe scan starts running.This scan requires completion of three different user interface elements: Scan Operations, Schedules, andCredentials.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Classify | Discover Scan Operations.• On your McAfee DLP appliance, select Classify | Discover Scan Operations.2 From the Actions menu, select New.3 On the Add Scan Operation page, type a name and optional description.4 In the Devices frame, select the Discover device from which the scan will run.If you are not planning to run the scan right away, click None.5 From the Repository Type menu, select CIFS.6 Click New to add a credential, or accept the none default.The Create Credential window appears. Type in the user account information you need to access therepository, then click Save.7 Click New to add a schedule, or accept the none default.The Create Schedule window appears. Enter a name and optional description, select Once and No EndTime, set a Start Time for the scan, then click Save.8 From the Mode menu, select Discover.9 In the IP Address/Host Name field, type the IP address or host name, then click Test.• If the host is not found, check the credentials and determine if the system is up.• If the test is successful, click Include. The credential will be checked in the background, and theIP Address or Host name will be highlighted in a color that indicates the success or failure of theautomatic testing.1 Green highlighting indicates a successful connection.2 Red highlighting indicates a failed connection.3 Amber highlighting indicates partial success. This might occur if multiple hosts or IP rangesare included, because only a small subset of nodes are tested.10 In the Filters tab, click Browse to locate the share to be scanned, or set the Filter category options todefine it.72 McAfee Data Loss Prevention 9.2.2 Product Guide