McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP DiscoverRegistering documents and structured data 48 Open the File Information category and select Signature | is any of , then paste the signature number inthe value field.9 Click Search.All incidents containing the file with that unique signature will be reported to the dashboard.10 View the Signature and Path columns, which will tell you the exact locations of the file.Registering documents and structured dataData in documents and databases can be registered by uploading files or structured data or by using aRegistration scan to create signatures for many files in a defined location. You can also register filesusing a McAfee DLP Discover scan to match rules to data at rest to tag sensitive data, embedsignatures in rules that run on a regular basis, or deploy signatures to endpoints through McAfee DLPAgent.Signatures that identify registered data are stored in two factory default concepts:• DocReg — Document registration for unstructured data• DBReg — Data registration for structured dataThe content of these two concepts can be accessed by adding them as components to rules that areused to crawl repositories during a Discover scan.For McAfee DLP Endpoint scans, the signatures are stored in registered document packages that aredeployed to endpoints.When data is registered by the web upload method, all devices registered to McAfee DLP Manager atthat time will receive the signatures. When data is registered by scanning, you can choose the devicethat will store the signatures.There are four ways to register content:• Uploading files or structured data• Applying policies to data at rest in repositories• Using signature collections (DocReg or DBReg) or signatures created with a SHA‐2 sum utility inrules• Scanning endpoints and deploying the signature package to McAfee DLP AgentSignatures that identify sensitive data are generated by complex algorithms during a registration scanor by uploading documents. Each protected document might contain hundreds of overlappingsignatures, which are expressed as hexadecimal numbers. The density, or fidelity, of the signaturetiling depends on the level of detection needed.Typically, the registration process runs whenever a document is uploaded to a McAfee DLP Discoverappliance, or when a Registration scan runs on a designated file system or database.Types of signaturesThe signature type selected when data is registered determines the density of signatures generatedduring registration.Signature types vary depending on usage and available memory.McAfee Data Loss Prevention 9.2.2 Product Guide 75