McAfee Data Loss Prevention 9.2.2 Product Guide

More documents

Recommendations

Info

ContentsDelete views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183Generating reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183Create PDF reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183Create HTML reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184Create CSV reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184Add titles to reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185Add custom logos to reports . . . . . . . . . . . . . . . . . . . . . . . . . . 185Customizing dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186Expand dashboard displays . . . . . . . . . . . . . . . . . . . . . . . . . . 186Add rows to the dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . 186Configure dashboard columns . . . . . . . . . . . . . . . . . . . . . . . . . 186Add a match string column . . . . . . . . . . . . . . . . . . . . . . . . . . 187Controlling dashboard settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187Encrypt incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187Configure throttling to limit incidents reported . . . . . . . . . . . . . . . . . . 1888 Working with cases 189Typical scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189Resolve credit card violations using a case . . . . . . . . . . . . . . . . . . . . 189Manage case permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190Add, delete, or save cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192Add new cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192Assign incidents to existing cases . . . . . . . . . . . . . . . . . . . . . . . . 192Delete incidents from within cases . . . . . . . . . . . . . . . . . . . . . . . 193Delete cases from the case list . . . . . . . . . . . . . . . . . . . . . . . . . 193Export cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193Modify cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194Change ownership of a case . . . . . . . . . . . . . . . . . . . . . . . . . . 194Change status of a case . . . . . . . . . . . . . . . . . . . . . . . . . . . 195Change the priority of a case . . . . . . . . . . . . . . . . . . . . . . . . . 195Change the resolution stage of a case . . . . . . . . . . . . . . . . . . . . . . 195Add notes to a case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195Customize cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196Add or remove attachments to cases . . . . . . . . . . . . . . . . . . . . . . 196Add or remove custom case attributes . . . . . . . . . . . . . . . . . . . . . . 197Customize Case List columns . . . . . . . . . . . . . . . . . . . . . . . . . 197Customize case notifications . . . . . . . . . . . . . . . . . . . . . . . . . . 198Notify stakeholders of case updates . . . . . . . . . . . . . . . . . . . . . . . 1989 Managing policies and rules 199How policies and rules can be used . . . . . . . . . . . . . . . . . . . . . . . . . . 199Analyzing trends in data matching . . . . . . . . . . . . . . . . . . . . . . . 199Use Chart and Compare to prioritize policies . . . . . . . . . . . . . . . . . . . 200Use Chart and Compare to tune policies and rules . . . . . . . . . . . . . . . . . 200Typical scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201Protect intellectual property by customizing a standard policy . . . . . . . . . . . . 201Identify insider threats by deploying a standard policy . . . . . . . . . . . . . . . 202Block data containing source code . . . . . . . . . . . . . . . . . . . . . . . 203Block transmission of financial data . . . . . . . . . . . . . . . . . . . . . . . 203Modify alphanumeric patterns in rules that produce false positives . . . . . . . . . . 204Track intellectual property violations . . . . . . . . . . . . . . . . . . . . . . 205Managing policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206Policy inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206Policy activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207Activate or deactivate policies . . . . . . . . . . . . . . . . . . . . . . . . . 207Add, modify, and deploy policies . . . . . . . . . . . . . . . . . . . . . . . . . . . 2078 McAfee Data Loss Prevention 9.2.2 Product Guide
ContentsInternational policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208Add policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209Rename policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210Clone policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210Change ownership of policies . . . . . . . . . . . . . . . . . . . . . . . . . 210Delete policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211Modify policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211Deploy policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211Manage rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212Add rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213Find rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213View rule parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214Tune rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214Copy rules to policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215Disable rule inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . 216Reconfigure rules for web traffic . . . . . . . . . . . . . . . . . . . . . . . . 216Delete rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217Modify rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217Identify exceptions to rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217Identify false positives . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218Define exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218Add new rules with exceptions . . . . . . . . . . . . . . . . . . . . . . . . . 21910 Managing action rules 221How McAfee DLP Prevent uses action rules . . . . . . . . . . . . . . . . . . . . . . . 222How McAfee DLP Endpoint uses action rules . . . . . . . . . . . . . . . . . . . . . . 222How McAfee DLP Discover uses action rules . . . . . . . . . . . . . . . . . . . . . . 223Add, modify, or delete action rules . . . . . . . . . . . . . . . . . . . . . . . . . . 224Add action rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224Apply action rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225Assign responsibility for actions . . . . . . . . . . . . . . . . . . . . . . . . 225Change incident status with action rules . . . . . . . . . . . . . . . . . . . . . 225Clone action rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226Delete action rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226Modify action rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226Log actions taken . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227Notify users of actions taken . . . . . . . . . . . . . . . . . . . . . . . . . 227Reconfigure action rules for web content . . . . . . . . . . . . . . . . . . . . . 228Remove actions from rules . . . . . . . . . . . . . . . . . . . . . . . . . . 22811 Managing concepts 231Typical scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231Identify Human Resources violations . . . . . . . . . . . . . . . . . . . . . . 231Monitor social networking traffic . . . . . . . . . . . . . . . . . . . . . . . . 232Types of concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233How content concepts work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233Regular expression syntax for concepts . . . . . . . . . . . . . . . . . . . . . . . . 233Add, apply, restore, and delete concepts . . . . . . . . . . . . . . . . . . . . . . . 234Add content concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234Set conditions for matching concepts . . . . . . . . . . . . . . . . . . . . . . 236Add session concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236Apply concepts to rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237Restore user-defined concepts . . . . . . . . . . . . . . . . . . . . . . . . . 238Delete custom concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . 23812 Using templates 239McAfee Data Loss Prevention 9.2.2 Product Guide 9
Page 1: Product GuideRevision AMcAfee Data
Page 6 and 7: ContentsFind host names in data at
Page 10 and 11: ContentsTypical scenarios . . . . .
Page 12 and 13: Contents12 McAfee Data Loss Prevent
Page 14 and 15: PrefaceFind product documentationTi
Page 16 and 17: 1McAfee DLP ManagerMcAfee DLP data
Page 18 and 19: 2Using McAfee DLP MonitorHow data i
Page 20 and 21: 2Using McAfee DLP MonitorTypical sc
Page 26 and 27: 2Using McAfee DLP MonitorSearch bas
Page 28 and 29: 2Using McAfee DLP MonitorUsing logi
Page 30 and 31: 2Using McAfee DLP MonitorSupported
Page 38 and 39: 2Using McAfee DLP MonitorRules used
Page 40 and 41: 2Using McAfee DLP MonitorFinding in
Page 42 and 43: 2Using McAfee DLP MonitorFinding in
Page 44 and 45: 2Using McAfee DLP MonitorUse concep
Page 46 and 47: 2Using McAfee DLP MonitorFind data
Page 52 and 53: 2Using McAfee DLP MonitorSearching
Page 58 and 59:
2Using McAfee DLP MonitorSearching
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
2Using McAfee DLP MonitorFinding do
Page 66 and 67:
3Managing McAfee DLP PreventHow McA
Page 68 and 69:
3Managing McAfee DLP PreventConfigu
Page 70 and 71:
3Managing McAfee DLP PreventConfigu
Page 72 and 73:
4Using McAfee DLP DiscoverTypical s
Page 74 and 75:
4Using McAfee DLP DiscoverTypical s
Page 76 and 77:
4Using McAfee DLP DiscoverRegisteri
Page 78 and 79:
4Using McAfee DLP DiscoverRegisteri
Page 80 and 81:
4Using McAfee DLP DiscoverCrawling
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
4Using McAfee DLP DiscoverOptimizin
Page 88 and 89:
4Using McAfee DLP DiscoverOptimizin
Page 90 and 91:
4Using McAfee DLP DiscoverManaging
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
4Using McAfee DLP DiscoverScan stat
Page 106 and 107:
Page 108 and 109:
4Using McAfee DLP DiscoverSearch di
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
4Using McAfee DLP DiscoverRemediati
Page 116 and 117:
Page 118 and 119:
Page 120 and 121:
Page 122 and 123:
4Using McAfee DLP DiscoverGetting s
Page 124 and 125:
4Using McAfee DLP DiscoverGetting s
Page 126 and 127:
4Using McAfee DLP DiscoverConfiguri
Page 128 and 129:
4Using McAfee DLP DiscoverConfiguri
Page 130 and 131:
5Integrating McAfee DLP EndpointTyp
Page 132 and 133:
Page 134 and 135:
Page 136 and 137:
Page 138 and 139:
5Integrating McAfee DLP EndpointVie
Page 140 and 141:
5Integrating McAfee DLP EndpointCon
Page 142 and 143:
5Integrating McAfee DLP EndpointUni
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
5Integrating McAfee DLP EndpointTag
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
6Managing the Home pageHow the Home
Page 174 and 175:
7Using the Incidents dashboardTypic
Page 176 and 177:
7Using the Incidents dashboardSort
Page 178 and 179:
7Using the Incidents dashboardGetti
Page 180 and 181:
7Using the Incidents dashboardGetti
Page 182 and 183:
7Using the Incidents dashboardSet u
Page 184 and 185:
7Using the Incidents dashboardGener
Page 186 and 187:
7Using the Incidents dashboardCusto
Page 188 and 189:
7Using the Incidents dashboardContr
Page 190 and 191:
8Working with casesManage case perm
Page 192 and 193:
8Working with casesAdd, delete, or
Page 194 and 195:
8Working with casesModify casesYou
Page 196 and 197:
8Working with casesCustomize cases3
Page 198 and 199:
8Working with casesCustomize cases4
Page 200 and 201:
9Managing policies and rulesHow pol
Page 202 and 203:
9Managing policies and rulesTypical
Page 204 and 205:
9Managing policies and rulesTypical
Page 206 and 207:
9Managing policies and rulesManagin
Page 208 and 209:
9Managing policies and rulesAdd, mo
Page 210 and 211:
9Managing policies and rulesAdd, mo
Page 212 and 213:
9Managing policies and rulesManage
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
9Managing policies and rulesIdentif
Page 220 and 221:
9Managing policies and rulesIdentif
Page 222 and 223:
10Managing action rulesHow McAfee D
Page 224 and 225:
10Managing action rulesAdd, modify,
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
11Managing conceptsTypical scenario
Page 234 and 235:
11Managing conceptsAdd, apply, rest
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
12Using templatesTypical scenariosT
Page 242 and 243:
12Using templatesAdd, modify, and d
Page 244 and 245:
12Using templatesAdd, modify, and d
Page 246 and 247:
13Managing McAfee DLP systemsConfig
Page 248 and 249:
13Managing McAfee DLP systemsConfig
Page 250 and 251:
13Managing McAfee DLP systemsUsing
Page 252 and 253:
Page 254 and 255:
Page 256 and 257:
Page 258 and 259:
13Managing McAfee DLP systemsAdding
Page 260 and 261:
Page 262 and 263:
Page 264 and 265:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 274 and 275:
13Managing McAfee DLP systemsManagi
Page 276 and 277:
Page 278 and 279:
Page 280 and 281:
13Managing McAfee DLP systemsTechni
Page 282 and 283:
13Managing McAfee DLP systemsTechni
Page 284 and 285:
14Disaster recovery backup and rest
Page 286 and 287:
Page 288 and 289:
Page 290 and 291:
15Technical supportCreate a technic
Page 292 and 293:
Indexdevice class (continued)status
Page 294 and 295:
Indexuser groupscreating 275deletin
show all

McAfee Data Loss Prevention 9.2.2 Product Guide

Create successful ePaper yourself

Delete template?

Save as template?