McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverCrawling databasesPort options for database scansPort numbers for each of the database types are already set. If a different port is to be used for thescan, it can be defined in the Node Definition tab.Table 4-10 Port options for database scansOption DefinitionPortPorts are automatically configured according to database type. Enter non‐standard ports inthe Node Definition Port box.• DB2 ‐ 50000• Microsoft SQL Server ‐ 1433• MySQL ‐ 3306• Oracle ‐ 1521Advanced options for database scansMcAfee DLP Discover supports configuration of bandwidth and email notification in addition to routinescanning tasks. These options are available on the Add Scan Operation page in the Advanced Options tab.Bandwidth throttling allows you to set a specific data transfer rate for a scan. Email notification allowsset up of notification when a scan has started, stopped or both.Email subject fields are not customizable. There might be a lag of a few minutes between the actualtask start‐stop time and the email posting. The end notification is sent at the end of scanning. Recordsprocessing might continue after notification.Table 4-11 Schema options for database scansOptionBandwidthEmail NotificationEmail To / On StartEmail To / On EndDefinitionWhen throttling is activated, allows users to set bandwidth allocated to a scan.Notifies users of scanning operations if On Start or On End is selected.Sends customized email to a user when a scan starts.Sends customized email to a user when a scan is complete.Using SSL certificatesLike credentials, SSL certificates authenticate users to repositories that are to be crawled. Unlikecredentials, they encrypt the channel between the database server and the McAfee DLP Discoverappliance.Database scans using SSL certificates enforce host name verification by default while negotiating aSSL connection with a database server. Host name verification ensures that the host name in thedatabase server URL to which the crawler (client) connects matches the host name in the digitalcertificate that the database server sends back as part of the SSL connection.Host name verification is enforced by default; it cannot be turned on and off.This helps to prevent man‐in‐the‐middle attacks. But in some situations, the host name in SSLcertificate might differ from the host name of database server (for example, a certificate might beissued to an alias/subdomain like xyz.mcafee.com, but the database server given (in URL) isxyz1.mcafee.com).The database crawler will fail to crawl such SSL setups. The workaround is to either use the correcthostname in the database host name while configuring the scan, or configure the correct SSLcertificate on the database server and upload it to McAfee DLP Manager.84 McAfee Data Loss Prevention 9.2.2 Product Guide