McAfee Data Loss Prevention 9.2.2 Product Guide

More documents

Recommendations

Info

4Using McAfee DLP DiscoverOptimizing scanning with data classification5 Type in the Host Name or IP address of the database server.6 Click Save.The certificate be uploaded to the McAfee DLP Discover appliance and stored in the TrustStore ofthe database crawler, and its identifying characteristics will appear in the Edit SSL Certificate window.After you have added the certificate and saved the task, you can start it. If the certificate matches theexported from the database, the crawler will start.Troubleshooting the SSL certificateIf the crawl fails to validate the certificate, you can log on as root to the McAfee DLP Discoverappliance to examine the certificates in the TrustStore.Change directory to /data/stingray/python, then view the contents of the certificate file by runningthis command:# ./certificate_ct1.py LISTYou can match up the information in this file to the Certificate Details pane of the Edit SSL Certificate window.Optimizing scanning with data classificationThe Data Classification feature sorts crawled data into different content types and evalutes the likelihoodof potential rule violations before they are reported. That knowledge can be used to create newprotection strategies and optimized, more effective scans.This feature is not available for database scanning, but you can create an inventory scan for thedatabase to estimate the size and its schema structure.Without enough information about the characteristics of data in a repository, constructing a protectionstrategy for the data involves trial and error. Sensitive data might be sampled with different types ofcrawls, and trial runs might be done using different combinations of rules and policies.Data Classification uses an OLAP data model to obviate the need for such time‐consuming tactics,producing comprehensive and useful information so that new strategies can be devised and significantresults can be retrieved more quickly.Once data has been classified for use in optimized scans, OLAP tools can be used to manipulate andrecord it.How McAfee DLP Discover uses OLAPMcAfee DLP Discover databases are configured to use Online Analytical Processing, a data model thatenables processing of metadata at rapid rates from many different viewpoints. The process createsmultidimensional relationships between data values.When McAfee DLP Discover scans a file system repository, each value, or hypercube, is compared tomany others in the database. A web of relationships between data values produces previouslyunknown data patterns that can be used to protect data at rest quickly and more effectively.When an optimized Discover scan is run after data has been classified and stored in amultidimensional OLAP database, new knowledge about the data can be used to estimate potentialviolations. Using data that describes the context of data values amplifies its usabilty and extends theeffectiveness of discovery.86 McAfee Data Loss Prevention 9.2.2 Product Guide
Using McAfee DLP DiscoverOptimizing scanning with data classification 4McAfee DLP Discover includes OLAP tools that enable users to explore all aspects of the scanned data.Evaluating the contents of a repository or share before scanning makes it possible to invent newprotection strategies that will focus efforts more precisely on data at risk.The OLAP NavigatorThe OLAP Navigator displayed on the Predefined View and Task View pages provides tools that allow users tomanipulate classified data.The OLAP tools give you the ability to explore, drill down, chart, print and report classified data in aninfinite number of configurations.You must be authorized to view Data Classification results. An administrator must add that privilege to theyour user group under Discover Scan Permissions.Each of the attributes listed under Columns and Rows offer an opportunity to explore the classified dataproduced by the scan you are analyzing.After you have analyzed a view, you can clear it by clicking X.Table 4-13 OLAP toolsOLAP toolOLAP NavigatorFunctionDisplays potential rule hits using the classified data available for each.Drill position Offers the ability to drill down to finer granualarity data levels by clicking +.Show/Hide ChartChart ConfigurationConfigure Print SettingsPrint to PDFExport to ExcelUse the values to show or hide the default chart.Use chart settings to create a new chart.Use print settings to print a new chart.Save the results in a PDF report.Save the results in a CSV report.How the classification engine worksThe data classification engine operates on two levels: during scan operations, and on the McAfee DLPdevice.When inventory and classification scans run, the classification engine crawls the defined repository,reports the files and directory attributes (file name, size, path, etc.) found at that location, classifiesthem by file type, and reports the results in a several different predefined views.During a classification scan, the inventory phase is followed by fetching and classifying the contentthat is found in the repository. The classification engine then stores the existing information about thedata (metadata) in a classification database, and it is available on the Data Classification dashboard.The data can then be used to add refined Discover and Registration scans that allow targeting ofspecific content types and policies.Classification scans do not generate incidents on Data‐at‐Rest dashboards.McAfee Data Loss Prevention 9.2.2 Product Guide 87
Page 1:
Product GuideRevision AMcAfee Data
Page 6 and 7:
ContentsFind host names in data at
Page 8 and 9:
ContentsDelete views . . . . . . .
Page 10 and 11:
ContentsTypical scenarios . . . . .
Page 12 and 13:
Contents12 McAfee Data Loss Prevent
Page 14 and 15:
PrefaceFind product documentationTi
Page 16 and 17:
1McAfee DLP ManagerMcAfee DLP data
Page 18 and 19:
2Using McAfee DLP MonitorHow data i
Page 20 and 21:
2Using McAfee DLP MonitorTypical sc
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
2Using McAfee DLP MonitorSearch bas
Page 28 and 29:
2Using McAfee DLP MonitorUsing logi
Page 30 and 31:
2Using McAfee DLP MonitorSupported
Page 32 and 33:
Page 34 and 35:
Page 36 and 37: 2Using McAfee DLP MonitorSupported
Page 38 and 39: 2Using McAfee DLP MonitorRules used
Page 40 and 41: 2Using McAfee DLP MonitorFinding in
Page 42 and 43: 2Using McAfee DLP MonitorFinding in
Page 44 and 45: 2Using McAfee DLP MonitorUse concep
Page 46 and 47: 2Using McAfee DLP MonitorFind data
Page 52 and 53: 2Using McAfee DLP MonitorSearching
Page 64 and 65: 2Using McAfee DLP MonitorFinding do
Page 66 and 67: 3Managing McAfee DLP PreventHow McA
Page 68 and 69: 3Managing McAfee DLP PreventConfigu
Page 70 and 71: 3Managing McAfee DLP PreventConfigu
Page 72 and 73: 4Using McAfee DLP DiscoverTypical s
Page 74 and 75: 4Using McAfee DLP DiscoverTypical s
Page 76 and 77: 4Using McAfee DLP DiscoverRegisteri
Page 78 and 79: 4Using McAfee DLP DiscoverRegisteri
Page 80 and 81: 4Using McAfee DLP DiscoverCrawling
Page 88 and 89: 4Using McAfee DLP DiscoverOptimizin
Page 90 and 91: 4Using McAfee DLP DiscoverManaging
Page 104 and 105: 4Using McAfee DLP DiscoverScan stat
Page 108 and 109: 4Using McAfee DLP DiscoverSearch di
Page 114 and 115: 4Using McAfee DLP DiscoverRemediati
Page 122 and 123: 4Using McAfee DLP DiscoverGetting s
Page 124 and 125: 4Using McAfee DLP DiscoverGetting s
Page 126 and 127: 4Using McAfee DLP DiscoverConfiguri
Page 128 and 129: 4Using McAfee DLP DiscoverConfiguri
Page 130 and 131: 5Integrating McAfee DLP EndpointTyp
Page 136 and 137:
5Integrating McAfee DLP EndpointTyp
Page 138 and 139:
5Integrating McAfee DLP EndpointVie
Page 140 and 141:
5Integrating McAfee DLP EndpointCon
Page 142 and 143:
5Integrating McAfee DLP EndpointUni
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
5Integrating McAfee DLP EndpointTag
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
6Managing the Home pageHow the Home
Page 174 and 175:
7Using the Incidents dashboardTypic
Page 176 and 177:
7Using the Incidents dashboardSort
Page 178 and 179:
7Using the Incidents dashboardGetti
Page 180 and 181:
7Using the Incidents dashboardGetti
Page 182 and 183:
7Using the Incidents dashboardSet u
Page 184 and 185:
7Using the Incidents dashboardGener
Page 186 and 187:
7Using the Incidents dashboardCusto
Page 188 and 189:
7Using the Incidents dashboardContr
Page 190 and 191:
8Working with casesManage case perm
Page 192 and 193:
8Working with casesAdd, delete, or
Page 194 and 195:
8Working with casesModify casesYou
Page 196 and 197:
8Working with casesCustomize cases3
Page 198 and 199:
8Working with casesCustomize cases4
Page 200 and 201:
9Managing policies and rulesHow pol
Page 202 and 203:
9Managing policies and rulesTypical
Page 204 and 205:
9Managing policies and rulesTypical
Page 206 and 207:
9Managing policies and rulesManagin
Page 208 and 209:
9Managing policies and rulesAdd, mo
Page 210 and 211:
9Managing policies and rulesAdd, mo
Page 212 and 213:
9Managing policies and rulesManage
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
9Managing policies and rulesIdentif
Page 220 and 221:
9Managing policies and rulesIdentif
Page 222 and 223:
10Managing action rulesHow McAfee D
Page 224 and 225:
10Managing action rulesAdd, modify,
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
11Managing conceptsTypical scenario
Page 234 and 235:
11Managing conceptsAdd, apply, rest
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
12Using templatesTypical scenariosT
Page 242 and 243:
12Using templatesAdd, modify, and d
Page 244 and 245:
12Using templatesAdd, modify, and d
Page 246 and 247:
13Managing McAfee DLP systemsConfig
Page 248 and 249:
13Managing McAfee DLP systemsConfig
Page 250 and 251:
13Managing McAfee DLP systemsUsing
Page 252 and 253:
Page 254 and 255:
Page 256 and 257:
Page 258 and 259:
13Managing McAfee DLP systemsAdding
Page 260 and 261:
Page 262 and 263:
Page 264 and 265:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 274 and 275:
13Managing McAfee DLP systemsManagi
Page 276 and 277:
Page 278 and 279:
Page 280 and 281:
13Managing McAfee DLP systemsTechni
Page 282 and 283:
13Managing McAfee DLP systemsTechni
Page 284 and 285:
14Disaster recovery backup and rest
Page 286 and 287:
Page 288 and 289:
Page 290 and 291:
15Technical supportCreate a technic
Page 292 and 293:
Indexdevice class (continued)status
Page 294 and 295:
Indexuser groupscreating 275deletin
show all

McAfee Data Loss Prevention 9.2.2 Product Guide

Create successful ePaper yourself

Delete template?

Save as template?