cancel
Showing results for 
Search instead for 
Did you mean: 
Rijo
Level 7
Report Inappropriate Content
Message 1 of 22

Configure paragraph in mcafee DLP

Jump to solution

How to configure paragraph based classification in DLP? Currently DLP is generating alert for single word. I want that the alert be generated only if the entire paragraph is matched in a file. How will I achieve that?

2 Solutions

Accepted Solutions
McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 15 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

1. Please check in the orion.log file for the copy error. Please try the DLP 11.0 P6 build once as some defects were fixed in latest releases.

2. For the audit error messages:

There was past issue where an unwanted messages was reported in ePOs audit.log:


ePolicy Orchestrator audit log contains excessive "Notify Agent" messages
Technical Articles ID: KB88281

What you see sounds simulare, but the button portion of the messages is unexpected here.

Also refer: https://kc.mcafee.com/corporate/index?page=content&id=KB71458

McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 18 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

The error related to EEADMIN is for McAfee Drive Encryption Product.

 

The error mentioned related to copy is from DLP. Based on the error mentioned in the log file, its very clear that user does not have permission to perform the copy.

Please perform the below options and check if the issue is resolved.
1. The ePO computer account needs access to the evidence share.
2. Add the user to ”everyone” group to the UNC folder, then the issue would get resolved.

 

21 Replies
McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 2 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

You need to use the registered document feature.

 

Refer the product guide:

https://kb.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27070/en_US/...

 

Registered documents
The registered documents feature is based on pre-scanning allfiles in specified repositories (such as the engineering SharePoint) and creating signatures of fragments of each file in these repositories. McAfee DLP Endpoint and the network McAfee DLP products use slightly di΍erent versions of registered documents.

McAfee DLP Endpoint uses manual registration. Signatures of files are manually uploaded to a McAfee ePO database by McAfee DLP. These signatures are then distributed to all managed endpoints. The McAfee DLP
Endpoint client is then able to track any paragraph copied from one of these documents and classify it according to the classification of the registered document signature. McAfee DLP Prevent and McAfee DLP
Monitor also access the McAfee ePO database to use registered documents. McAfee DLP Discover runs registration scans on file repositories. The signatures created by this automatic registration are stored in signature databases on servers designated as DLP Servers. They are used by McAfee DLP Discover to create classification and remediation scans. They are also used by McAfee DLP Prevent and McAfee DLP Monitor to define rules.

Rijo
Level 7
Report Inappropriate Content
Message 3 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

Do we require license for Mcafee DLP Prevent and monitor for creating package in registered documents?

McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 4 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

No, if you have DLP endpoint license key then regitsered document feature works for that as well.

Its common for both Endpoint DLP and Network DLP.

Rijo
Level 7
Report Inappropriate Content
Message 5 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

I tried uploading a sample file in registered document. The upload was successfull. I can see the document in the file list. But when I tried to create package after that. It showed me error "Error during package creation ". Currently there is only one file in file list. Why am I getting the error while creating package? When I checked the audit log; it showed as copying files to evidence folder failed and also Copying package for computer with XXXXXX (client configuration) error. Is it failing due to this? Please help me.

McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 6 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

Please check the errors in the ePO Audit Log:

This error may occur when invalid credentials are used when trying to complete the Manual RegDoc package creation.


Specifically, copying the .dat package to the \\server\\regDocs folder.


 

 

Rijo
Level 7
Report Inappropriate Content
Message 7 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

I checked the credentials. It is correct. Where exactly should I checked the credentials? Why I am getting client configuration error?

McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 8 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

Please check the errors recorded in the ePO Audit Log. What is the error message shown in the audit log. 

Also, please check the orion.log file for the errors been generated.

Highlighted
Rijo
Level 7
Report Inappropriate Content
Message 9 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

I am getting this error "Could not copy files to \\Server name\regDocs". Actually it is trying to copy files to two evidence folder location. There are two evidence folder location for two different client configuration policy. For one client configuration; the copy is successfull to its respective evidence folder. But for other; I am getting copy error. Both evidence share location use same credentials for copying files. Both evidence folders are on two different servers.

McAfee Employee nyeshoda
McAfee Employee
Report Inappropriate Content
Message 10 of 22

Re: Configure paragraph in mcafee DLP

Jump to solution

Try to manually copy a file into the other share. If it fails then its issue with login cradentials. So need to fix the login issue 1st.

 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community