cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Mcafee DLP monitor automatic response

Dear Team,

We have DLP policy for specific device exception on the specific container.but from my query was if any new devices connected on those container machines. As a admin i need automatic mail for the user connected not excluded devices.

I have configured the automatic response in my server but i am getting the below mail as expected.but still event ID information is not displaying..But event id "19115"

Kindly help me if any parameter i am missing in the configuration.

Hostname: LT006678

Event Description: Device Plug

Event ID: {ThreatEventID}

Threat Name: DENY ALL WPD_UHG

Event Type: Threat

User Name: LT006678\Vnameit


Regards,

Kuraj

7 Replies
palex
Level 11
Report Inappropriate Content
Message 2 of 8

Re: Mcafee DLP monitor automatic response

Menu - Configuration - Server settings - Event Filtering choose "All events to the server".

Regards

Re: Mcafee DLP monitor automatic response


Dear Team,

I thick you didn't get my query.

I have enabled all the Events in my server already.

If the events is not enabled means other description will show none. But only Event ID details alone showing as {threatEventID} instead of "19115".

rest others are showing as expected. Example threatname: DENY ALL WPD_UHG ; User name: test\vnameit

Need to know what body action I need to give for Event ID: {ThreatEventID}   and also I have mentioned below the screenshots

Capture.JPG

Hostname: LT006678

Event Description: Device Plug

Event ID: {ThreatEventID}

Threat Name: DENY ALL WPD_UHG

Event Type: Threat

User Name: test\Vnameit

Regards,

Kuraj

palex
Level 11
Report Inappropriate Content
Message 4 of 8

Re: Mcafee DLP monitor automatic response

Hi, kumar.raja67!

I do not understand, how did you do this server task.

Do you tell me how do you do this e-mail responce?

Re: Mcafee DLP monitor automatic response

Dear Team,

In Automatic Response (Configure to trigger in response)

Menu--> Automation--> Automatic response-->

In Filter I am adding DLP event id:19115.

If user access without exclude device popup will display from user machine..At the same time as a admin I will get email with the 2nd screenshots "Body" what information

I have provided like wise I will get email to my id.

My Query was Host name, Event Description,Threatname.event type, User name information I am able to get from user machine details.

But Event id alone not showing the Event id number.. From the output I have highlighted the Bold with underline.

From output  I am getting this

Event ID: {ThreatEventID}

I need output like this Event ID: 19115

Output :

Hostname: test

Event Description: Device Plug

Event ID: {ThreatEventID}

Threat Name: DENY ALL WPD_UHG

Event Type: Threat

User Name: test\Vnameit

1.JPG

11.png


Regards,

Kumararaja J

palex
Level 11
Report Inappropriate Content
Message 6 of 8

Re: Mcafee DLP monitor automatic response

Hi, kumar.raja67!

I tested! You response work fine!

You have an error: {ThreatEventID} is not right, you must write {threatEventID}.

When I write {threatEventID} the responce was: "19115".

I hope that helped ))

Regards.

Re: Mcafee DLP  monitor automatic response

Dear Team,


Thanks for the update.


I have Changed the name with "threatEventID" now I am getting the response was "19115"


Thank you so much for your help  🙂


Regards,

kuraj

palex
Level 11
Report Inappropriate Content
Message 8 of 8

Re: Mcafee DLP monitor automatic response

Hi, kumar.raja67!

Thank you. I am very pleased 🙂


Regards.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community