cancel
Showing results for 
Search instead for 
Did you mean: 
Reliable Contributor Troja
Reliable Contributor
Report Inappropriate Content
Message 1 of 5

Monitoring PNP and Removeable Storage Devices

Hi all,

does anyone know a good way to monitor and report PNP and Removeable Storage Devices without generating Incidents?

Goal: We need the following Reports

  • Which PNP and Removeable storage devices have been connected to endpoints. Like iPhones, MP3 players, removeable WLAN card and more.
  • How much content was copied to removeable storage.

But, i do not want a massive amount of Incidents.

Any ideas?

Cheers

4 Replies
McAfee Employee hhoang
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Monitoring PNP and Removeable Storage Devices

The way DLP 'monitors' devices is essentially by generating incidents.  If you would like to minimize the amount of incidents being generated probably the best route would be to pilot the rules in specific departments and/or user groups.  Alternatively, monitor single device types at a time before expanding to additional device types.

Reliable Contributor Troja
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: Monitoring PNP and Removeable Storage Devices

Hm,

thanks for the answer, this is really a nasty product design... 

Cheers

Highlighted
Reliable Contributor bretzeli
Reliable Contributor
Report Inappropriate Content
Message 4 of 5

Re: Monitoring PNP and Removeable Storage Devices

@Throsten,

Mit DLP 11 ein wenig besser oder wieder schlechter geworden 😉

Was wir immer noch nicht wissen > Wie man LEERE Reports im EPO gar nich erst versenden kann. (z.B. bei ROGUE SCAN reports)

Beim DLP > Die Loesung ist bis dato bei einem Event via E-Mail zu versenden und das wird dan mit einer Exchange Regel in ein IT-Alert-DLP Postfach verschoben usw. Teilweise filtere ich dann die Sachen welche ich nicht will sogar mit Transport Rules auf dem Exchange.

Das selbe Problem habe ich bei Mcafee Security for Exchange Reports oder Alerts. Das Feintuning der Reports und Alerts ist nicht so durchdacht manchmal.

Reliable Contributor Troja
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: Monitoring PNP and Removeable Storage Devices

Hello ​,

i will attend the McAfee DLP class at the Techforum in Portugal this year. Let´s see the outcome of this week. If you have some nasty questions, please let me know, i can ask them there. 🙂

Cheers

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator