If you want to block Files based on the content in them,
You have to create a Removable Storage Protection Rule.
Follow the following steps :-
Creat a content classification rule based on text pattern or dictionary items.
Goto Protection rules
Create a Removable storage protection rule with the same content classification tag.
Apply this rule, and you will not be able to copy any file having that content to that USB.
McAfee DLP has many more content aware features and rules that can be used in full mode.
Hope I could help.
Thanks for answer but I am not able to understand how I can create content classification rule for my file, we blocked following files from executing on Removabale storage by this we are achieving follwing
1. User will not able to copy any blocked file on removable storage (online/offline)
2. If copied from other system (not running DLP product) then execution will be blocked
Issue we discover in this approach
We blocked EXE file for USB but if we just rename to EXE file to some other allowed extension then DLP not blocking this file.. any thoughts on this We blocking following extension using "Removable Storage File Access Rule"
Product in Use
Mcafee Agent : 126.96.36.1997
Mcafee DLP Endpoing : 188.8.131.527
Mcafee VS Ent. : 8.8.0
EPO : 5.0.1 (Build 228)
this is not the rule you are looking for.
First, GoTo Agent Configuration--> File Tracking--> Ensure Device Control with removable storage protection mode is selected.
Now, Goto Classification rules, Here you create a content classification based on your requirement.
Finally, Goto Protection rules-->Create Removable Storage Protection Rule--> Include your content classification.
You can refer to product guide for more info on how to create these rules.
Hope I Could Help.