For continuous, automated discovery of data in a cloud service like a new portal, the correct approach is to use McAfee’s cloud connector framework. Creating a discovery job targeted at the specific cloud storage location, with classification rules (e.g., for account number formats), will automatically scan and classify data as it appears, providing real-time visibility without manual intervention.

Creating separate, descriptively named policies (e.g., “PCI Cardholder Data Protection” and “HR Confidential Records Protection”) is a best practice. This provides clear separation of controls, simplifies management and tuning, and creates a precise audit trail. During an incident or review, logs will clearly indicate which specific policy was triggered, demonstrating targeted compliance efforts for each data type.

The first step in any incident review is to gather facts. You must examine the incident details within the DLP console to see the exact content snippet or file that triggered the rule and understand the confidence level of the classification match. This confirms whether it was a true positive (actual source code) or a false positive (e.g., a document that merely mentions the words ‘source code’). This factual analysis is crucial before taking any action.

DLP Prevent functions (like encryption on copy) are enforced by the DLP Prevent agent running on the endpoint. If this agent is not installed, is corrupted, or is disabled, the endpoint cannot enforce the policy, even if the policy is correctly configured in ePO. The Discover server being offline would affect scanning repositories, not real-time endpoint prevention.

A Classification Rule is the core component that defines *what* to look for. It combines one or more identifiers (like your custom ID number identifier) with conditions and confidence levels. You then add this classification rule to a discovery job to tell the scanner, “When you run, use this rule to find and classify data matching these criteria.”

The most targeted and effective solution is to refine the agent’s configuration. The ‘File Types’ settings often include options to skip files based on size. Excluding extremely large files (with an appropriate size threshold) from deep content inspection can dramatically improve performance for users while still protecting the vast majority of documents. Changing the action from Block to Monitor does not reduce the scanning workload.

McAfee DLP includes a robust reporting and dashboard engine designed specifically for this purpose. It can generate pre-configured or custom reports that aggregate incident data, show top violators, top policies, and trends over time. This is far more efficient and accurate than manually compiling data from the raw incident list.

Endpoint-based DLP enforcement (monitoring, blocking, encrypting) is contingent on the DLP Prevent agent being installed and communicating with your management server (ePO). Without the agent, the endpoint has no ability to interpret or enforce DLP policies, regardless of user or device ownership. Managing agent installation on non-corporate devices requires a clear process and agreement with the contracting party.

Many DLP network monitors inspect traffic on common web ports (80, 443). If a cloud application uses a less common port for its API or data transfer, and the DLP network monitor is not configured to decrypt and inspect traffic on that specific port, the upload will bypass the network-based policy. Investigation would involve checking the network monitor’s port settings and the cloud app’s behavior.

For continuous, automated discovery of data in a cloud service like a new portal, the correct approach is to use McAfee’s cloud connector framework. Creating a discovery job targeted at the specific cloud storage location, with classification rules (e.g., for account number formats), will automatically scan and classify data as it appears, providing real-time visibility without manual intervention.0