Download Security for Microsoft SharePoint 3.0 Product Guide

5
Policy Manager
Manage core scanner settings for a policy
4
5
6
In Activation, select Enable to activate the DLP and compliance scanner settings for the selected
submenu item.
•
By default, all scanner setting options are disabled for DLP and Compliance Scanner for sub
policies.
•
If you are configuring settings for a sub‑policy, select Use configuration from parent policy to
inherit settings from the parent policy.
In Options, you can use:
•
Include document and database formats — To scan documents and database formats, for noncompliant
content.
•
Scan the text of all attachments — To scan the text of all attachments.
•
Create — To create a new alert message when the content of an item is replaced due to a rule
being triggered. See the Create a new alert section for more instructions.
•
View/Hide — To display or hide the preview of the alert message. If the preview is hidden, clicking
this link displays it. If the preview is displayed, clicking this link hides it.
In DLP and Compliance rules and associated actions, click Add rule.
The DLP and Compliance Rules page appears.
7
In Specify actions for rule, select a rule group from the Select rule group drop‑down menu that triggers an
action, if one or more of its rules are broken. Each phrase can have a Score set for a category,
under DLP and Compliance Scanner Phrase.
For some rule groups, you might need to specify these options:
•
Threshold score — To specify the maximum threshold score upon which the scanner triggers.
•
Max Term Count — To specify the maximum number of times this rule group can be triggered.
Exceeding this count triggers the scanner to take the specified action.
The equation for current Threshold score = Score x Term Count (instance). A rule is triggered when the
value equals or exceeds the Threshold score.
To understand how Threshold score and Max Term Count helps in triggering a rule, let us consider an
example on Pascal Language dictionary. Consider that you have set the Score for the DLP and
Compliance Scanner Phrase "PAnsiChar" to 5.
Under Select rule group, if you have selected Pascal Language dictionary, and set the value for:
•
Threshold score = 15
•
Max Term Count = 4
If "PAnsiChar" is found twice in the code, the current threshold score becomes 10. Hence the rule
will NOT be triggered.
If "PAnsiChar" is found five times in the code, the current threshold score will still be calculated as
Score x Max Term Count which is 5 * 4 = 20. This value is greater than the defined threshold score.
Hence the rule will be triggered.
Consider that you have modified the Score for "PAnsiChar" to 8. If the phrase "PAnsiChar" is found
thrice in the code, the current threshold score becomes 24. Now the rule will be triggered as it
exceeded the specified Threshold score.
McAfee Security for Microsoft SharePoint 3.0.0
Product Guide
59