McAfee Network Data Loss Prevention (DLP) Discover
Identify and protect sensitive data

Features & Benefits:

Simplify data protection
Cut the time and effort required to secure enterprise information. McAfee DLP Discover automatically scans all accessible resources to pinpoint sensitive data, uncover potential risks, and identify the content owner.

Control sensitive information
Filter and control sensitive information with multivector classification. Inventory and index all content, and then query and analyze that data to better understand and manage it.

Identify the most exotic data
Classify data that does not fall into standard file categories. DLP Discover uses a technology called “Concepts” to describe where you can find data within a file. Once defined, it is easy to use Concepts anywhere within the system to find, categorize, and search for specific data items.

Review and remediate violations
Learn the origin of content violations, register and generate signatures, and send alert notifications to protect documents and the information within them more effectively. Integrated case management supports notification to content owners and system administrators using configurable messages.

Make policy generation easy
Perform queries and transfer the results to a protection rule. Customize the pre-built compliance, corporate governance, and intellectual property policies, or create your own. Then, register sensitive information for fingerprinting to ensure safe handling and reduce false positives.

Get powerful reporting
Customize summary and detail views of inventory logs and search results. You can create reports on demand or schedule for regular delivery. To get you started, the system comes with over 20 preconfigured, customizable reports.

Perform automatic network scanning
Scan laptops, desktops, servers, file transfer locations, document repositories, portals, and databases with ease. DLP Discover’s advanced network crawling technology uncovers data you never knew existed. Determine what and where to search, and build the schedule to regularly retrieve network data that is appropriate for your workflow.

Guarantee broad content compatibility
Ensure support for over 300 content types, including Microsoft Office documents, multimedia files, source code, design files, archives, encrypted files, built-in policies, and intellectual property.

Get broad database support
Access support for the following databases: Oracle 8i and later; MySQL Enterprise 5.0 and 5.1; Microsoft SQL Server 7.0, up to 2008; and IBM DB2 5 thru 9.1.

Create advanced data analytics
Perform a granular investigation and historical inspection of information to detect risk of data exposure. Quickly identify sensitive information through an intuitive search interface, and determine who is sending data and where it is located.

Gain common repository support
Get support for the following repositories: Common Internet File System (CIFS), Server Message Block (SMB), Network File System (NFS), HTTP/HTTPS, FTP, Microsoft SharePoint, and EMC Documentum.

Register data instantly
Register data from any supported repository or database. You can use signatures from registered data to detect sensitive material in policies enforced across the network.

Develop powerful rule definitions
Create robust rules to define what data is scanned, including keywords, regular expressions, database tables, rows and columns, and unique McAfee Concepts. Document registration to rules, including network path scanning, on a configurable schedule, and easily discriminate between non-sensitive and sensitive information. You can also restrict rule and policy enforcement to specific scan operations.

Prevent Loss of Sensitive Data

From source code to trade secrets to strategic business plans, IP and other information assets are critical to your brand, public reputation, and competitive edge. Protecting data during transmission is critical, but securing sensitive data before it is inappropriately accessed or moved and understanding where it resides should be your first line of defense.

McAfee DLP Discover helps you protect your organization against data loss. Unlike legacy solutions that expect you to know exactly what content you want to protect, McAfee DLP Discover provides comprehensive coverage for obvious information and helps you find the non-obvious.

Determine What Information to Protect

To identify information and proliferation risks, McAfee DLP Discover can be configured to scan specific repositories and identify data for explicit protection. Additionally, all data crawled by McAfee DLP Discover is indexed and made accessible through an intuitive interface, allowing you to quickly search for data that may be sensitive in order to understand who owns the content and where it is stored.

Define Policies for Protection

Once you know what information to protect, McAfee DLP Discover can help you accurately protect that information. McAfee DLP Discover provides intuitive and unified policy creation, reporting, and management to give you more control over your information protection strategy for data at rest. Key benefits of the policies, rules, and classifications in McAfee DLP Discover include:

• Numerous built-in policies for a simple out-of-box experience.
• Powerful rule-construction engine, from simple structured data (credit cards, Social Security numbers) to complex information (intellectual property).
• Simplified rule creation and validation by transferring search result analysis to a protection rule.
• Integration with adjacent information security vectors to ensure consistent protection.
• Exclusion of public documents and common text to prevent benign information from generating incidents.

Scan Your Network for Violations

After policies are defined, McAfee DLP Discover can be instructed to routinely scan network resources for policy violations. Flexible scheduling options are available to perform continuous, daily, weekly, or monthly scans.

McAfee DLP Discover automatically scans all accessible resources, including laptops, desktops, servers, document repositories, portals, and file transfer locations, for policy violations. You can define scan groups based on IP addresses, subnets, ranges, or network paths. You can also focus scan operations based on specific parameters, such as scanning only My Documents for all users and not system folders, or looking for files owned by specific users or of a certain type or size.

Review and Remediate Violations

McAfee DLP Discover eliminates or minimizes proliferation of sensitive material through integrated incident workflow and case management. If McAfee DLP Discover finds content that violates protection policies, it generates incidents and sends notifications. Incidents created by McAfee DLP Discover can be added to the case management framework, which allows you to involve specialists from numerous organizations within the company to take action on the violation. Additionally, risk dashboards provide easy ways for security personnel to see the profile of policy violations and generate reports based on any data at rest parameter of interest.

Capture and Analyze Stored Data

In addition to scanning network resources to detect policy violations, McAfee DLP Discover also indexes all content found at rest in the network and provides you with the ability to query and mine this information to understand your sensitive data. McAfee DLP Discover lets you quickly understand your sensitive data, how it is used, who owns it, where it is stored, and where it has proliferated.

Complex Data Classification

McAfee DLP Discover empowers your organization to protect all kinds of sensitive data—from common, fixed-format data to complex, highly variable intellectual property. By combining the inputs from these object-classification mechanisms, McAfee DLP Discover is able to build a highly accurate, multivector classification, which is used to filter and control sensitive information and to perform searches that identify hidden or unknown risks. Object classification mechanisms include:

• Multilayer classification—Covers both contextual information and content in a hierarchical format.
• Document registration—Includes biometric signatures of information as it changes.
• Grammar analysis—Detects grammar or syntax of anything from text documents to spreadsheets to source code.
• Statistical analysis—Tracks how many times a signature, grammar, or biometric match occurred in a particular document or file.
• File classification—Identifies content types regardless of the extension applied to the file or compression.

Specifications:

DLP Discover Specifications
Content types	Supports file classification of more than 300 content types, including: Microsoft Office documents Multimedia files Source code Design files Archives Encrypted files Built-in policies Intellectual property
Repositories supported	Common Internet file system/server message block (CIFS) Network file system (NFS) HTTP/HTTPS FTP/FTPS Microsoft Sharepoint EMC Documentum Databases: Microsoft SQL, Oracle, DB2, MySQL Enterprise

Specifications: McAfee DLP 5500 Appliance
Component	Description
Processor	2 x Intel E5-2620 6 core, 15 M Cache, 2.0 GHz, 7.20 GT/s Intel QPI
Memory	32 GB DDR3-1333 MHz
Power supply	2 x 760 W hot-swap power supply modules
Hard drives	8x 2 TB SATA 7.2K rpm drives
NIC card	Intel Dual Copper 1Gbps Ethernet I/O Module
IPMI	Intel Remote Management Modules 4 (AXXRMM4)
Product size	2 rack units (2U)

Specifications: Virtual Machines
McAfee DLP Discover is available as a virtual appliance that can run on VMware environment. Below are the minimum hardware requirements for running the virtual appliance.
Component	Requirement
Processor	Intel x86 4x vCPU
Memory	16 GB RAM
Hard disk drive(s)	Drive 1: Minimum size, 100 GB for VM software Drive 2: Minimum size, 512 GB for DLP virtual image
Network	4 Virtual NICs
BIOS	Enable VT thread

Document Registration

Documents can be registered from any repository. Signatures from registered documents can be used locally for detecting proliferation of sensitive material, or be made available to other McAfee DLP Appliances.

Reporting

The powerful analytics engine for incident and search result views allows you to customize summary views based on any two contextual pivot points. List and detail views, as well as summary views with trending, are available. More than 20 customizable prebuilt and customizable reports are provided with the system.

System Requirements:

McAfee DLP Manager, McAfee DLP Monitor, McAfee DLP Discover, and McAfee DLP Prevent are now supported on the McAfee DLP 5500 appliance. The DLP 5500 appliance is an Intel-based platform with dual six core CPUs, 32 GB of RAM and over 10 TB of storage in a 2U form factor. DLP hardware appliance solutions are self-contained devices. There are no minimum software or hardware system requirements or additional database installations required.

McAfee DLP 5500 Appliance

• System
  • CPU: 2x Intel E5-2620, 6 core, 15 M Cache, 2.0 GHz, 7.20 GT/s Intel QPI
  • Memory:32 GB P1333 DDR3
  • Hard Drives: 8 x 2 TB 7,200 rpm 3.5" SATA drives
  • Network Interfaces: Intel Dual Copper 1 Gb Ethernet I/O Module
  • IPMI: Intel Remote Management Modules 4 (AXXRMM4)
• Power
  • 2 x 760W hot-swap Power Supply Modules
• Dimensions
  • 17.57"W x 30.79"D x 3.43"H
  • Form factor: 2RU
• Weight
  • 67 lbs.
• Temperature
  • Operating temperature: 10°–35° C/50°–95° F
  • Humidity range: 8%–90%, non-condensing
• Compliance
  • NRTL Certification (US/Canada)CB Certification (International)
  • CE Declaration of Conformity (CENELEC Europe)
  • FCC/ICES-003 Class A Attestation (USA/Canada)
  • USA-UL
  • VCCI Certification (Japan)
  • C-Tick Declaration of Conformity (Australia)
  • MED Declaration of Conformity (New Zealand)
  • BSMI Certification (Taiwan)
  • GOST R Certification / Certification (Russia)
  • CC Certification (Korea)
  • IRAM Certification (Argentina)
  • Ecology Declaration (International)
  • China RoHS Environmental Friendly Use Period
  • Packaging & Product Recycling Marks
  • SABS (South Africa)
  • NOM/NYCE (Mexico)
  • CCC Certification (China)
  • CC EAL 2+
  • FIPS-compliant encryption algorithms
  • Security Technical Implementations Guide (STIG)

Virtual Appliance Minimum Hardware Requirements

• System
  • CPU: Intel Quad Core
  • Memory: 16 GB RAM
  • Hard Drive(s):
    • Drive 1: 100 GB for VM software
    • Drive 2: 512 GB for DLP virtual image
  • Network Ports: 4 Virtual NICs
  • BIOS: Enable VT thread

Documentation:

Download the McAfee Network DLP Discover Datasheet (PDF).