Use case: Filter incidents by date, destination, and user

Create a filter that identifies incidents sent within the last 24 hours by a particular user.

Task

  1. In McAfee ePO, select MenuData ProtectionDLP Incident Manager.
  2. Select Data-in-use/motion from Present.
  3. Select Last 24 hours from the Time drop-down list.
  4. In Filters, click Edit.
  5. In Destination equals add the required destination.
  6. Select Username equals and add the name you want to look for.
  7. Select Update Filter.
  8. In the left panel select Group-by, then select Rule Set from the drop-down list.