> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations.md).
# File Operations
## File Operations Trigger in DLP Policies
Trigger **File Operations** in DLP policies allows monitoring of user actions on files and folders in selected locations. It enables precise definition of the conditions that must be met for the system to activate the appropriate rule. This helps the function effectively protect organizational data from unauthorized access, editing, or deletion.
{% hint style="warning" %}
In the case of monitoring operations on a file containing **specific content** or **marked with an invisible tag**, it is possible to track activity associated with the file regardless of its location, extension, etc. As a result, monitoring also works when the file is moved, copied, or edited.
To configure monitoring, first go to the [Document Tagging.](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/actions/document-labeling.md)
{% endhint %}
## File operation types
The system allows monitoring and controlling the following operations:
* **Creation:** Detection of new file creation.
* **Deletion:** Control of file deletion attempts.
* **Open:** Monitoring and logging the moment files are opened, including within a defined process.
* **Rename/move:** Monitoring changes in file names or location.
* **Save:** Tracking changes saved to files.
## Configuration fields
{% stepper %}
{% step %}
### **Operation type**
You must define the operation type. This is a multi-select list.
* **Creation**
* **Deletion**
* **Open**
* **Rename/move**
* **Save**
{% endstep %}
{% step %}
### **Path mask / Excluded path mask**
* **Path mask:** Defines the locations where operations will be monitored.
* Examples: `H:\desktop\test` or `H:\*`.
* **Excluded path mask:** Excludes specific locations from monitoring.
* Example: for the mask `H:\*`, exclusion can be `H:\desktop\test`.
[How to add/edit a mask?](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md)
{% endstep %}
{% step %}
### **File mask / Excluded file mask**
* **File mask:** Specifies the files to be monitored.
* Examples: `invoice.pdf`, `invoice*.pdf`, `*.txt`, `*.jpg`.
* **Excluded file mask:** Excludes specific files from monitoring.
* Example: for the mask `*.jpg`, exclusion `test.jpg` will cause all JPG files except `test.jpg` to be included.
[How to add/edit a mask?](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md)
{% endstep %}
{% step %}
### **File type**
The drop-down list allows you to select the object type:
* **Folders:** Monitoring only folder operations.
* **Files:** Monitoring only file operations.
* **Files and folders:** Monitoring both object types simultaneously.
{% endstep %}
{% step %}
### **Applies to media**
The multi-select field allows you to specify the media on which operations are to be monitored:
* **Local disk**
* **External disk**
* **USB drive**
* **Network share**
#### **Additional option for USB drive:**
Selecting USB drives unlocks USB device group configuration:
* **USB device groups:** Drop-down list, initially containing the value "All". Groups are created from the list of previously detected USB devices.
{% endstep %}
{% step %}
### **Process mask / Excluded process mask**
Works analogously to file and path masks:
* **Process mask:** Specifies the processes to be included, e.g. `chrome.exe`, `*.exe`.
* **Excluded process mask:** Excludes specific processes, e.g. for the mask `*.exe`, exclusion `chrome.exe`.
[How to add/edit a mask?](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md)
{% endstep %}
{% step %}
### [**Tag**](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/actions/document-labeling.md)
Multi-select field available after tags have been created in the system.
* Allows restricting DLP rule action to files with a specific tag (e.g. classification).
* Example: It is possible to set the mask `*` (all locations and files), so that the only condition for the policy to apply will be the tag assigned to the file.
{% endstep %}
{% endstepper %}
{% hint style="warning" %}
#### Entering multiple parameters in a single rule
Within a single rule, you can enter multiple parameters (e.g. domain, path, file name, or process masks). There is no need to create a separate rule for each of them.
Each parameter should be entered **on a separate line**, separating successive entries only with the **ENTER** key. Do not use commas, semicolons, or other separators.
In this case, the **OR**logic applies. This means the rule will be applied if **any** of the specified conditions is met.
**Example - paths**
```
C:\Users\Public\
D:\Documents\*
*\Server\Share\*
```
The rule will be applied if the operation concerns **any** of the specified paths.
**Example - file names**
```
*.pdf
*.docx
*.xlsx
testABCD.*
```
The rule will be applied to **any** PDF, DOCX, XLSX file or a file named "testABCD" with any extension.
{% endhint %}
## Practical application
#### Example:
The rule applies to:
* Operations: **Open**.
* Locations: **User desktop**.
* File type: **Text files (.txt)**.
* Media: **Local disk**.
* Process: **Word.exe**.
**Result:** The DLP policy will be applied to `.txt` files located on the local disk in the "Desktop" folder, opened exclusively by means of Word.
## **Summary**
Trigger **File Operations** allows for detailed monitoring and management of access to files in selected locations, on specified media, and using selected processes. Thanks to flexible field configuration, it is possible to precisely adapt DLP rules to the specific requirements of the organization.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
