File Operations

File Operations Trigger in DLP Policies

Trigger File Operations in DLP policies allows monitoring of user actions on files and folders in selected locations. It enables precise definition of the conditions that must be met for the system to activate the appropriate rule. This helps the function effectively protect organizational data from unauthorized access, editing, or deletion.

In the case of monitoring operations on a file containing specific content or marked with an invisible tag, it is possible to track activity associated with the file regardless of its location, extension, etc. As a result, monitoring also works when the file is moved, copied, or edited.

To configure monitoring, first go to the Document Tagging.

File operation types

The system allows monitoring and controlling the following operations:

• Creation: Detection of new file creation.

• Deletion: Control of file deletion attempts.

• Open: Monitoring and logging the moment files are opened, including within a defined process.

• Rename/move: Monitoring changes in file names or location.

• Save: Tracking changes saved to files.

Configuration fields

1

Operation type

You must define the operation type. This is a multi-select list.

• Creation

• Deletion

• Open

• Rename/move

• Save

2

Path mask / Excluded path mask

• Path mask: Defines the locations where operations will be monitored.

  • Examples: H:\desktop\test or H:\*.

• Excluded path mask: Excludes specific locations from monitoring.

  • Example: for the mask H:\*, exclusion can be H:\desktop\test.

How to add/edit a mask?

3

File mask / Excluded file mask

• File mask: Specifies the files to be monitored.

  • Examples: invoice.pdf, invoice*.pdf, *.txt, *.jpg.

• Excluded file mask: Excludes specific files from monitoring.

  • Example: for the mask *.jpg, exclusion test.jpg will cause all JPG files except test.jpg to be included.

How to add/edit a mask?

4

File type

The drop-down list allows you to select the object type:

• Folders: Monitoring only folder operations.

• Files: Monitoring only file operations.

• Files and folders: Monitoring both object types simultaneously.

5

Applies to media

The multi-select field allows you to specify the media on which operations are to be monitored:

• Local disk

• External disk

• USB drive

• Network share

Additional option for USB drive:

Selecting USB drives unlocks USB device group configuration:

• USB device groups: Drop-down list, initially containing the value "All". Groups are created from the list of previously detected USB devices.

6

Process mask / Excluded process mask

Works analogously to file and path masks:

• Process mask: Specifies the processes to be included, e.g. chrome.exe, *.exe.

• Excluded process mask: Excludes specific processes, e.g. for the mask *.exe, exclusion chrome.exe.

How to add/edit a mask?

7

Tag

Multi-select field available after tags have been created in the system.

• Allows restricting DLP rule action to files with a specific tag (e.g. classification).

• Example: It is possible to set the mask * (all locations and files), so that the only condition for the policy to apply will be the tag assigned to the file.

Entering multiple parameters in a single rule

Within a single rule, you can enter multiple parameters (e.g. domain, path, file name, or process masks). There is no need to create a separate rule for each of them.

Each parameter should be entered on a separate line, separating successive entries only with the ENTER key. Do not use commas, semicolons, or other separators.

In this case, the ORlogic applies. This means the rule will be applied if any of the specified conditions is met.

Example - paths

C:\Users\Public\
D:\Documents\*
*\Server\Share\*

The rule will be applied if the operation concerns any of the specified paths.

Example - file names

*.pdf
*.docx
*.xlsx
testABCD.*

The rule will be applied to any PDF, DOCX, XLSX file or a file named "testABCD" with any extension.

Practical application

Example:

The rule applies to:

• Operations: Open.

• Locations: User desktop.

• File type: Text files (.txt).

• Media: Local disk.

• Process: Word.exe.

Result: The DLP policy will be applied to .txt files located on the local disk in the "Desktop" folder, opened exclusively by means of Word.

Summary

Trigger File Operations allows for detailed monitoring and management of access to files in selected locations, on specified media, and using selected processes. Thanks to flexible field configuration, it is possible to precisely adapt DLP rules to the specific requirements of the organization.