> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md).
# Masks
Configuration of path, file, and process masks.
## Introduction
Configuring DLP rules in the system often requires defining locations, file types, or processes that will be covered by the security policy. Masks allow you to precisely define what is to be monitored or blocked, while exclusion masks make it possible to exclude specific elements from rule enforcement.
### **Examples of mask usage**
* **Path mask:** Defines the locations covered by the rule, e.g. `C:\Desktop`. All files in this location, including subfolders, will be monitored unless excluded, e.g. `C:\Desktop\Trash`.
* **File mask:** Defines the type of files covered by the policy, e.g. `*.txt`. All text files will be covered by the rule, with the ability to exclude specific files, e.g. `ABCD.TXT`.
* **Process mask:** Defines the processes covered by the rule, e.g. `*.exe`. Specific processes can be excluded, such as `chrome.exe`.
### Practical applications
1. **Path mask:**
* **Configuration:**
* The rule covers files in the location `C:\Desktop`.
* Exclusion: `C:\Desktop\Trash`.
* **Effect:** All files on the desktop, including subdirectories, will be monitored except those located in the "Trash" folder.
2. **File mask:**
* **Configuration:**
* File monitoring `*.docx`.
* Exclusion: `Report.docx`.
* **Effect:** The policy applies to all Word files in the location, except for the specified file "Report.docx".
3. **Process mask:**
* **Configuration:**
* Process monitoring `*.exe`.
* Exclusion: `chrome.exe`.
* **Effect:** All executable processes are monitored, except for the Chrome browser.
4. **Advanced example:**
* **File mask:** `*invoice*.*`.
* **Effect:** All files containing "invoice" in the name are monitored, regardless of file extension.
* **Exclusion:** `TESTinvoice.doc`.
***
## Step-by-step configuration
#### Creating path, file, or process masks
{% stepper %}
{% step %}
**Expand the configuration field**
In the main rule view, go to the mask configuration section.
{% endstep %}
{% step %}
**Add a new mask**
* Click **+ Add new** next to the appropriate field.
{% endstep %}
{% step %}
**Edit mask**
* After confirmation, a field will open where you can change the mask name.
* Optionally, add a description to make it easier to identify the mask later.
{% endstep %}
{% step %}
**Enter mask criteria**
* Enter path, file, or process masks (one item per line).
* Example:
* Paths: `C:\Desktop`, `C:\Documents`.
* Files: `*.txt`, `Report.docx`.
* Processes: `chrome.exe`, `*.exe`.
{% endstep %}
{% step %}
**Confirm the configuration**
* Click "Save" to add the mask to the list of available masks, or cancel the process with the "Cancel" button.
* The new mask will also be available as an exclusion mask option.
{% endstep %}
{% endstepper %}
### Wildcards
The system supports the wildcard character `*`, which replaces **any string of characters** (including an empty one). This makes it possible to create flexible masks that match many different values.
#### Usage examples
**Web addresses**
| Mask | Match |
| --------------------------- | --------------------------------------------- |
| `*mail.onet.pl` | `https://mail.onet.pl`, `http://mail.onet.pl` |
| `*.facebook.com/*` | all subpages of the Facebook domain |
| `https://www.facebook.com/` | only the exact specified address |
> **Note:** If the address may include a prefix, e.g. `https://`, it is recommended to start the mask with the character `*`. This way, the rule will match regardless of the beginning of the address.
**Files**
| Mask | Match |
| ------------- | ---------------------------------------------------------------------------- |
| `*.pdf` | all PDF files |
| `*invoice*.*` | all files containing the word "invoice" in the name, regardless of extension |
| `Report.docx` | only the file named `Report.docx` |
**Paths**
| Mask | Match |
| ------------- | ----------------------------------------------- |
| `C:\Users\*` | all files and directories in the folder `Users` |
| `*\Desktop\*` | any path containing the directory `Desktop` |
| `C:\Desktop` | only the specified location |
**Processes**
| Mask | Match |
| ------------ | --------------------------------------------------- |
| `*.exe` | all executable processes |
| `*chrome*` | all processes whose name contains the word `chrome` |
| `chrome.exe` | only the process `chrome.exe` |
{% hint style="info" %}
**Recommendation:** If exact matching is not required, use the character `*`. It allows additional characters before or after the searched value to be included, making rules more universal and resilient to differences in notation.
{% endhint %}
#### Example of mask usage in rules
**Trigger File Operation**
* File masks allow you to monitor file opening in selected processes, e.g.:
* File monitoring `*.docx` in the process `word.exe`.
* Blocking file opening in the process `chrome.exe`.
### Additional information
* **Recommendation for broad masks:** For broad masks, it is advisable to use exclusion masks, e.g.:
* **Files:** `*.bin, *.cookie, *.dat, *.db, *.dll, *.exe, *.ini, *.json, *.lnk, *.nls, *.ost, *.prefs, *.sdb, *.sync, *.temp, *.tmp`.
* **Paths:** `AppData, Program Files, Windows`.
{% hint style="warning" %}
**INFO:** The examples are provided only as suggested usage scenarios and are not subject to vendor validation. They should be modified according to the organization's requirements.
{% endhint %}
### Entering multiple parameters in a single rule
Within a single rule, you can enter multiple parameters (e.g., domain, path, file name, or process masks). There is no need to create a separate rule for each of them.
Each parameter must be entered **on a separate line**, separating consecutive entries only with the **ENTER**key. Do not use commas, semicolons, or other separators.
In this case, the **OR**logic applies. This means that the rule will be applied if **any** of the specified conditions is met.
#### **Example - domain masks**
```
*.facebook.com*
*.youtube.com*
*.tiktok.com*
```
The rule will be applied if the user visits **Facebook OR YouTube OR TikTok**.
#### **Example - paths**
```
C:\Users\Public\
D:\Documents\
*\Server\Share\*
```
The rule will be applied if the operation concerns **any** of the specified paths.
#### **Example - file names**
```
*.pdf
*.docx
*.xlsx
```
The rule will be applied to **any** PDF, DOCX, or XLSX file.
> **Note:** The values entered within a single rule are always interpreted according to the **OR**logic. Currently, the system does not support **AND** logic between parameters within the same rule.
## Summary
Path, file, and process masks are a flexible tool that enables precise control over DLP rule behavior. With masks, you can focus monitoring on key areas while excluding locations, files, or processes considered irrelevant.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
