File Sent

File Sending Trigger

Trigger File Sending enables monitoring and blocking of file transfer operations through various channels, such as:

• Email.

• Cloud application.

• Other.

With this feature, any attempt to attach or send a file can be monitored, blocked, or logged in the system. The tool also supports synchronization of files with cloud applications and other user-defined processes, such as data transfer in messaging applications (for example, Microsoft Teams).

When monitoring operations on a file containing specific content or marked with an invisible tag, it is possible to track file-related activity regardless of its location, extension, etc. As a result, monitoring works even when the file is moved, copied, or edited.

To configure monitoring, first go to the Document Tagging.

Trigger configuration

Select transfer type

The user must specify the type of transfer operation:

• Email: Monitoring file transfers via email.

• Cloud applications: Monitoring data synchronization with cloud applications (support for 20 types).

• Other: Monitoring file transfers to defined processes (for example, messaging applications).

Configuration for email

After selecting the transfer type, the next step is to define which files should serve as a trigger for subsequent actions in the event of an attempt to send them by email.

• Path mask

Specifies the location from which files will be considered by the trigger. If no file mask is defined, all files in the specified location will be monitored.

Example:

C:\Users\*\Desktop

The above path means monitoring the Desktop of each user. The * character replaces the user profile name, so the rule works regardless of who is logged on to the computer.

It is also possible to define exclusions, for example, to skip selected subfolders located in the monitored location.

• File masks

They allow you to define which file types should serve as a trigger. You can specify one or more file types, as well as define exclusions.

Example:

*.pdf

In this case, only PDF files will serve as the trigger.

• Exclusions

They allow you to define file types or paths that should be excluded from monitoring, even if they meet the other rule conditions.

• Tags

Optionally, previously assigned document tags can be used to restrict the trigger to tagged files only. More information is available in the chapter Document Tagging.

Combining the above conditions allows you to build a precise monitoring policy. If none of the conditions is specified, the system will consider all files. Individual criteria can be used independently or combined, for example, to monitor only PDF files located on the user's Desktop or documents from a specific directory marked with a specific tag.

Configuration for cloud applications

Includes all options available for email.

• Additionally: Selection of the cloud application used by the user.

List of supported cloud applications:

• Microsoft OneDrive

• BitTorrent Sync

• Box

• Copy

• Cubby

• Dropbox

• Google Drive

• Knowhow Cloud

• Mediafire

• Mega

• Mozy

• OwnCloud

• Spideroak

• STRATO HiDrive

• Tresorit

Configuration for Other

Includes all options available for email. Additionally:

• Monitored processes: The user specifies specific processes in which file transfer should be monitored or blocked (for example, teams.exe).

• Excluded processes: Ability to exclude selected processes from monitoring.

How to add/edit a mask?

Entering multiple parameters in a single rule

Within a single rule, you can enter multiple processes. There is no need to create a separate rule for each of them.

Each parameter should be entered on a separate line, separating successive entries only with the ENTERkey. Do not use commas, semicolons, or other separators.

In this case, the ORlogic applies. This means that the rule will be applied if any of the specified conditions is met.

Example - processes

chrome.exe
*xyz.exe
test*test.exe

The rule will be applied if the operation concerns any of the specified processes, for example chrome.exe OR 123xyz.exe OR test000000test.exe.

Usage example

Purpose: Protect the company price list from being sent by users through various channels.

• Configuration:

  • Select the file price_list.xlsx as the monitored object. (Option 1: Specify the file location and name; Option 2: Specify the tag previously assigned to this specific file - an optimal solution, resistant to file copying and moving.)

  • Configure blocking of this file from being sent through:

    • Email (for example, Outlook).

    • Cloud applications (for example, Google Drive).

    • Messaging applications (for example, Microsoft Teams).

• Result:

  • Any attempt to send the price list file will be blocked, and the event will be recorded in the system logs.

Summary

Trigger "File Sending" provides comprehensive control over data transfer within the organization. Thanks to flexible configuration and broad support for transfer channels, the tool supports enforcement of security policies and minimizes the risk of unauthorized disclosure of sensitive data.