> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention/triggers/file-sent.md).

# File Sent

Trigger **File transfer** enables monitoring of file transfer operations through various channels.

It may include:

* email,
* cloud applications,
* other specified processes, e.g., messaging apps.

Depending on the rule configuration, an attempt to transfer a file may be logged or cause the configured actions to be executed, e.g., blocking the operation.

{% hint style="info" %}
A rule can contain only **one trigger**, but you can assign multiple actions and multiple notifications to it.
{% endhint %}

### What can trigger the rule?

You do not need to monitor every file transfer.

The trigger can be narrowed down based on, among other things:

* file location,
* file type or extension,
* excluded locations,
* excluded file types,
* [a previously assigned document tag](/eacloud-docs-en/features/data-loss-prevention/file-classification-and-labeling.md),
* the channel through which the file is transferred.

This means the rule can apply, for example, only to PDF files on the user's desktop or to documents previously marked with the appropriate tag.

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FIzIuiGqnGdfH55g37VKK%2Fimage.png?alt=media&amp;token=2a10b244-edc4-40c2-841e-0497669c4a8f" alt="Konfiguracja wyzwalacza Wysłanie pliku w eAuditor Cloud z wyborem typu przesyłania, maski ścieżki, maski pliku, wykluczeń i znacznika dokumentu." width="375"><figcaption><p><em>The trigger can be limited to specific files, locations, and transfer channels.</em></p></figcaption></figure>

{% hint style="info" %}
If the file was previously marked with a document [tag](/eacloud-docs-en/features/data-loss-prevention/file-classification-and-labeling.md) during trigger configuration, you can use this tag. This makes it possible to monitor the tagged file even if it is moved, copied, or its location changes.
{% endhint %}

### Transfer type

During trigger configuration, select the channel to be controlled.

There are three types available:

| Type                   | Use case                                                                                 |
| ---------------------- | ---------------------------------------------------------------------------------------- |
| **Email**              | Monitoring file transfer via desktop email (only applications running locally on the PC) |
| **Cloud applications** | Monitoring file synchronization and transfer using supported cloud applications          |
| **Other**              | Monitoring file transfers through specified processes, e.g., messaging apps, browsers.   |

Each type uses the basic file conditions. Additional settings depend on the selected channel.

### Configuration for email

After selecting the type **Email** specify which files should trigger the rule when an attempt is made to send them via email.

#### Path mask

**Path mask** defines the location of the files that should be considered by the trigger.

Example:

`C:\Users\*\Desktop`

Character `*` replaces the user profile name.

This allows the rule to cover the desktop of the currently logged-in user regardless of the account name.

If no file mask is additionally specified for the selected location, the trigger will consider all files located there.

{% hint style="info" %}
Masks make it possible to create a configuration that works for multiple users without entering a separate path for each profile.
{% endhint %}

#### Path exclusion

You can specify locations to be skipped even if the other conditions are met.

Example:

The monitored location is:

`C:\Users\*\Desktop`

but one of its subfolders should not be monitored.

In that case, add the appropriate path to exclusions, for example:

`C:\Users\*\Desktop\New_folder`

#### File mask

**File mask** defines the file types that should trigger the rule.

Example:

`*.pdf`

In this case, the rule will apply to PDF files.

You can specify one or more file types.

#### File exclusion

Allows you to specify file types to be skipped, even if they meet other rule conditions.

This allows you, for example, to monitor a broad group of documents but exclude specific extensions from it.

#### Tags

Optionally, you can limit the trigger to documents that were previously assigned a tag.

This allows you to create rules that are independent of the file's current name or location.

A detailed description is provided in the section [**File classification and tagging**](/eacloud-docs-en/features/data-loss-prevention/file-classification-and-labeling.md) **->** [**Document tagging**](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/actions/document-labeling.md).

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FCAylBz2cTdC5Gs9GSnAN%2Fimage.png?alt=media&amp;token=2d2e4ea2-c940-45a7-8c1d-949b7c4ba191" alt="Konfiguracja warunków wyzwalacza Wysłanie pliku dla poczty e-mail z maską ścieżki, maską pliku, wykluczeniami oraz opcją znacznika." width="375"><figcaption><p><em>Conditions can be combined to precisely define the files covered by the rule.</em></p></figcaption></figure>

{% hint style="info" %}
Conditions can be used independently or combined. For example, you can control only PDF files located on the user's desktop or only documents marked with a specific tag.
{% endhint %}

### Configuration for cloud applications

Type **Cloud applications** uses the same file settings as the email configuration.

In addition, you must specify the cloud application to which the rule should apply.

Supported services include:

* Microsoft OneDrive,
* BitTorrent Sync,
* Box,
* Copy,
* Cubby,
* Dropbox,
* Google Drive,
* Knowhow Cloud,
* Mediafire,
* Mega,
* Mozy,
* OwnCloud,
* Spideroak,
* STRATO HiDrive,
* Tresorit.

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FApkeUYFj7e8NQZja8m3T%2Fimage.png?alt=media&amp;token=a1f58b83-2b86-4c51-8c87-fb091d9bdfb4" alt="Konfiguracja wyzwalacza Wysłanie pliku dla aplikacji chmurowej z rozwiniętą listą obsługiwanych usług." width="375"><figcaption><p><em>For the Cloud applications type, you must also specify the service to which the rule should apply.</em></p></figcaption></figure>

#### Example

If you want to control the transfer and synchronization of PDF files to Google Drive:

1. select the type **Cloud applications**,
2. set the file mask `*.pdf`,
3. select **Google Drive**,
4. configure the required actions,
5. save the rule and update the policies.

### Configuration for Other

Type **Other** allows you to control file transfers through specified processes.

It can be used, for example, for messaging apps or other applications that are not supported as a separate channel type.

The configuration includes the basic file conditions and additionally:

* **Monitored processes** - processes in which file transfer should be controlled,
* **Excluded processes** - processes that should be skipped.

Example of a monitored process:

`teams.exe`

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FKXu3BRpFc7i3tzun3CZl%2Fimage.png?alt=media&amp;token=7a422644-a1d5-4ee1-8080-e89811f9a413" alt="Konfiguracja wyzwalacza Wysłanie pliku typu Inne z polem procesów monitorowanych i procesów wykluczonych." width="375"><figcaption><p><em>The Other type allows you to control file transfers through specified processes.</em></p></figcaption></figure>

### Entering multiple values

In one field, you can specify more than one process or parameter.

Enter each value on a **separate line**, confirming each entry with the **Enter**.

Do not use:

* commas,
* semicolons,
* other separators.

Example:

```
chrome.exe
xyz.exe
testtest.exe
```

In this case, OR logic is used. This means the condition will be met if the operation applies to any of the specified processes.

<figure><img src="https://3262380731-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdzip3GyvGq5q5J3qckWN%2Fuploads%2FMCyGV0YcUgS11dL76rLO%2Fimage.png?alt=media&amp;token=e26c14ee-eb39-4b59-a437-4f10c21881c9" alt="Wprowadzanie wielu wartości" width="375"><figcaption><p><em>Entering multiple values.</em></p></figcaption></figure>

{% hint style="warning" %}
Do not enter multiple processes on one line separated by a comma or semicolon. Each process should be on a separate line.
{% endhint %}

### Creating a rule

{% stepper %}
{% step %}
Open the rule configuration Create a new rule or open an existing one for editing.
{% endstep %}

{% step %}
Select trigger In the Triggers section, select: **File transfer**
{% endstep %}

{% step %}
Select transfer type Specify the channel to be controlled:

* Email,
* Cloud applications,
* Other.
  {% endstep %}

{% step %}
Specify files depending on your needs configure:

* path mask,
* path exclusion,
* file mask,
* file exclusion,
* document tag. If you do not want to limit the rule by a given parameter, leave it without additional configuration.
  {% endstep %}

{% step %}
Set channel parameters For Cloud applications, select the cloud service. For the Other type, specify the monitored or excluded processes.
{% endstep %}

{% step %}
Configure actions Specify what should happen after a file transfer attempt is detected. You can add multiple actions to the rule.
{% endstep %}

{% step %}
Configure notifications If the event should be reported to an administrator or another recipient, add the appropriate notifications.
{% endstep %}

{% step %}
Save the rule and update the policies Save the configuration, assign the rule to the appropriate policy, and then click: Update policies
{% endstep %}
{% endstepper %}

Use case example Protecting the company price list Suppose that the file: cennik.xlsx should not be transferred outside the computer through selected channels. You can prepare separate rules using the File transfer trigger for:

* email, e.g., Outlook,
* cloud application, e.g., Google Drive,
* messaging process, e.g., Microsoft Teams. You can specify the file based on its location and name or use a document tag assigned earlier.

{% hint style="info" %}
If you want to protect a specific document even after it has been copied or moved, a better solution may be to tag the file in advance and use that tag in the rule.
{% endhint %}

#### Testing the rule

{% stepper %}
{% step %}
Use a test computer Initially, apply the policy on a device where you can safely perform a file transfer test.
{% endstep %}

{% step %}
Update the policies Click Update policies and make sure that eAgent has downloaded the current configuration.
{% endstep %}

{% step %}
Prepare a file that meets the conditions Use a file matching the configured mask, path, or tag.
{% endstep %}

{% step %}
Try to transfer the file Perform the operation using the controlled channel, for example:

* email message,
* selected cloud application,
* specified process.
  {% endstep %}

{% step %}
Check the response Verify that the actions and notifications configured in the rule have been executed.
{% endstep %}

{% step %}
Check the DLP Logs Go to: **Data Loss Prevention -> DLP Logs** and check the recorded event.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Before deploying a blocking rule, test every channel that should be protected. A rule intended for email does not replace separate control of transferring the same file through a cloud application or messaging app.
{% endhint %}

### FAQ

<details>

<summary><strong>Can one rule control email and Google Drive at the same time?</strong></summary>

The trigger has one selected transfer type. If the same file should be protected across different channels, prepare separate rules for each transfer type.

</details>

<details>

<summary><strong>Can I monitor only PDF files?</strong></summary>

Yes. Set the file mask: \*.pdf

</details>

<details>

<summary><strong>Can I limit the rule to the user's desktop only?</strong></summary>

Yes. You can use a path mask, for example: C:\Users\*\Desktop. The \* character replaces the user profile name.

</details>

<details>

<summary><strong>Can I exclude a specific folder or file type?</strong></summary>

Yes. The path exclusion and file exclusion fields are used for this purpose.

</details>

<details>

<summary><strong>Can the rule protect a file after it has been moved to another folder?</strong></summary>

If protection is based only on the path, changing the location may cause the file to no longer meet this condition. If the document was previously marked with the appropriate tag, the tag can be used to identify the file regardless of its current location.

</details>

<details>

<summary><strong>How do I control file sending through Microsoft Teams?</strong></summary>

Select Other and specify the appropriate process, e.g., teams.exe, as the monitored process.

</details>

<details>

<summary><strong>Can I enter multiple processes?</strong></summary>

Yes. Enter each process on a separate line. The conditions are then treated according to OR logic - the rule may be triggered for any of the specified processes.

</details>

<details>

<summary><strong>Can I control file sending to a specific email address, domain, or URL?</strong></summary>

No.

Trigger **File transfer** allows you to control the channel or process used to transfer a file, for example:

* email,
* cloud application,
* specified process or messaging app.

However, the rule cannot be limited to a specific:

* email address,
* email domain,
* URL,
* message recipient.

Therefore, it is possible, for example, to control file sending through Outlook or a specified application, but it is not possible to create a rule that applies only to messages sent to the address `jan@example.com` or to the domain `example.com`.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention/triggers/file-sent.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.