> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# File Monitoring

> Monitor File Upload operations performed by users on Client computers. Capture upload events in the File Monitoring tab and trigger alerts on specific file-upload patterns.

## See file uploads without buying a separate DLP product

Data Loss Prevention products historically lived in their own category: Forcepoint DLP, Symantec/Broadcom DLP, Microsoft Purview Information Protection  with separate agents, separate consoles, and separate licensing from the session-monitoring tools they run alongside. The capability overlap is real: both are watching the endpoint for evidence of data movement.

**Syteca's file monitoring captures the most common DLP signal — file upload operations** — through the same Client agent doing session recording, clipboard monitoring, and PAM session capture. Not a full DLP product; doesn't classify documents or do content-aware inspection. But for "did this user upload anything to a file-sharing service or browser-based form?" it's enough — and it lives in the same console as the screen capture showing exactly what they uploaded and where.

<Info>
  **Use file monitoring when you need to:**

  * **Track outbound file movement** — uploads via browsers, file-sharing dialogs, email attachments, and the like.
  * **Catch unauthorized cloud storage use** — file-upload events to Dropbox, Box, OneDrive, Google Drive web interfaces.
  * **Layer visibility on top of EDR/UAM** without adding a DLP product to the stack.
  * **Generate file-upload alerts** as part of a broader insider-threat program.
</Info>

<Note>
  **Applies to**: Windows Clients, macOS Clients. The configuration procedure differs slightly between platforms (registry on legacy Windows AS, `.config` file on current Syteca versions). The macOS Client specifically supports browser-dialog file uploads.
</Note>

## Two-step enablement

File monitoring requires **both** an Application Server-side feature flag **and** a per-Client checkbox. Skipping either leaves it disabled.

### 1. Enable the feature on the Application Server

The procedure depends on your Syteca version:

<Tabs>
  <Tab title="Syteca v6.53.1 and later (current)">
    Edit the **EkranServer.Settings.config** file (located in `C:\Program Files\Ekran System\Ekran System\Server`) and add the following key:

    ```xml theme={"system"}
    <add key="EnableFileMonitoring" value="1" />
    ```

    No service restart required — Syteca picks up the new setting on next configuration reload.
  </Tab>

  <Tab title="Syteca v6.53.0 and earlier (legacy)">
    Configure via the Windows Registry:

    <Steps>
      <Step title="Stop the Application Server">
        Click **Stop** in the context menu of the **Syteca Server** icon in the Windows System Tray. Alternatively, find the **EkranServer** service in the Task Manager and click **Stop**.
      </Step>

      <Step title="Open the Registry Editor">
        Open the Windows **Registry Editor**.
      </Step>

      <Step title="Add the value">
        Select the `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem` key. Edit → New → DWORD (32-bit), and add:

        * **Value name**: `EnableFileMonitoring`
        * **Value data**: `1`
      </Step>

      <Step title="Restart the service">
        Start the **EkranServer** service to continue working with the application.
      </Step>
    </Steps>

    <Warning>
      `EkranServer` is the literal service name; `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem` is the literal registry key. Preserve both verbatim in scripts and runbooks.

      After updating to Syteca v6.53.1 or higher, **the Application Server can no longer be configured via the registry** — move to the `EkranServer.Settings.config` file approach in the other tab.
    </Warning>
  </Tab>
</Tabs>

### 2. Enable per Client / Client group

After Step 1 is complete, select the **Enable file monitoring** checkbox on the **Editing Client** / **Editing Client Group** page, on the **Monitoring \[Windows/macOS]** tab, in the **Monitoring Parameters** section at the top.

## What gets monitored on each platform

| Platform    | File-upload operations captured                                                                                         |
| ----------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Windows** | File uploads through supported applications. See the Activity Monitoring → File Monitoring tab for the captured events. |
| **macOS**   | Operations in a dialog window opened from a browser. Additional supported applications evolve per Syteca release.       |

## Where to view captured file uploads

* **Activity Monitoring → File Monitoring tab** — list of all File Upload operations performed across monitored Client computers
* **Alerts** — define File Upload alert rules to trigger on specific upload patterns (filename, target, application)

## Alert rules for file uploads

Add or edit an alert on the **Alerts** page, with rules using the **File Upload (Windows and macOS)** parameter. The alert can target specific file extensions, target applications, or upload destinations.

## Related

<CardGroup cols={2}>
  <Card title="Clipboard monitoring" icon="clipboard" href="/docs/session-monitoring/recording/clipboard-monitoring">
    Complementary monitoring stream — what users copy/paste.
  </Card>

  <Card title="User activity recording" icon="video" href="/docs/session-monitoring/recording/user-activity-recording">
    Screen recording showing the visual context of file uploads.
  </Card>

  <Card title="Alerts" icon="bell" href="/docs/session-monitoring/alerts">
    Define File Upload alert rules.
  </Card>

  <Card title="Application Server settings" icon="settings" href="/docs/administration/deployment/server-advanced-settings">
    Other EkranServer.Settings.config keys.
  </Card>
</CardGroup>