File operations: Delete/Move/Rename¶
An endpoint agent of StaffCop Enterprise has full functionality to track and intercept any file operations that occur on a user workstation or terminal server.
File interception is performed in accordance with the rules specified in the computer configuration.
A computer configuration can be assigned to all agents or to certain groups of computers/workstations.
The most frequent file operations that a security officer should pay attention to are the operations of Deletions/Moving/Renaming files.
All these events can be tracked by selecting “File -> File operation” in “Dimension panel”.
![../_images/cases_31.png](../_images/cases_31.png)
To get detailed reports on events of interest only (for example, “Delete”), select this operation. As a result, we get a list of all operations with files that have been deleted.
![../_images/cases_32.png](../_images/cases_32.png)
There is a possibility of getting detailed information by selecting “Analysis” in the display menu. In this case, you must add “Account -> User Name” in the dimension filter, then “Application -> Executable”.
![../_images/cases_33.png](../_images/cases_33.png)
In “Lens”, you can view the resulted information in a most convenient visualization form. For example, choose “Tree” with the following filters filters:
File operations
File operation -> Delete
tree branch “Account -> User name”
sub-branch “Application -> Executable”
The tree view is handy for data visualization and you can also print the data in the PDF format (click “Print” in the top part of the administrating menu).
![../_images/cases_34.png](../_images/cases_34.png)
Then click the button “Export and printing” to get the whole facts list for export and analysis - you will be able to print the received information (e.g. in PDF) for further analysis.