File Scanner¶

The File Scanner automatically checks documents on workstations. Its main purpose is to identify important files that are located in places they should not be.

Staffcop Enterprise offers two file scanners:

The built-in file scanner — included in the standard version and designed for basic file monitoring.

See also

More information on file scanner (old)

Advanced File Scanner (New Version) — separate, licensed component of Staffcop Enterprise. Designed for large-scale auditing of file storage systems, it features high performance, centralized management, flexible access rights, and other advanced features.

See also

Guides for configuring and operating the new file scanner:

Working with File Scanner (New Version)

Two-Server Setup

Three-Server Setup

Configuring an IPsec tunnel to secure NFS

Blocking Files

In Staffcop Enterprise, scanning is integrated with the DLP module and file tagging. This allows not only for document detection but also for document management.

The built-in scanner uses Security Policies to search for sensitive information while file blocking is configured in the DLP module.

        graph LR
   A["<div style='text-align:left; font-size:12px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/cases/keywords.html' style='color:black; text-decoration:underline; cursor:pointer;'>1. Dictionary Setup</a></b><br/>
      The administrator sets custom and ready-made dictionaries for content analysis in <b>Security Policies</b>
      </div>"]

   B["<div style='text-align:left; font-size:12px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/user_manual/configuration/filescan.html' style='color:black; text-decoration:underline; cursor:pointer;'>2. Launch Scan</a></b><br/>
      Using the system configuration, the administrator launches a scan on user workstations
      </div>"]

   C["<div style='text-align:left; font-size:12px; line-height:0.9; color: black;'>
      <b>3. Content Analysis</b><br/>
      The system automatically searches for matches and saves the results in <b>File</b> events
      </div>"]

   D["<div style='text-align:left; font-size:12px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/cases/dlp_cases.html' style='color:black; text-decoration:underline; cursor:pointer;'>4. DLP Blocking</a></b><br/>
      The administrator creates blocking rules in the DLP module for scanned files based on their content, attributes, or name.
      </div>"]

   A --> B
   B --> C
   C --> D

   style A fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:12px
   style B fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:12px
   style C fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:12px
   style D fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:12px

   linkStyle 0 stroke:#000000,stroke-width:1px
   linkStyle 1 stroke:#000000,stroke-width:1px
   linkStyle 2 stroke:#000000,stroke-width:1px

The new file scanner scans files with sensitive information based on their tags. The resulting data is used to apply DLP policies. You can tag files in the scanner interface and configure blocking rules on the DLP module page.

        graph LR
   A["<div style='text-align:left; font-size:14px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/user_manual/crawler/crawler_work.html#id12' style='color:black; text-decoration:underline; cursor:pointer;'>1. Category Configuration</a></b><br/>
      The administrator configures scanner file categories to search for files with sensitive information.
      </div>"]

   B["<div style='text-align:left; font-size:14px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/user_manual/crawler/crawler_work.html' style='color:black; text-decoration:underline; cursor:pointer;'>2. Launch Scan</a></b><br/>
      The administrator launches a scan on user workstations
      </div>"]

   C["<div style='text-align:left; font-size:14px; line-height:0.9; color: black;'>
      <b>3. File Search</b><br/>
      An administrator reviews scan results to identify files containing sensitive information.
      </div>"]

   D["<div style='text-align:left; font-size:14px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/user_manual/crawler/crawler_work.html#id28' style='color:black; text-decoration:underline; cursor:pointer;'>4. Scanner Tag Setup</a></b><br/>
      </div>"]

   E["<div style='text-align:left; font-size:14px; line-height:0.9; color: black;'>
      <b><a href='https://docs.staffcop.ru/cases/dlp_cases.html' style='color:black; text-decoration:underline; cursor:pointer;'>5. Blocking Setup</a></b><br/>
      The administrator creates blocking rules in the DLP module based on the tags or content of scanned files.
      </div>"]

   A --> B
   B --> C
   C --> D
   D --> E

   style A fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:14px
   style B fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:14px
   style C fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:14px
   style D fill:#f0f8ff,stroke:none,rx:10,ry:10,width:270px,font-size:14px
   style E fill:#f0f8ff,stroke:none,rx:10,ry