Auditing File Uploads (with view to block using Application Rule)

[Eric_Knopp]

Gateway version - R81.20 T99; SMS management - R82, including Log Server and Smart Event.

We have an audit finding that would like us to "research ways to enhance controls preventing data uploads to unauthorized websites." There's a great Tag called "File Uploads" that we can use in a Block rule, but I want to be able to audit which sites are currently being used in our organization that would fit into the File Uploads category. I want to research which business approved sites would be blocked using this category, so we can create specific accepts above the block rule. We currently block most File Storage and Sharing sites across the organization.

I've tried searching the logs for category:"File Upload", tags:"File Upload" and cannot find any logs in our log server that match those categories. I thought I could add an Accept Rule for that tag/category in the App Control rulebase, but that may allow users to upload to file storage sites we do not want them to access.

[the_rock]

Very interesting question. Let me play around with this in my lab and see how far I get.

Andy

[PhoneBoy]

You can see what apps we include as part of File Upload on AppWiki by simply searching for the tag "File Upload" of which there appear to be 250.