See file uploads without buying a separate DLP product
Data Loss Prevention products historically lived in their own category: Forcepoint DLP, Symantec/Broadcom DLP, Microsoft Purview Information Protection with separate agents, separate consoles, and separate licensing from the session-monitoring tools they run alongside. The capability overlap is real: both are watching the endpoint for evidence of data movement. Syteca’s file monitoring captures the most common DLP signal — file upload operations — through the same Client agent doing session recording, clipboard monitoring, and PAM session capture. Not a full DLP product; doesn’t classify documents or do content-aware inspection. But for “did this user upload anything to a file-sharing service or browser-based form?” it’s enough — and it lives in the same console as the screen capture showing exactly what they uploaded and where.Use file monitoring when you need to:
- Track outbound file movement — uploads via browsers, file-sharing dialogs, email attachments, and the like.
- Catch unauthorized cloud storage use — file-upload events to Dropbox, Box, OneDrive, Google Drive web interfaces.
- Layer visibility on top of EDR/UAM without adding a DLP product to the stack.
- Generate file-upload alerts as part of a broader insider-threat program.
Applies to: Windows Clients, macOS Clients. The configuration procedure differs slightly between platforms (registry on legacy Windows AS,
.config file on current Syteca versions). The macOS Client specifically supports browser-dialog file uploads.Two-step enablement
File monitoring requires both an Application Server-side feature flag and a per-Client checkbox. Skipping either leaves it disabled.1. Enable the feature on the Application Server
The procedure depends on your Syteca version:- Syteca v6.53.1 and later (current)
- Syteca v6.53.0 and earlier (legacy)
Edit the EkranServer.Settings.config file (located in No service restart required — Syteca picks up the new setting on next configuration reload.
C:\Program Files\Ekran System\Ekran System\Server) and add the following key:2. Enable per Client / Client group
After Step 1 is complete, select the Enable file monitoring checkbox on the Editing Client / Editing Client Group page, on the Monitoring [Windows/macOS] tab, in the Monitoring Parameters section at the top.What gets monitored on each platform
Where to view captured file uploads
- Activity Monitoring → File Monitoring tab — list of all File Upload operations performed across monitored Client computers
- Alerts — define File Upload alert rules to trigger on specific upload patterns (filename, target, application)
Alert rules for file uploads
Add or edit an alert on the Alerts page, with rules using the File Upload (Windows and macOS) parameter. The alert can target specific file extensions, target applications, or upload destinations.Related
Clipboard monitoring
Complementary monitoring stream — what users copy/paste.
User activity recording
Screen recording showing the visual context of file uploads.
Alerts
Define File Upload alert rules.
Application Server settings
Other EkranServer.Settings.config keys.