When content scanning is enabled for prevention, content is scanned only in Windows Explorer environment. If a user is using any other environment (e.g. using CMD to move files in Windows or using the Terminal app in Mac), the file will not be scanned and the operation will be automatically blocked.
Block actions due operation performed using methods other than Windows File Explorer are not reported as an activity.
If a user is using any other environment, the file will not be scanned and it will be automatically blocked as shown in the Windows example below.
If there are multiple files, all files are scanned. A pop-up displays showing the progress of the scanning process. If at any point, you want to abort the process, a cancel option is available on the pop-up.
When the process is complete, a notification is displayed.
Files from Exit Points
When Content Scanning for Prevention is enabled and the user attempts to open a file from an exit point, the file is opened in view mode only. A notification is sent to the user indicating the file is permitted for viewing only.
If the user want to modify the file, it is recommended to first copy the file to the local drive, make the changes and then use Windows Explorer to copy the file again to the original path in the exit point.
End User Experience with Web Upload Prevention
Resume Web Upload
Available for Windows from version 2.5. For Mac Agents, this feature is available on request only. Contact your Proofpoint representative.
When Resume Web Upload is turned on, Web Upload action is resumed after file processing, without end user interaction or with only minimal end user interaction.
With Resume Web Upload, when an end user attempts to upload files to the Web and a prevention rule with content scanning is applied, the Agent cancels the user upload action and then freezes the Web browser window. The Agent can then recreate and resume the upload action after file processing.
During the freeze, any key strokes and any mouse clicks will be ignored. End users can however, continue to work on other applications (including another Web browser instance) in other Windows.
When the Agent completes the file processing, if the end user has remained in the Web browser window (the initial windows stayed in focus), the Agent will unfreeze the window and automatically complete the upload action without any user interaction.
If during freeze, the end user moved to another window (the initial window lost focus), at the end of file processing, a message notification prompts the end user to confirm the upload. The Agent then unfreezes the Web browser window and resumes and completes the upload action automatically.
The behavior is turned on/off at the Realm level. From Processing in the Agent Realm, turn on Prevention Enabled and turn on Resume web upload operation automatically.
For Windows, this feature supports File Picker and Drag & Drop and Paste Keyboard shortcut (Ctlr +V), uploading via Paste and Right-click paste.
For Mac, this feature supports Drag & Drop a, Command + V, Control-click (or right-click) the item you selected, Paste from the shortcut menu.
In Mac, on Drag & Drop action, both the Web Browser and Finder windows are frozen until file scan is completed.
If Resume Web Upload is not turned on, the maximum of files in a single upload is limited to 50 files.
Resume web upload is limited to a maximum of 1000 files in a single upload operation
Web Upload without Resume Web Upload
This feature is available for Windows only.
If Resume Web Upload is not turned on, when an end user attempts to upload files to the Web, after the Agent completes the file processing, the end user must reselect the files and repeat the upload action.
When content scanning is enabled and an end user uploads files to the Web, the Agent first scans the files and blocks any files with data you defined in the rule.
If the scan completes successfully, a notification displays and the end user is prompted to upload the files.
If any file fails the scan, a notification displays listing which files passed the scan and which files failed. The operation will cancel if any file fails the scan.