Content Rule Groups

Learn how Content Rule Groups work in Transfer Shield DLP

Introduction

Content Rule Groups are the primary configuration objects used by Transfer Shield.

Each Content Rule Group contains one or more Content Rules and defines what Couchdrop should do when those rules match a transferred file.

Think of a Content Rule Group as a policy. The group combines the rules you want to enforce with the action Couchdrop should take when those rules match.

Only Content Rule Groups can be assigned to folders, users, connections, and other transfer points. Individual Content Rules cannot be assigned directly.

Only the account owner can create, edit, and assign Content Rule Groups.

Creating a Content Rule Group

Content Rule Groups can be created manually or from a template.

Available templates include:

Template	Description
PII	Detects common personal information
PCI	Detects payment card information
Malware & Executables	Detects malware and executable files

After creating a Content Rule Group, add one or more Content Rules and configure the action Couchdrop should take when the group matches.

Actions

Each Content Rule Group uses one action when a file is denied by its content rules.

Action	Description
Require manual approval	Holds the transfer until an assigned user or group approves or rejects it
Block	Prevents the transfer
Detect only	Records the match without preventing the transfer

For Detect only groups, you can optionally send email notifications to selected users or groups.

Notifications

Transfer Shield notifications are configured on the Content Rule Group.

Available notification events include:

Event	Description
File requires approval	Sends an email when a file is held for approval
Content Rule Group match detected	Sends an email when a Content Rule Group matches

For Detect only groups, notifications can be sent to specific Couchdrop users or groups.

Multiple Content Rule Groups

More than one Content Rule Group can apply to the same transfer.

When multiple groups match, Transfer Shield uses the strictest matching action.

A Block match prevents the transfer even when another rule or Content Rule Group allows the file.

Applying Content Rule Groups in Couchdrop

A Content Rule Group can be assigned to individual transfer points or applied globally across the account.

Assignment points

Content Rule Groups can be assigned to:

Assignment point	Description
Global	Applies to all inbound and outbound transfers
Folders and subfolders	Applies to files transferred through the selected folder
Upload links	Applies to files submitted through upload links
Mailboxes	Applies to files received through Couchdrop Mailboxes
SFTP and FTP users	Applies to files transferred by selected SFTP or FTP users
Inbound AS2 stations	Applies to files received through inbound AS2
Inbound webhooks	Applies to files received through inbound webhooks
Remote SFTP and FTP	Applies to files sent to remote SFTP or FTP destinations
Outbound AS2	Applies to files sent through outbound AS2
Storage connections	Applies to files moving through connected storage platforms

Global Content Rule Groups

A global Content Rule Group applies to both inbound and outbound transfers.

Global groups cannot be configured to apply only to inbound transfers or only to outbound transfers.

Folder inheritance

Content Rule Groups assigned to a folder also apply to its subfolders.

Subfolders can have additional Content Rule Groups assigned to them.

These additional groups can introduce stricter requirements, but a subfolder cannot remove or override a Content Rule Group inherited from its parent folder.

Multiple assignments

A transfer can be affected by multiple Content Rule Groups.

For example, a transfer may have:

• A global Content Rule Group
• A folder-level Content Rule Group
• A user-level Content Rule Group

When multiple groups match the same transfer, Transfer Shield uses the strictest matching action.

A Block match always prevents the transfer, even when another applicable rule or group allows it.