> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/security-and-governance/transfer-shield-dlp/content-rule-groups.md).

# Content Rule Groups

Learn how Content Rule Groups work in Transfer Shield DLP

## Introduction

Content Rule Groups are the primary configuration objects used by Transfer Shield.

Each Content Rule Group contains one or more [Content Rules](/security-and-governance/transfer-shield-dlp/content-rules.md) and defines what Couchdrop should do when those rules match a transferred file.

{% hint style="info" %}
Think of a Content Rule Group as a policy. The group combines the rules you want to enforce with the action Couchdrop should take when those rules match.
{% endhint %}

Only Content Rule Groups can be assigned to folders, users, connections, and other transfer points. Individual Content Rules cannot be assigned directly.

Only the account owner can create, edit, and assign Content Rule Groups.

## Creating a Content Rule Group

Content Rule Groups can be created manually or from a template.

Available templates include:

| Template                  | Description                          |
| ------------------------- | ------------------------------------ |
| **PII**                   | Detects common personal information  |
| **PCI**                   | Detects payment card information     |
| **Malware & Executables** | Detects malware and executable files |

After creating a Content Rule Group, add one or more Content Rules and configure the action Couchdrop should take when the group matches.

## Actions

Each Content Rule Group uses one action when a file is denied by its content rules.

| Action                      | Description                                                               |
| --------------------------- | ------------------------------------------------------------------------- |
| **Require manual approval** | Holds the transfer until an assigned user or group approves or rejects it |
| **Block**                   | Prevents the transfer                                                     |
| **Detect only**             | Records the match without preventing the transfer                         |

For **Detect only** groups, you can optionally send email notifications to selected users or groups.

## Notifications

Transfer Shield notifications are configured on the Content Rule Group.

Available notification events include:

| Event                                 | Description                                      |
| ------------------------------------- | ------------------------------------------------ |
| **File requires approval**            | Sends an email when a file is held for approval  |
| **Content Rule Group match detected** | Sends an email when a Content Rule Group matches |

For Detect only groups, notifications can be sent to specific Couchdrop users or groups.

## Multiple Content Rule Groups

More than one Content Rule Group can apply to the same transfer.

When multiple groups match, Transfer Shield uses the strictest matching action.

A Block match prevents the transfer even when another rule or Content Rule Group allows the file.

## Applying Content Rule Groups in Couchdrop

A Content Rule Group can be assigned to individual transfer points or applied globally across the account.

### Assignment points

Content Rule Groups can be assigned to:

<table><thead><tr><th width="231.93359375">Assignment point</th><th>Description</th></tr></thead><tbody><tr><td><strong>Global</strong></td><td>Applies to all inbound and outbound transfers</td></tr><tr><td><strong>Folders and subfolders</strong></td><td>Applies to files transferred through the selected folder</td></tr><tr><td><strong>Upload links</strong></td><td>Applies to files submitted through upload links</td></tr><tr><td><strong>Mailboxes</strong></td><td>Applies to files received through Couchdrop Mailboxes</td></tr><tr><td><strong>SFTP and FTP users</strong></td><td>Applies to files transferred by selected SFTP or FTP users</td></tr><tr><td><strong>Inbound AS2 stations</strong></td><td>Applies to files received through inbound AS2</td></tr><tr><td><strong>Inbound webhooks</strong></td><td>Applies to files received through inbound webhooks</td></tr><tr><td><strong>Remote SFTP and FTP</strong></td><td>Applies to files sent to remote SFTP or FTP destinations</td></tr><tr><td><strong>Outbound AS2</strong></td><td>Applies to files sent through outbound AS2</td></tr><tr><td><strong>Storage connections</strong></td><td>Applies to files moving through connected storage platforms</td></tr></tbody></table>

### Global Content Rule Groups

A global Content Rule Group applies to both inbound and outbound transfers.

Global groups cannot be configured to apply only to inbound transfers or only to outbound transfers.

### Folder inheritance

Content Rule Groups assigned to a folder also apply to its subfolders.

Subfolders can have additional Content Rule Groups assigned to them.

These additional groups can introduce stricter requirements, but a subfolder cannot remove or override a Content Rule Group inherited from its parent folder.

### Multiple assignments

A transfer can be affected by multiple Content Rule Groups.

For example, a transfer may have:

* A global Content Rule Group
* A folder-level Content Rule Group
* A user-level Content Rule Group

When multiple groups match the same transfer, Transfer Shield uses the strictest matching action.

A Block match always prevents the transfer, even when another applicable rule or group allows it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.couchdrop.io/security-and-governance/transfer-shield-dlp/content-rule-groups.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.