Copying or moving discovered files

Administrator Help | TRITON AP-DATA | Version 8.3.x

You can copy or move sensitive content (files) when it is discovered. TRITON AP-DATA provides the following remediation scripts for the most common actions you may need to perform.

CopyFiles - Copies files that are in breach of corporate policy to another directory. Within the CopyFiles script file, users can define to ignore files that have not been accessed in X number of days.

MoveFiles - Moves (not copies) files that are in breach of corporate policy to another directory for quarantine. In the original location, the file is replaced with a text message: "This file was detected to contain content that is a breach of corporate policy and thus has been quarantined. For more information please contact your system administrator". Within the MoveFiles script file, users can define to ignore files that have not been accessed in X number of days.

Note the following:

These remediation scripts are provided only for network file system discovery, discovery on endpoint systems and SharePoint.

The scripts can be used for endpoint or policy remediation, but not for remediation instigated during incident management.

Support for endpoint discovery is limited. The scripts assume that the endpoint always has access to the quarantine folder. If the quarantine folder is outside the network, the operations will not work.

The scripts cannot be used for Exchange, Outlook PST, or database discoveries, and they cannot be used for local versions of SharePoint.

These scripts are just common examples of what can be done with remediation scripts. You can write any remediation script you need to in order to perform an action on discovered incidents, such as encryption or DRM-integration.

See Preparing and running the remediation scripts for instructions on using these scripts.