> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/file-data-security.md).

# File Data Security

#### Overview <a href="#h-overview" id="h-overview"></a>

Automated File Detection & Response allows customers to automate enforcement actions across Google Drive to continuously protect against unwanted sharing and excessive permissions. Customers are able to :

* Create and save file search strings as detections
* Configure automated remediation flows for a detection
* Choose from email, grace period, and revoke external access to build a remediation
* View & manage detection matches and insights in the issues UI

#### Instructions <a href="#h-instructions" id="h-instructions"></a>

A. Create a new detection:

1. Navigate to Data Protection within Settings.
2. Select Detections below Data Protection.
3. Click on Create New Detection in the top right of the page.
4. Enter a name and description of your choice.
5. Enter your Detection criteria using our search UX and prompts . This will start to populate matching results for preview.
6. Click on Create Detection to save.
7. On the right hand panel - you can toggle the enabled button to activate/deactivate the detection.
8. On the right hand panel- click on Add Remediation to start building your remediation workflow. Follow step B for individual remediation configurations.
9. You can choose between email, grace period and revoke external access.

B. Remediations:

1. Once you click on Add Remediation you will be able to choose between the different remediation types. You can repeat this for each step in your remediation workflow. Note: The first step cannot be a grace period and if revoke external access is used it is the last step in the workflow.
2. Click on email remediation/grace period/Revoke external access from the dropdown and continue with the corresponding instructions. A. Email Remediation : Choose amongst file owners for mydrive, shared drive admin per your settings, security team & individual account email as recipients. Customize email content per your preference and click on save. B. Grace Period : Choose from time periods listed in the dropdown or customize to a duration of your choice. Click on Save. C. Revoke External access : Type in any external domains you want to keep access for in the external domain access field. Choose if you would like to update general settings or keep them as they are. Click on save.
3. You can view your complete remediation flow on the right hand panel.

C. Activate your file detection and response:

1. Once you have configured your detection criteria and remediation workflow, you can activate the remediation and detection when ready.
2. Turn on the toggle for remediations - this will execute the workflow for every file that matches the detection criteria.
3. Set the detection to enabled. When prompted for historical sync, choose yes if you want to apply the detection to previously synced files. If not, detection will apply to all new file activity moving forward by default.
4. You are now ready to use your file detection & remediation. Issues will start getting created and show up under Data Protection -> Issues.
5. Please repeat the steps here for any file detection you want to build.

D. Viewing and managing issues:

1. Once your file detections and response are active, issues will get created and be available under Data Protection-> Issues. An issue is unique to the combination of file and detection.
2. Issues are grouped by detection as default, you can choose to change this to no grouping in the top right of the page.
3. Once you click on an individual issue, you can view the remediation history, remediation summary and the issue status.
4. Issue status: A. Issue status types - Open, In progress, Ignored, Resolved B. An issue stays open as long as the detection criteria stays true and is resolved when it is no longer true. These checks are performed any time there is new file activity. C. If you would like to pause the automated flows for an issue, you can change issue status to ignored with reasons including false positive. D. If you want to mark an issue as being worked on you can switch it to in progress. E. Issue options will continue to expand in upcoming releases to offer a wide range of capabilities.

E. Other product information:

1. As part of our detections functionality, you will be able to use pre-built detections available in the product. For Okta customers : The detection named ‘File shared externally by Okta off-boarded account’ identifies externally shared files owned by users suspended in Okta. You can customize the remediation flow per the steps in part B. This detection can be used to enhance your offboarding flows with Google Drive.
2. Example configuration - A. Detection criteria : category.any and shared.externally B. Remediation : Email file owner , Grace period 1 day, Email security team, Revoke external access


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/file-data-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.