File Search

Overview

File Search helps customers understand the sensitive data risk across files in their cloud office environment. When enabled, Material's File Search syncs file activity, classifies sensitive data, and helps customers identify risky sharing patterns. Material provides out-of-the-box remediation tools for addressing these risks across your most sensitive files.

File Search for Google Drive

Customers with at least one enrolled Google tenant can configure Material to connect to their Google Drive environment. Material supports syncing and sensitive content analysis across both My Drives and Shared Drives, and exposes findings via File Search.

Once enabled, Material File Search starts indexing and analyzing your Google Drive environment. We bias toward processing the most recent business activity, and work backward to build out visibility across the history of your Google Drive environment. Material File Search will sync 6 months of historical activity starting from when you enable syncing, in addition to all new activity while the feature is enabled.

Syncing times vary based on the size and complexity of your Google Drive. But because we start syncing the most recent activity first, most customers can start exploring interesting results within an hour of enabling sync.

Note: File Search is currently only supported for Google Drive environments. We are working on similar functionality for Microsoft 365. If you are interested in providing feedback for our Microsoft offering, please reach out to your customer success team.

Setup & Configuration

Customers can configure File Search manually, or by using the in-product set up guide the first time they visit File Search. Setting up File Search for Google Drive follows three basic steps:

• Granting Scopes
• Enabling My Drive Syncing
• Enabling Shared Drive Syncing

Granting Scopes

File Search requires (2) additional Google Drive scopes to be granted to Material via domain-wide delegation:

• https://www.googleapis.com/auth/drive
• https://www.googleapis.com/auth/drive.activity

Scopes can be granted via Google Admin, and must be granted for each Google tenant you would like Material to sync & analyze.

If you have questions about granting scopes, please contact your Material support team.

Enabling My Drive Syncing

Enabling My Drive Syncing allows Material to sync & analyze files stored in My Drives. If you would like to enable My Drive syncing by default for accounts in your organization, visit:

• Settings > Default Account Settings, then under Syncing, turn File Sync on.

If you have a specific subset of accounts or groups you would like to enable this feature for, use the corresponding Accounts or Groups page to select your target audience. Then select:

• Edit Settings, then under File Sync, select Override File Sync and toggle it On.
• Click Save to save changes.

Enabling Shared Drive Syncing

Enabling Shared Drive Syncing allows Material to sync & analyze files stored in Shared Drives. Because there is no single “owner” of a Shared Drive, Shared Drive Syncing is not tied to a particular Account or Group. Instead, you can enable syncing for all Shared Drives in a tenant, with an option to exclude specific Shared Drives.

Before enabling Shared Drive Syncing, determine if you would like to exclude any Shared Drives from File Search. Reach out to your Material success team to configure exclusions. To verify that Shared Drive exclusions are active, visit:

• Google Drive Security > Settings and review the list of excluded Shared Drives.

To enable Shared Drive Syncing, visit:

• Google Drive Security > Settings and toggle Shared Drive Syncing to On.

If you choose to exclude a Shared Drive at a future date, Material will ignore any new activity from the excluded Shared Drive.

Note: Material will not automatically delete activity or analysis that has already been processed for a Shared Drive that is later excluded. Data that has already been synced will continue to be visible and searchable in File Search.

File Search

Once Google Drive data is syncing, customers can use File Search to write custom queries about their Google Drive environment. Material offers several Suggested Queries to help get you started. Clicking a Suggested Query will automatically populate the search bar, and execute the search.

Search modes

File Search has three modes, which you choose with Search Mode at the top of the search:

• Quick: a form where you search by file name, owner, type, location, sharing, and sensitive-data category, without writing a query.
• Prompt: describe what you're looking for in plain English, without writing a query.
• Query: the full search syntax described below.

Explorer > Files

Prompt mode isn't available if you've opted out of Material's GenAI capabilities.

Every mode supports Save as detection, so you can turn a search you've built into a detection without rewriting it. In Prompt mode that means you can describe the files you want to find in plain language and save that search as a detection directly.

In Quick mode, the Trusted external filter matches files shared externally to a trusted entity, separately from files shared externally in general. In Query mode, use the shared.with_trusted_entity operator.

Explorer > Files

Search Syntax

File Search is a modern search experience that includes syntax suggestions, inline documentation, type-ahead filtering, and query validation to help you easily write powerful queries.

File Search offers (4) core namespaces to help organize your query building blocks. Each namespace has a set of corresponding properties:

Namespace	Description	Examples
File	Search across file metadata and content.	id, name, type, content, and owner
Category	Search for files containing specific sensitive data categories	ssn, credit_card, ein, passport
Shared	Search for files that have been shared in specific ways	externally, with_personal_email, with_public_link
Location	Search for files stored in a specific location	my_drive, shared_drive

When writing a query, all supported namespaces, properties, and operators are suggested to you. In addition, File Search supports and, or, not operators, as well as parentheses (, ).

Validation

As you build your query, the Search button will only be enabled when the query syntax is valid.

Keyboard Shortcuts

You can use your keyboard to quickly build queries. When the suggestion menu is open, you can use the DOWN / UP arrow keys to cycle through available options. Pressing ENTER or TAB will add the currently selected value to your query.

You can dismiss the suggestion menu at any time using ESCAPE. You can reactivate the suggestion menu by pressing DOWN.

You can press ENTER anytime the Search button is enabled to execute the current search query.

Example Queries

Here are a few example queries to help you understand how the search syntax works:

Example: Searching for Sensitive Financial Data, Shared Externally

shared.externally and (category.bank_routing or category.ein or category.financial_report)

Example: Searching for All Sensitive Files an Account Has Access To

shared.has_access:"[e-mail]" and category.any

Example: Searching in Shared Drives for Files Containing SSNs that are Shared with Personal Email

location.is_shared_drive and category.ssn and shared.with_personal_email

For a full list of available search operators, see the File Search Operator Reference below:

File Search Operator Reference

Property	Type	Description
category	object	Search for files based on the kind of sensitive data they contain
category.any	bool	Files containing any category of sensitive data
category.bank_routing	bool	Files containing: US bank routing numbers
category.confidential	bool	Files containing: Information marked as privileged or confidential
category.credit_card	bool	Files containing: Credit card numbers
category.drivers_license	bool	Files containing: Drivers license numbers
category.ein	bool	Files containing: US employer identification numbers
category.financial_report	bool	Files containing: Financial reports such as income statements, balance sheets or projections
category.health_record	bool	Files containing: Health records including lab test results and biometric data
category.iban	bool	Files containing: International Bank Account Number (IBAN) codes
category.passport	bool	Files containing: Passport numbers
category.password	bool	Files containing: Passwords
category.patent	bool	Files containing: Patent documents such as applications and inventor declarations
category.payroll	bool	Files containing: Wages and payroll statements
category.source_code	bool	Files containing: Source code
category.ssn	bool	Files containing: US Social Security numbers
category.swift	bool	Files containing: SWIFT codes
category.tax_document	bool	Files containing: Completed common US Tax Forms such as Form W-2, Form W-9, etc.
file	object	Search for files based on content, owner, and other metadata
file.content	string	Search for files by content
file.created	date	Search for files by created date
file.id	string	Search for files by id
file.labels	array	Search for files with a label
file.last_modified	date	Search for files by last modified date
file.name	string	Search for files by name
file.owner	string	Search for files by owner
file.type	object	Search for files by type
file.type.document	bool	Matches documents (e.g. Google Document, Word Document)
file.type.drawing	bool	Matches drawings (e.g. Google Drawing)
file.type.image	bool	Matches images (e.g. .jpg, .png, .svg, .webp)
file.type.mime_type	string	Search for files matching a mime type string
file.type.pdf	bool	Matches PDFs
file.type.presentation	bool	Matches presentations (e.g. Google Presentation, PowerPoint)
file.type.spreadsheet	bool	Matches spreadshseets (e.g. Google Sheet, Excel)
file.type.text	bool	Matches text files (e.g. .txt, .rtf)
location	object	Search for files based on where they're stored
location.is_my_drive	bool	Search for files that are stored in a user's My Drive
location.is_shared_drive	bool	Search for files that are stored in shared drives
location.shared_drive	object	Search for files that are stored in a specific shared drive
location.shared_drive.id	string	Search for shared drives by id
shared	object	Search for files based on how they've been shared
shared.externally	bool	Search for files that are shared outside the organization in any way (by link or with explicit entities)
shared.with_trusted_entity	bool	Search for files that are shared externally to a trusted entity
shared.has_access	string	Search for files that this email has access to
shared.restricted	bool	Search for files where the general access is restricted to those entities with which the file is explicitly shared
shared.with	object	Search for files that are shared with...
shared.with.domain	string	Search for files that are shared with this entire Google Workspace domain
shared.with.email	string	Search for files that are shared with this email
shared.with.group	string	Search for files that are shared with this group
shared.with_disposable_email	bool	Search for files that are shared with an email address known to be provided by a disposable email service such as Temp-Mail or 10MinuteMail
shared.with_employee_personal_email	bool	Search for files that are shared with a personal email address whose display name or username contains the first or last name of an internal user who has explicit access to the file. Note this does not detect access to the file via group or organization membership.
shared.with_org	bool	Search for files that are shared with the organization
shared.with_personal_email	bool	Search for files that are shared with an email address with a domain typically used for personal email accounts (e.g. gmail.com, yahoo.com)
shared.with_public_link	bool	Search for files that are publicly accessible to anyone with a link
shared.with_sanctioned_country_tld	bool	Search for files shared with top-level domains associated with a country with comprehensive US sanctions (complete list here)

FAQ

What file types are supported?

File Search supports the most common cloud office documents, including native Google file types {Google Docs, Google Sheets, Google Slides}, Microsoft Office documents, and common file types like PDF, CSV, and various images. We are extending file type support all the time. In general, we do not process video files or large binary files.

Are there file size limitations?

File Search looks across your entire Google Drive footprint to help provide visibility. We actively process files up to 10 MB in size for sensitive content, and sync metadata to make all other files searchable.

How often does Material scan for new sensitive content or sharing?

Material scans for changes in sensitive content and sharing based on document activity, not on a fixed refresh interval. When a change happens in Google Drive, we process that event and rescan for sensitive content whenever appropriate.

How far back does Material scan historically?

Material has access to 6 months of activity data for Google Drive, as limited by Google's APIs. We also sync all new activity for as long as the feature is enabled. Note that this historical sync is based on activity, not file age. If a file that was created 10 years ago has been modified in the last 6 months, we scan it. And anytime an older file is touched going forward, we will also scan it. Over time, this allows us to cover the vast majority of your entire Google Drive footprint.

What types of sensitive data does Material scan for?

Material scans for (16) built-in Sensitive Content Categories. A full list of current Categories is available as part of the suggestion menu in File Search, under the category namespace.

Can I save queries as part of File Search?

We do not currently support saved queries. To reuse a search, save it as a detection instead.

Why can’t I see a file preview from the Material Admin UX?

Material currently supports previewing file types that support text extraction, which means we don't preview images today. We also give plain text previews of files like PDFs. We will be continuing to add additional support for previewing richer file types over time.

Are Google Workspace domains and DNS domains the same thing?

They are related but not entirely the same. shared.with.domain refers to the concept of a Google Workspace domain that is configured as a trusted domain in your Google Drive sharing settings. If you want to search for a file shared with any email address ending with a particular DNS domain such as example.com, perform a search using the contains operator such as shared.with.email:~"@example.com" .

---

Appendix

Top Level Domain (TLD) List for shared.with_sanctioned_country_tld

Cuba	.cu
Iran	.ir
North Korea	.kp
Russia	.ru
Syria	.sy