Access types
All access types detected by FileAudit for Windows file servers and supported cloud storage providers.
An access type represents a specific operation on a file or folder that FileAudit detects and records as an event. Each event in FileAudit is associated with one access type (Read, Write, Delete, etc.) that describes what the user attempted or performed.
The available access types differ between Windows file servers and cloud storage providers because the underlying audit mechanisms are different:
Windows relies on the NTFS security audit log, which captures both successful and denied attempts.
Cloud providers expose activity through their own APIs, which only report operations that were actually authorized: if a user lacks permission to see a file, no event is generated.
Note
For details on how each audit source collects events, see Windows audit and Cloud audit.
FileAudit detects the following access types on Windows file servers. Each type corresponds to an operation captured by the NTFS security audit log.
Access type | Description |
|---|---|
Read | A user attempted to open a file in read mode. |
Write | A user attempted to modify a file. |
Delete | A user attempted to delete a file or folder. |
Execute | A user attempted to execute an executable file. |
Rename | A user attempted to rename a file. |
Move | A user attempted to move a file or folder. |
Permissions | A user attempted to change the permissions on a file or folder. |
Ownership | A user attempted to take ownership of a file or folder. |
Write attributes | A user attempted to modify a file attribute (such as Read-only or Hidden). |
Note
An event is generated for every attempted access, regardless of outcome.
If a user without sufficient privileges attempts to delete a file on a monitored folder, FileAudit records a Delete event with a Denied status.
Use the Status column in Reporting or Alerts to distinguish successful operations from denied attempts.
Box exposes file activity through its Events API.
The following table lists the access types FileAudit can detect for Box.
Access type | Supported | Notes |
|---|---|---|
Read | ✅️ | From web site only. |
Write | ✅️ | |
Delete | ✅️ | |
Move | ✅️ | |
Copy | ✅️ | From web site only. |
Create | ✅️ | |
Rename | ⛔️ | Not available from Box. |
Download | ✅️ | |
Shared | ⛔️ | Not available from Box. |
Unshared | ⛔️ | Not available from Box. |
Destroy (from trash) | ⛔️ | Not available from Box. |
Restore (from trash) | ⛔️ | Not available from Box. |
Revert | ⛔️ | Not available from Box. |
Lock | ✅️ | Exclusive to Box among supported providers. |
Unlock | ✅️ | Exclusive to Box among supported providers. |
Dropbox exposes file activity through its audit log.
The following table lists the access types FileAudit can detect for Dropbox.
Access type | Supported | Notes |
|---|---|---|
Read | ✅️ | From web site only. |
Write | ✅️ | |
Delete | ✅️ | |
Move | ✅️ | From web site only. |
Copy | ✅️ | From web site only. |
Create | ✅️ | |
Rename | ✅️ | |
Download | ⛔️ | Not available from Dropbox. |
Shared | ✅️ | No real-time notification. The sharing event is reported with the next detected event. |
Unshared | ✅️ | From web site only. |
Destroy (from trash) | ✅️ | From web site only. |
Restore (from trash) | ✅️ | From web site only. |
Revert | ✅️ | Exclusive to Dropbox among supported providers. |
Google Drive exposes file activity through the Google Workspace Activity API.
The following table lists the access types FileAudit can detect for Google Drive.
Access type | Supported | Notes |
|---|---|---|
Read | ✅️ | From web site only. |
Write | ✅️ | |
Delete | ✅️ | |
Move | ✅️ | |
Copy | ✅️ | From web site only. |
Create | ✅️ | |
Rename | ✅️ | |
Download | ✅️ | |
Shared | ✅️ | |
Unshared | ✅️ | |
Destroy (from trash) | ✅️ | From web site only. |
Restore (from trash) | ✅️ |
OneDrive and SharePoint Online expose file activity through the Microsoft 365 audit log.
The following table lists the access types FileAudit can detect for OneDrive.
Access type | Supported | Notes |
|---|---|---|
Read | ✅️ | From web site or Office 2016 app. |
Write | ✅️ | |
Delete | ✅️ | |
Move | ✅️ | |
Copy | ✅️ | From web site only. |
Create | ✅️ | |
Rename | ✅️ | |
Download | ✅️ | |
Shared | ✅️ | |
Unshared | ⛔️ | Not available from OneDrive. |
Destroy (from trash) | ✅️ | From web site only. |
Restore (from trash) | ✅️ | From web site only. |
Check In | ✅️ | A user checked in a file in SharePoint Online. |
Check Out | ✅️ | A user checked out a file in SharePoint Online. |
Undo Check Out | ✅️ | A user discarded a check out of a file in SharePoint Online. |