Classify a file and choose who may open it
Set a label, choose an audience, update it later, and ask the station for a masked excerpt. The file stays on the station.
Classify a file and choose who may open it
A classification is a label plus a fingerprint. TAO publishes that label to every entitled station. The file itself is not uploaded, and a later discovery pass does not put an older label back after an operator has locked it.
You can classify from a finding, or set the label for a file the station has already reported. The default label is Sensitive.
Who may open it
The list under Who may open it is the groups stations have already seen on a signed-in session. A Windows entry is the group's security identifier. A Linux entry is the group name, exactly as the station reads it. FileGuard does not sync Active Directory, and these groups are not the device groups under Managed devices.
- Leave every group clear. The organization switch for blocking exfiltration decides what happens next. When that switch is on, a labeled file is blocked from leaving.
- Select one or more groups when only those people may open the file. Everyone outside that set is blocked. People in the set follow the same organization switch.
The names you see are display labels. The value TAO enforces is the identifier behind the name. At the moment of a decision, TAO reads the groups of the person at the keyboard.
Classify, update, dismiss
- Open FileGuard → What stations found.
- Set the label.
- Choose the audience, or leave it empty.
- Choose Classify. The row confirms the save. Stations recognize the file on the next check-in.
Update label writes a new label or a new audience for a file that is already classified.
Dismiss drops the finding. It removes a discovery label that an operator has not locked. It does not remove a label an operator classified.
Masked excerpt
See a masked excerpt is for a finding whose match was not certain. The station checks about once a minute, masks the sensitive part, and the passage appears on the row. It disappears after 15 minutes.
If the passage would still contain a secret after masking, the station keeps the text and the row says so. That is a successful answer: the excerpt was refused, not lost.
Use the excerpt to decide the label. Do not treat it as a stored copy of the file.